For every benefit of the internet of things, such as being able to unlock a garage door with your mobile phone, or find your car keys by sending them a text message, there’s a downside.
From web-connected smoke-alarms that can be “unintentionally deactivated” with the wave of a hand to smart light fixtures that, after a software update, refuse to work with lightbulbs made by other brands, it sometimes seems like the internet of things is just an abbreviation “the internet of things that should not have been connected to the internet”.
This week, technology site Ars Technica highlighted one more reason to keep the world resolutely unconnected: a search engine that allows users to find live video of anything from an internet-connected webcam which lacks proper security precautions. This ranges from banal feeds of back gardens, offices and shops — to intrusive videos of sleeping babies whose parents use webcams as a monitoring device.
The search engine in question is Shodan, which was launched in 2009 by John Matherly, expressly with the aim of scanning every internet-connected device looking for vulnerabilities and insecurities. Named after the malicious AI from the System Shock series of video games, it’s a search engine for everything on the internet that’s not a website.
Shodan doesn’t do anything other than reveal weaknesses that are already out there but that hasn’t stopped it facing criticism. Security expert Marc Goodman, argued in his book Future Crimes that: “[Shodan] provides tips on how to exploit everything from power plants to wind turbines. It is searchable by country, company or device, providing detailed how-tos and greatly lowering the technical bar and knowledge for any rogue individual to hack our critical infrastructures.”
The site has now lowered that bar still further. A new feed, for members who have paid a $49 fee, now demonstrates just how easy it is to find, scrape and deliver footage from unsecured web cameras.
The feed, at images.shodan.io, is similar to sites such as Insecam that sparked anger in 2014 by collating and aggregating web cameras. But unlike Insecam, which operated out of Russia and seemed pitched towards voyeurs who wanted the thrill of spying on strangers, Shodan’s feed is specifically aimed at highlighting just how bad the state of internet security still is, even 15 months on from that example.
Webcams with predictable default passwords or even no passwords at all, are still widely available. And even though more respectable manufacturers, such as Google’s Dropcam, have developed a reputation for security, they can’t compete with the lowest common denominator on price. Technology site Ars Technica argues that the best solution is “some combination of regulatory stick and rating system carrot”.
The former would require a change in tack from organisations such as the Information Commissioners Office, which are currently stuck playing whack-a-mole, taking action against sites such as Insecam without addressing the problem at its root.
In the meantime, the latter has more chance of succeeding. One grassroots organisation, called I Am The Cavalry, aims to do just that. The group of public-minded cybersecurity volunteers proposed a “Hippocratic oath” for connected medical devices last week, suggesting that manufacturers of the devices (which pose tempting targets and can cause huge personal suffering if hacked) abide by a set of principles including supporting “prompt, agile and secure updates” and working with third-party researchers to ensure potential security issues can be safely reported.
Similar oaths may one day be advertised on the packaging of other internet of things devices, allowing customers to be sure that they’re purchasing from a provider that takes security seriously. Until then, at least take the time to change the default password and hopefully you can stay out of Shodan’s gaze.
Other things that have bubbled up on Shodan recently really shouldn’t be connected to the internet at all. In September 2015, a France-based director at a major international company specialising in cyber security told researchers from Chatham House that they used the site and found “all of the nuclear plants in France that are connected to the internet”.
All too often for other pieces of major industrial machinery, the controls are sitting there in plain sight or hidden behind the most rudimentary credentials. In 2012, simply attempting to log in as “root” or “admin”, with the password being the same again, was sufficient for another group of anonymous internet explorers to gain access to more than 400 000 devices. With the rise of internet-connected devices since this study was conducted, that number is likely to be far higher. – By Alex Hern
Image – AFP