The Institute for Critical Infrastructure Technology (ICIT), a cybersecurity think tank, published a new paper in which it argued that future IoT devices need to be secure-by-design and that there should be some regulation setting minimum security standards, too. Failing that, the group warned that non-secure IoT devices or devices that have backdoors could be transformed into powerful weapons that rival nations could wield against each other.
Mirai, The Beginning Of Massive DDoS Attacks
Since the open source Mirai botnet software was published on the internet, we’ve started to see some powerful distributed denial of service (DDoS) attacks that can take down major websites or at least cause severe disruption to their service.
The attacks were mainly enabled by non-secure Internet of Things (IoT) devices, which are often not designed with security in mind and even come with backdoors or hardcoded credentials. This allows attackers to discover easy entrance into millions of devices and take them over.
However, despite all of this, many experts seem to agree that Mirai is only the beginning. As billions of IoT devices are predicted to come online over the next decade, we could see attacks that are orders of magnitude more powerful. At that point, the non-secure or backdoored IoT devices are not just a threat to a handful of large companies or organizations, but to entire nation states. Massive DDoS attacks could be used to shut down critical infrastructure and cause chaos.
In the report called “Rise of the Machines: The Dyn Attack Was Just a Practice Run” (pdf), which was written by James Scott and Drew Spaniel, both of whom are members of ICIT, the authors warned that in the future it’s possible that China or other states could weaponize non-secure or backdoored IoT devices and then use them against rivals.
If that’s the case, and it at least looks like we’re heading in that direction, then the governments of all countries need to realize that non-secure IoT devices, or devices that ship pre-backdoored and can later be exploited by anyone, represent a serious national security risk.
Making IoT Devices "Secure-By-Design"
Throughout most of the paper, the authors argued for IoT devices that employ “security-by-design.” What that means is that manufacturers will have to ensure that their IoT devices are developed with security-first thinking. All code will need to be written in a way that won’t cause too many security vulnerabilities later on, and multiple anti-exploit protections will have to be deployed. Both of which should end up saving the manufacturers some money with patching the systems, or even with recalls or lawsuits.
The ICIT authors said that right now, neither the buyers nor the sellers of IoT devices feel any responsibility for the damage their devices cause when they are taken over by botnets due to poor security. The buyers don’t care because DDoS attacks don’t impact their devices in a major way, and the sellers have simply moved on to selling a new version of their product, instead of investing in patching the older one.
Bruce Schneier, a well known security expert, has recently argued that the non-security of IoT devices should be seen as invisible pollution that affects everyone. Therefore, just like with pollution, the only solution is some kind of government regulations on companies polluting the environment.
The ICIT authors also share Schneier’s view that governments should impose some minimum security standards on IoT manufacturers, along with liabilities in case something goes wrong. Companies affected by DDoS attacks from non-secure IoT devices should also be able to sue the makers of those devices.
The authors also said that regulation should be done responsibly so as not to hinder innovation too much. They suggested following security standards similar to those in other industries, such as the healthcare industry, as well as following security best practices such as the ones promoted by the NIST or other relevant agencies.
Backdoors should also be avoided at all costs. The authors said that whatever good may be achieved through them is outweighed by orders of magnitude by the potential of a nation state one day being able to use those same backdoors to attack and cripple national infrastructure of various critical services. In the meantime, backdoors will also be discovered and used by many other “bad guys” for their own malicious purposes.
