The wheel turns slowly, but it turns: Feds emit IoT security tip sheet

election swinging?

before the Feds come knocking on your door after your microwave has attempted to swing an election at the behest of a not-nice foreign power

But presumably OK if it's a nice foreign power? Like that lovely Mr Putin who is such a chum of the Prez? "Webcams for Trump!"

We know it's ok to swing elections

By the usual suspects - lobbyists from big corporations, people like the Koch brothers, George Soros, other wealthy people with an agenda, and even special interest groups -- all of whom do so right out in the open and even brag about doing it. In some districts of fame, the phrase "vote early and often" is not joke.

I'm sure foreign powers get into the act too, but to blame all your problems on them vs what we all know to be true and which is right out in the open is to deflect responsibility for fixing that and to CYA the current jerks in power. It's a very old game pols play.

1. We need a distraction from our poor performance, and to convince people they need us.

2. To do that, we create an enemy, using someone we can't fight without horrible consequences, and who we can't extradite from. Doesn't matter if they're actually a threat or not - they may even be in on it and using you for the same purpose (see...west vs east and control of their populaces). Currently, we have a 3 way tie for superpowers, so any one can use the other two as enemies. For smaller countries, we all just have proxy wars to keep things riled up and bomb the mostly-innocent populace of those places - nice real world weapons testing and..."you know what waving".

3. We get you to to clamor for protection, from them, by us, thus retaining and increasing our power over the normal citizen/serf. We keep the status quo, which benefits the top crust more than anyone else, going indefinitely.

See HL Mencken quotes. This is not news.

All sides do this (doesn't make it right, just real). Wake up, it's a not-nice game and you're being played. If you sit at the table and don't know who the mark is...it's you.

To get on topic - the IoT is a joke. I built a LAN of things for myself. But the only real reason to put things on the internet is so someone can be a man in the middle - to charge rent, spy on you, and other shenanigans. Do you really need to turn your heat up and down from work, a job a cheap timer could do - and have security and reliability advantages doing it? If the police are such a failure you need realtime video monitoring remotely - why not get that fixed? What would you do from miles away anyway? And so on - the IoT is just another way to try and charge you for living "as a service". Get wise.

Keeping up to date with patches

No problem for most IoT devices. They start out with the full complement of patches that will be issued over the coming decade.

I had a guy assert to me that everyone is going to become a programmer. Looks like the G-men want everyone to become a sysadmin.

This advice is the sort of thing to get my paranoid side going. The only honest assessment of IoT "security" is, "Hahahahahahahahaha.....!", or "Ieeeeeeeeeeeeeeeeeeee...!" If consumer protection were the real goal, the FBI ought to be issuing stern warning about the lack of security, and the dangers of using these devices. Almost all are fundamentally unsecurable, which means that that any vaguely competent actor can just pop them at will and get complete access to...

Yeah. My paranoid side really gets triggered at this point.

better advice

Better advice is at RouterSecurity.org.

Block unknown IP address in the firewall? What does that even mean.

Much IoT security is really router security. Disable UPnP and NAT-PMP to block devices from opening holes in the firewall. Test the router firewall yourself to see if there are open ports (aka holes).

The FBI is right that IoT devices should be isolated, another router issue. Of course, they offer no help in doing so - or even a warning that many routers can not do this.

Encouragement for IoT in the national press.....

....and in the mean time, there's this gem today in The Guardian newspaper encouraging their readership to install a few, maybe dozens, of IoT microphones in their houses!!

*

https://www.theguardian.com/technology/2018/aug/04/how-do-i-get-best-from-alexa-amazon-echo-hacks-apps-accessories-skills

*

Fab.....let me get onto Amazon and place an order!

They're sitting here wondering how we can secure things, i'm sitting here knowing full well that you can hack a dildo with a webcam attached to it......

Incdentially, how do I patch this thing, for my girlfriend of course..

BTW, you can google the above and they show you a video how to do it... It's quite amusing. It was carried out by Pen Test Partners.