The Internet of Things Is Wildly Insecure — And Often Unpatchable

[Duke_Nukem]

Were at a crisis point now with regard to the security of embedded systems, where computing is embedded into the hardware itself — as with the Internet of Things. These embedded computers are riddled with vulnerabilities, and theres no good way to patch them.

Its not unlike what happened in the mid-1990s, when the insecurity of personal computers was reaching crisis levels. Software and operating systems were riddled with security vulnerabilities, and there was no good way to patch them. Companies were trying to keep vulnerabilities secret, and not releasing security updates quickly. And when updates were released, it was hard — if not impossible — to get users to install them. This has changed over the past twenty years, due to a combination of full disclosure — publishing vulnerabilities to force companies to issue patches quicker — and automatic updates: automating the process of installing updates on users computers. The results arent perfect, but theyre much better than ever before.

But this time the problem is much worse, because the world is different: All of these devices are connected to the Internet. The computers in our routers and modems are much more powerful than the PCs of the mid-1990s, and the Internet of Things will put computers into all sorts of consumer devices. The industries producing these devices are even less capable of fixing the problem than the PC and software industries were.

The Internet of Things Is Wildly Insecure — And Often Unpatchable

Bruce Schneier lets it fly at IoT and rightfully so, but will it change anything? Security is and always has been a last tier feature and among the first cut at even the slightest hint of budget, time or resource shortfalls, but 50 Billion easily hackable and perhaps even non patchable devices by 2020 is a very frightening concept.

[Cuno]

@Duke Nukem

Security is and always has been a last tier feature and among the first cut at even the slightest hint of budget, time or resource shortfalls

Indeed. Few businesses seem to have an idea how to even think about and decide on embedded security, e.g., how to assess potential security threats. Often, device security appears to be more of a fig leaf requirement (“we need to show at least something, in case our devices become hacked and the media get wind of it”).

Nevertheless, we think embedded security will inevitably become more important, and therefore have begun to investigate this topic quite thoroughly. We focus on single-chip microcontrollers, where e.g. using OpenSSL is out of the question. We’ll see where this leads us.