Thinking of buying that Skype-enabled smart TV? Bad move bud, you’re inviting all sorts of hackers, spy agencies, feds, and other undesirables directly into your living room.
Once upon a time in 2003, the FBI sought permission to wiretap an OnStar-like device in a car… except it wasn’t wiretapping communications, it was turning the device into an always-on microphone that got piped directly to FBI HQ. And they didn’t seek permission, they coerced the manufacturer into helping them, concluded their surveillance, then asked the court later. Oops.
A recent report, released by “the Berkman Center for Internet & Society at Harvard University” said:
A plethora of networked sensors are now embedded in everyday objects. These are prime mechanisms for surveillance: alternative vectors for information-gathering that could more than fill many of the gaps left behind by sources that have gone dark – so much so that they raise troubling questions about how exposed to eavesdropping the general public is poised to become.
The report itself is a very interesting read, and surprisingly unbiased; I’d recommend reading the full thing if you have 20 mins to spare.
In short: who cares if you’re using Signal if your TV can just listen in on your conversation? Why bother with PGP if your Wi-Fi enabled anytime-vlogging necklace can just read your emails off your screen? Is there a point to avoiding Windows 10 if your voice-activated Twitter-enabled fridge is reporting everything you do in your kitchen anyway? Ignoring, for a second, that The Greatest Surveillance Tool of All Time rarely leaves you pocket: a microphone, two cameras, a GPS chip, and even an always-on data connection!
Our glorious government’s been getting assblasted by the recent we-do-encryption-too–no-backdoors-we-swear corporate meme, but that’s sadly about to become irrelevant as IoT becomes more prevalent. The Xbox One was a fairly good test of how the public would react to inserting a surveillance device directly into their living room (I still get creeped out when I enter a room and see that thing looking back at me), and according to MS, the “vast majority” of people who bought an Xbone with a Kinect still use it (although, MS is “decommissioning” certain Kinect features like gesture control for menus, so I’d read the preceding statement as “left it plugged in but don’t really use it”). As Wi-Fi enabled everything becomes the new cool thing to have, we’ll keep seeing more and more stories about exploits in poorly-written firmware. Then one day, some whistleblower will drop a story about some agency having recorded everything you said in your livingroom over the last decade and everyone will be all surprised all over again.
Sounds bleak right? There are a few things you can do though:
- Try to avoid IoT-esque devices for “nifty” features. Do you really need to control your house temperature from your phone, at the expense of your house “occupancy metadata” being available?
- If you’re using a device in a LAN context, don’t let it talk to the outside world. If you like turning on your blender with a button in your bathroom, that’s cool. But no, the blender does not need 24/7 internet connectivity to “check for updates”. Least amount of access necessary is good secsec anyway.
- If your device needs to talk to someone external, firewall it down to just the people it should be talking to (you do have a hardware firewall at the edge of your network, right?). If your toilet posts to Twitter, there’s no reason for it to be talking to anyone but Twitter.
- If you need to connect to your device from outside your LAN, do yourself a favor and set up a VPN server on your network. Exposing these IoT devices to the outside world is a terrible, terrible idea considering that they often offer no authentication past a basic username and password, and are often hilariously insecure. Personally, I make a single RPi available to the outside world, which I OpenVPN to (using PKI) (this is a one-button connection on my phone), then I access all internal services from there.
- Unplug your Xbone Kinect. Plug it in when you’re using it. And for the love of god, rip the OnStar module out of your car.