- People on Twitter ask whose ancestors would’ve passed immigrant ‘wealth test’ Monday 6:54 PM
- Kobe Bryant helicopter crash mocked in teen’s TikTok video Monday 6:38 PM
- Chiefs, Bears, Packers have Twitter accounts hacked Monday 3:48 PM
- Washington Post reporter suspended amid backlash over Kobe Bryant tweet Monday 3:08 PM
- America is united in hating Ken Starr’s impeachment hat Monday 3:01 PM
- In ‘Cuties,’ the contradictions of growing up come to a head Monday 1:55 PM
- Racist tweets blame fruit bat soup for coronavirus Monday 1:25 PM
- What is the #ILeftTheGOP movement? Monday 1:21 PM
- The Grammys were weird and sad—but the Billy Porter hat memes offered some levity Monday 12:36 PM
- Auschwitz Museum calls on Facebook to ban Holocaust denialism Monday 11:59 AM
- YouTuber who said his girlfriend was dead now says he faked it Monday 11:42 AM
- Review: Kentucky Route Zero is one of the most magical games ever made Monday 11:00 AM
- Backlash grows against Clearview as lawsuit looms Monday 10:58 AM
- Tyler the Creator calls out the Grammys for racism over ‘Rap Album’ win Monday 10:25 AM
- Democrats call on John Bolton to testify after book bombshell Monday 9:56 AM
Yet another reminder that the Internet of Things is a security nightmare
You can search for open Web cams on Shodan.
When purchasing a security camera to keep an eye on home or family, most consumers likely assume that security goes both ways, but this week we were reminded yet again of the security failures that plague the “Internet of Things.” Shodan, a search engine for Internet-connected devices debuted a new section of its website to let users search for insecure webcams.
Shodan launched in 2009 and has since maintained controversial feeds of Internet of Things vulnerabilities. The new section of the site gives you a glimpse into businesses, bedrooms, patios, and anywhere else someone might put a security camera. Shodan subscribers can view the feed at images.shodan.io/, and unpaid members can search via port:554 has_screenshot:true, Ars Technica reports.
The website captures screenshots of the vulnerable webcams and aggregates them on the site. Shodan is constantly looking for IP addresses with insecure open ports, and takes a screenshot when it finds one with a video feed, Ars explained. The feeds are vulnerable because they use the Real Time Streaming Protocol (RTSP), used to control streaming media sessions, and aren’t password protected.
Jessy Irwin, security evangelist for 1Password says that vulnerabilities like those displayed on Shodan are a direct result of the Internet of Things design process.
“Technologists have endless ideas about how to create mashups of everyday objects and appliances with the Internet, but they’re trying to innovate so quickly that they are not stopping to ask whether some devices truly should be connected or not,” Irwin said in an email to the Daily Dot. “Privacy and security assessments aren’t making their way into products for the home: if they were, manufacturers of at-home surveillance cameras and baby monitors would very easily see that they need to add a layer of security into their products that ensures video feeds are only accessible by the right users in a controlled manner.”
If it seems like there’s a new IoT security vulnerability unveiled before the last one you heard about is even patched, it’s because while manufacturers are trying to connect pretty much every aspect of your life to the Internet as cheaply as possible, they’re putting the excitement about connected fridges and baby monitors and televisions before the need to adequately address security.
A great example of how short memory spans are when it comes to IoT and security is VTech’s massive hack. Last year, the toymaker exposed millions of accounts, compromising information like names, email addresses, download history, passwords, security answers for passwords, IP addresses, and mailing addresses. Just a few months later, the company was hawking its connected home wares at tech’s biggest trade show, and USA Today included it in a “best of” CES roundup.
There’s currently no group that provides ratings for IoT devices like Kelly Blue Book does for automobiles. As Ars explains, “some combination of regulatory stick and rating system carrot seems likely to increase IoT security across the board.”
I Am The Cavalry is one group working on making security standards for IoT devices that manufacturers and consumers can use to see whether their products are safe. The organization recently released a “Hippocratic Oath for Connected Medical Devices,” for physicians using connected devices to have a better understanding of the technology and security of the tech they’re using, and maintain privacy and safety.
“In terms of legal requirements or standards, there’s no single set of security rules that internet-enabled devices have to meet and there’s no governing body that is mandating stronger security requirements of the technology industry,” Irwin said. “As a result, some companies are ignoring security altogether or cobbling together their own ‘solutions’ that ignore some of the simplest tenets of security. These gaps in IoT security leaves consumers exposed and vulnerable to attack, and they’re almost impossible to close once products make it into people’s homes.”
A cursory look at Shodan’s webcam search showed some eerie footage—backyards, bedrooms, living rooms, and kitchens. And yes, even sleeping babies.
For consumers, the idea of having devices and appliances that talk to you and supposedly make your life easier is quite compelling. Until you realize that those very devices could pose security and safety risks for the family or home you got them to protect in the first place.
“What users can do with the devices they already own is simple: be proactive, and be sure to regularly update the software that runs their devices, and be sure to use them on a closed, secure home network that is protected by a strong password,” Irwin said.
Selena Larson is a technology reporter based in San Francisco who writes about the intersection of technology and culture. Her work explores new technologies and the way they impact industries, human behavior, and security and privacy. Since leaving the Daily Dot, she's reported for CNN Money and done technical writing for cybersecurity firm Dragos.