Phil Neray of Q1 Labs, an IBM (IBM) company posted that in the recent Chinese hack of the U.S. Chamber of Commerce’s network, one attack vector was a thermostat. The thermostat at a Chamber town house on Capitol Hill which was communicating with an Internet address in China and a printer spontaneously started printing pages with Chinese characters (rb- I wrote about securing printers here).
The blog says the fact that the hackers were in the network for more than a year before being detected is not unusual. Mr. Neray cites the 2011 Data Breach Investigations Report, more than 60% of breaches remain undiscovered for a period of months or longer (versus days or weeks).
rb-
This is one of the risks of the Internet of Things. Security is in the era of IoT will have to use machines to monitor the machines.
Spencer Ackerman at Wired points out that more personal and household devices are connecting to the internet, forming the Internet of Things and U.S.CIA Director General David Petraeus cannot wait to spy on you through them.
General Petraeus recently spoke about the “Internet of Things” at a summit for In-Q-Tel, the CIA’s venture capital firm. “‘Transformational’ is an overused word, but I do believe it properly applies to these technologies particularly to their effect on clandestine tradecraft” the blog recounts.
Mr. Ackerman predicts that people will be sending tagged, geolocated data that a spy agency can intercept in real-time when they open their Sears (SHLD) Craftsman garage door with an app on an Apple (AAPL) iPhone. “Items of interest will be located, identified, monitored, and remotely controlled through technologies such as radio-frequency identification, sensor networks, tiny embedded servers, and energy harvesters — all connected to the next-generation internet using abundant, low-cost, and high-power computing,” Petraeus said, “the latter now going to cloud computing, in many areas greater and greater supercomputing, and, ultimately, heading to quantum computing.”
Wired says the CIA has a lot of legal restrictions against spying on American citizens. But collecting ambient geolocation data from devices is a grayer area, especially after the 2008 carve-outs to the Foreign Intelligence Surveillance Act. Hardware manufacturers, it turns out, store a trove of geolocation data; and some legislators have grown alarmed at how easy it is for the government to track you through your Apple iPhone or Sony (SNE) PlayStation.
rb-
The implications of the “Internet of Things” is profound when linked the transformational nature of the interconnected home network. The CIA sees great opportunity in wired home devices. Any home gadget with RFID, sensor networks, embedded servers, or energy harvesters is ripe for interception by spy agencies.
Koubachi, the Swiss start-up company behind the popular iPhone plant care assistant presented its newest innovation at CeBIT 2012 in Hannover: the Koubachi Wi-Fi Plant Sensor according to ITnewsLink.
Building on the success of its popular interactive plant care assistant, Koubachi launched a Wi-Fi Plant Sensor that integrates into the Koubachi system to literally gives your plant a voice.
The Wi-Fi Plant Sensor measures soil moisture, light intensity and temperature. Using Wi-Fi, the data is sent to the Koubachi cloud, where it is analyzed by the Koubachi Plant Care Engine. The plant owner gets a detailed care instructions on watering, fertilizing, misting, temperature and light through push notifications or email. “The Koubachi Wi-Fi Plant Sensor is the first device ever that enables real-time monitoring of the plant’s vitality” says Philipp Bolliger, CEO of Koubachi, “It’s a truly unique product in the field of “Internet of Things” and bringing state-of-the-art technology to plant care.”
Manufacturers are “future-proofing” their appliances with “Internet of Things” capabilities that are latent for now. Christopher Mims at MIT’s Technology Review asserts that major appliances bought in the last three years probably contain a Zigbee capable wireless radio that can send out information about a device’s status and energy use and receive commands that alter its behavior.
Many appliance makers don’t announce these capabilities, Mike Beyerle, an engineer at GE (GE) whom Mr. Mims interviewed about GE‘s Nucleus home energy management system. “We want to build up a base before we make a big deal out of it,” says Mr. Beyerle.
The author says that manufacturers aren’t telling consumers what their devices are capable of because, in part, those abilities are useless without an energy management hub like GE’s Nucleus or a utility company‘s smart meter. In both cases, smart appliances must be “bound” to a hub to communicate with the outside world.
Once a device is hooked up to an energy management system and become part of the IoT, it get interesting. Mr. Mims says that users who signed up for a “demand response” program with their utility to get a lower bill, enable the utility to control their appliances. For example a refrigerator’s ice maker’s defrost cycle or the elements in a clothes dryer can be manipulated to drive down power use during times of peak demand.
rb-
Most people do not realize that installing a new smart meter can activate a technological sleeper cell in their HDTV, kitchen or laundry room. All of these “smart” devices will be part of the “Internet of Things.” They will have an IP address (probably an IPv6 address) and will be broadcast via a Zigbee wireless network. This is why the CIA says it can spy on people through their dishwasher.
Connected Kitchen
Engadget says the Samsung RF3289 fridge is designed to let users access Pandora or tweet while grabbing a snack. Samsung touts it as the first to feature integrated WiFi. The Wi-Fi also offers the ability to view Google calendars, check the weather, download recipes from Epicurious, or leave digital notes
Engadet also reports LG’s Thinq line of connected appliances includes vacuum, oven, refrigerator, and washer / dryer. They support Wi-Fi and ZigBee to communicate with each other, the smart meter, smartphones and tablets. That’s a pretty strong foundation to build the Internet of Things especially if the home is already equipped with ZigBee devices. CNET says the line can be troubleshot remotely; tech support can log in to the device see what’s wrong and fix it. Kenmore has a similar product line.
Now that the IPv4 address pool is depleted and the IPocalypse is at hand, wrinkles are emerging in IPv6. One of the wrinkles is with mobile devices. Most of the cool mobiles devices have been able to handle IPv6 for a while. Apple’s (AAPL) iPhones, iPads and iPods have been capable of handling IPv6 Since version 4 of the iOS operating system and most Google (GOOG) Android devices have been capable since version 2.1. H Security is reporting that these mobile operating systems send information about their users to the network.
address (the “interface identifier”) themselves, but H Security says that smartphones are sloppy with this task. According to the article, the smartphones simply add the same two bytes to their globally unique MAC address and use it as their identifier. As a result, they transfer a unique hardware ID whenever they communicate with an IPv6-enabled server.
The only thing the smartphones are lacking is a control option in the user interface, as the Privacy Extensions do come as part of their kernel. For instance, on a (jailbroken) iOS 4 device with root access, they can be enabled with the same command that enables them on a desktop device running Mac OS X:
Nathan Ingraham
