Vint Cerf: 'The internet of things needs to be locked down'
Your air conditioner is a national security threat
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
RSA 2013 Device manufacturers who are sticking internet connections into everything from TVs to toasters need to lock down their systems with strong authentication, Google's chief internet evangelist Vint Cerf warned the RSA keynote audience.
Cerf said he was "frankly astonished" at the range of devices that now come with an internet connection. Back in the 1980s at the Interop conference, people used to joke about having an internet-enabled toaster, but you can now buy one in the shops. Internet-enabled air conditioners, light bulbs, and fridges are all available.
But there has been very little work to lock down these devices, Cerf said, and this must be addressed. While an internet fridge isn't much of a threat, it and other systems could be hacked, and the results could range from the simply irritating to the catastrophic.
He cited the use of internet-equipped air-conditioning systems. If a hacker could get control of the nation's aircon units, and cycle between shutting them down and whacking them up to full, you might be able to crash the US power grid, Cerf suggested.
Such a possibility is remote, and would be well in the future, but requires thought now, he said. Just as encryption that relies on factoring needs to fear the looming threat of quantum computing, so too the internet of things needs to be equipped with much stronger authentication, he concluded. ®
Bootnote
The internet-equipped toaster has become the stuff of technology legend, but one was actually built in 1990, after the president of Interop Dan Lynch bet John Romkey, who built the first TCP/IP stack for IBM PC in 1982, that he couldn't manage to build one. If he could manage it, Lynch promised him a top keynote spot at the following year's conference.
Never one to back away from a tech challenge, Romkey and a friend took a Sunbeam Deluxe Automatic Radiant Control Toaster and added TCP/IP and a Simple Networking Management Protocol Management Information Base controller. It went on display in 1990, and got an upgrade in 1991 with the addition of an internet-controlled robotic arm to load it with bread.
COMMENTS
Re: WTF?
"Yes, but the ultimate goal is that you don't ever have to go home. You will be able to do everything you normally do, including watching TV with the security camera's over the net, that it will be possible for you to stay at work 24/7."
Such is modern life. We have ansamachines to speak to people we don't want to talk to. We have PVRs to watch TV we dont want to watch. We have freezers to store food we have little intention of eating. We have social networks for dealing with people we don't want to meet in person. We have inboxes for messages from people we don't want to hear from. Now we're heading towards having machine doing most of the living in our houses that we're not in most of the time.
It's all very convenient!
Re: WTF?
The "personnel on station" are the end users. These are devices for home use, "tell your home to prepare as you drive, and it's comfortable, your favourite music is playing, and you meal is ready when you arrive". The only way these will get secured is if the manufacturers build in security as the default.
I suspect that the novelty of arriving home to a cacophony of pets disturbed by the sudden music who have eaten the toast again and an enormous electricity bill because the windows were left open will quickly wear off, but by then the devices manufacturers will have made their profit, and the devices will still be vulnerable when you are not using the features.
Re: WTF?
"Even IF you only put it on an internal network, that network is still susceptible to using an intermediary to "hop the airgap,""
That's it! It's Battlestar Galactica mode from now on. Henceforth, communications will take place only via little slips of paper sent through pneumatic tubes! Regrettably, this means I will be unable to further discuss the issue. It has been a pleasure working with you, gentlemen.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
