Tiny Computers

I recently gave a pitch focused on describing what Bear provides and how we could have prevented attacks such as the one on Dyn.  During the talk, I told people that cameras and DVRs were being used in these types of attacks and that blew peoples’ minds.  Nobody could grasp how these devices could possibly be used in this manner.

That is a problem.

I realized that people are conditioned to think that computers are desktops/laptops and many do not realize that these other devices are also computers.  The standard Comast DVR has more resources than many laptops.  It needs to have these resources as it streaming HD signals in real time.

You can literally purchase a Raspberry Pi with a 64-Bit processor with 32GB of storage for $35.  These cameras, printers, even coffee makers and routers all come with serious horsepower and are actually mini-computers.  The Internet of Things (IoT) is really adding Internet connectivity to billions of tiny computers.

The Issue

If I asked you to turn on your computer, disable your anti-virus and leave that computer open to the world, what would you say?  How about if I asked you to leave your computer open and running in a coffee shop and then walk away?

Asinine, right?

And yet this is exactly what is happening in the IoT today.  All of those tiny computers are being connected to the Internet with no thought to protecting them.  Unlike your computer which can readily add new software, there is no Windows Update for IoT devices.  These are tiny, really hard to update and, in many cases, cannot overcome any deficiencies discovered after that are connected.

This makes things a complete nightmare for security people now trying to deal with this crazy world of wide open, tiny computers in every part of our lives.  Awesome for hackers, horrible for the rest of us.

Thin Shred of Hope

The only part of this that is remotely helpful is that most of these devices are SIMPLE.  Sure they have enough processing power to tear down the Internet, but they quite often perform very simple tasks.  Cameras stream video, routers handles data flows, coffee makers burn coffee…

It is not like your typical laptop or phone where there are tons of processes running, of which you only usually know a few.  IoT devices quite often have one or two functions and that is it.  This is great for detecting and stopping illicit activity.

If a camera suddenly starts transmitting bad traffic to unknown places, it is probably doing something bad.  It is not as if that camera is downloading some new cool screensaver.

There is a ton of work to do and there will be more attacks – of a nature that will shock people – before we have the IoT under control.  That said, there is a path forward and it is not technology that is holding us back – it is the lack of financial interest.  I will be blogging on both of those soon…

Does this help clarify things at all?