Import standards on IoT devices a good idea, cyber experts say

OTTAWA — Experts praised the idea of stricter standards for imported insecure Internet of Things (IoT) devices at a cybersecurity conference Friday, though they weren’t so sure about whether the government is prepared for such a move or how the logistics would pan out. The panel discussion on the future of cybersecurity, hosted by the Conference Board of Canada, turned to the urgency of catching insecure devices at the border before they make it through. The two-day conference, which wrapped up Friday in Ottawa, already heard about the growing threat of distributed denial-of-service (DDoS) and ransomware attacks. “I think that idea is awesome and I’d love to see it,” Peter Morin, director of cybersecurity at KPMG LLP, said in response to a question about restricting imports of insecure products. But, he added, “I don’t think our government considers something like a default password or a cyber problem on a device as necessarily a threat to human safety.” Default passwords are easily-remembered login credentials — such as the relatively common “admin” for a username and password — that device manufacturers put in devices like routers so the user can access the system with little need for technical assistance. It’s also part of a number of recommendations United States politicians are asking the government to consider restricting in a Senate bill intended to impose minimum standards on IoT devices bought by federal agencies. The bill, introduced last summer, includes a requirement that devices “not include any fixed or hard-coded credentials used for remote administration, the delivery of updates, or communication.” Canada does not have a similarly-proposed legislation, but the Communications Security Establishment (CSE) told The Wire Report following the U.S. bill's introduction last year that it’s watching the legislation “with interest.” While such passwords limit the need to contact the manufacturer, it also makes the devices insecure, Morin said in a follow-up interview. “Why is there such a thing? Why would you need defaults?” Morin asked, adding changes to what the country imports should include a requirement that default passwords be disallowed and a user input a “specific username” and a “complicated” password before the device can be used. To illustrate the problem, Morin used the example of Shodan.io, a website that allows anyone with an internet connection to search for in-use IoT devices, check their specific characteristics, and in some cases access their dashboard using default passwords. He said you can see the output of many cameras in China because users either haven’t set a password, haven’t changed the default password or they’re insecure in another way. Worse still, Morin said, is that it isn’t just consumer electronics that Shodan features, but critical infrastructure — wind farms and power plants — as well. “Basically, if you have an IoT device on your network, I can scan it and I can figure out that it’s this product I try the default passwords and I’m into your IoT device,” Morin said of its simplicity. Other websites that allow you to view security cameras, including those of civilians in countries around the world, include insecam.org. The live feeds on the website, which dubs itself as the world’s biggest online cameras directory, contain devices with some not password-protected, with views ranging from front yards to inside kitchens. In 2016, as an example of other insecure devices, The Register reported some network-attached storage devices from hard drive maker Seagate Technology LLC allowed hackers to easily upload malware that mines cryptocurrency on infected machines. Morin said he doesn’t think the Canadian government is at a point where it would be able to take on such a proposal partly because it has “many other fish to fry right now.” One thing, however, that may push them to move on it is if the public begins to reject certain products as being insufficiently secure, Morin said. “I know this kind of sounds crazy...but start to boycott a lot of these products that shouldn’t be on our networks,” Morin added. Morin was flanked on the panel by Security Compass research director Altaz Valani and Jeff Stark, chief information security officer at the Ontario Pension Board. Stark said his initial reaction to the idea was positive but cautioned that such a system would be marred by logistical questions, including how to enforce it and which governing body would inspect “every inbound product to make sure it’s secure.” From the consumer perspective, Stark added, the consequence could also be that prices on those devices could go up. While imposing such a system is difficult to do at a government level, Valani said consumers will need to trust companies like Apple Inc. which, acting in the best interest of customers, would have to restrict products in their organization to reduce risk. He noted, for example, that some companies don’t use certain cloud providers because of what they do with data. Meanwhile, Morin believes things are going to get worse before they get better. Part of that outlook was informed when a demonstration showed hackers managing to infect a connected thermostat with ransomware in 2016, locking the device until the owner paid. Normally, ransomware is used to lock access to data through either a file download or via a clicked link, Morin said. But the thermostat’s hackers proved that ransomware can be used to take captive devices with data stored in the cloud. “I think going forward, we’re going to start to see a lot more ransomware and next-gen malware start to affect” not just computers, Morin said during the panel discussion, “but a lot more consumer-grade equipment — and I think that may send a bit of a shift.” — With reporting by Ahmad Hathout at ahathout@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

Import standards on IoT devices a good idea, cyber experts say

News | March 5, 2018

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Import standards on IoT devices a good idea, cyber experts say

News | March 5, 2018

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Online harms and more in focus as Parliament returns

Telecoms and broadcasters hit by CrowdStrike IT outage

CRTC lacking in battle against cybercrime: Auditor General

Education key to combating foreign interference on social media, ETHI hears

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us