RogerBW's Blog

This has been a year when "Internet of Things" devices became relatively mainstream. Oh dear.

I feel strongly about this because it has the potential to be done well, and isn't being. I already think in terms of headless clients where possible, and I've built various devices round Raspberry Pi and similar machines. But things sold as "IoT Devices" generally don't work that way. I have two basic problems with all this.

First is that they are typically closed platforms at best. Sure, you can have this device, but you can only control it from our smartphone app or web site. So you need an account with us, and we will track everything you do with the the thing we sold you. Or that you do merely in the same room as it. Did you not want to consent to that? Too bad, you can't use our device. Did you want to mix devices from different manufacturers? We will rewrite our code to stop you. If we decided not to encrypt our communications, you can't wrap them in a VPN tunnel or even rewrite the code to use HTTPS. If we get bored and stop providing the servers to make older devices work, you have to buy a new one.

Second is security. Well, this is the obvious one. By definition an IoT device must expose an IP stack. An IP stack can have bugs in it, and always does. If you're a sysadmin, think about how often you have to patch flaws, and then remember that most IoT devices are never updated. Remember all those Windows NT zombies? This is a whole lot worse.

What's worse, the code being written for these machines is not being security-checked by people who know what they're doing before it's released to the world. Often it doesn't meet even basic standards, like the Samsung smart-fridge that didn't bother to validate SSL certs, allowing man-in-the-middle attacks against any connection it made – such as a Google Calendar login to display your schedule for the day. Oops, there goes your Google password. SSL is hard! Time to buy some more eggs! And let's not even talk about the pacemakers (even if the main researcher did conveniently die just before revealing the details). Or the baby monitors. Or the dolls.

So what's to be done? Don't allow unmaintained devices into your life if they can talk to the outside world, or even your local network. If you aren't keeping it up to date with security fixes, is anyone? Do you trust them? Do you trust the people who are going to buy that company next week? If you can't change its behaviour, you don't own it - the company does. If you must put up with such a device, isolate it from the rest of the net and only allow it to talk to your own hosts, which may choose to pass on messages to or from the outside world. (A Raspberry Pi firewall for every Hello Barbie?)

And build your own if you can, or look for builders who know at least the basics of security. At this point there's so much garbage out there that even simply not having an easily-guessed default password will lift your device out of the mass of targets.

Yeah, I do actually want full control over the lights in my house from a single point, so that the last person to bed can command all of them off at the end of the day – or we can carry RFID tags so that lights come on when we walk into a room and go off when we leave. But I also insist on being able to get at the code that drives that, and to update the servers myself. I don't mind turning my home into a datacentre if I can admin the machines that live there.

What I want generically is not an Internet Thingy but a USB Thingy that I can connect to the Internet, via a real computer with real security, if I want to.