Cyber attack yesterday, was possibly powered by IoT devices

[Kaido]

Hah, spear, to a point.

And how about no on that two-factor thing. Also the quarterly reset thing, I already have to do that and you know what I (and pretty much everyone else) do every single time? XXXXXX1, then next time it's XXXXXX2, and so on until it lets me reuse XXXXXX1. All it does is annoy users while marginally increasing password complexity. Policies that work will help without getting in the way, like how routers these days come with a preset password that's unique and in big print on the side of the unit.

I do like the uniquely-printed Wi-Fi password sticker on the newer routers because 99.999% of people I've seen with them have never changed them, so at least there's some measure of security.

What do you suggest on email & sites where you have your bank information on to order stuff from?

 

[Ruptga]

I do like the uniquely-printed Wi-Fi password sticker on the newer routers because 99.999% of people I've seen with them have never changed them, so at least there's some measure of security.

What do you suggest on email & sites where you have your bank information on to order stuff from?

Personally I roll my face on the keyboard then take the first six or so characters and use that when I need a new password. In terms of company policy though, they could run a quick dictionary attack on whatever the user submits when setting up their account. Something like 100,000 really common entries shouldn't be too taxing and would go a long way toward eliminating stupid yet technically complex passwords like andrew111.

 

[Fritzo]

That's one of the things that scares me about putting Android in everything...massive security risks. Viruses, malware, botnets, you name it. As much as everyone complains about iOS being a walled garden, at least you can't download a fake free version of Angry Birds from Russian & get charged in a scam attack.

The Google Play store is actually pretty secure now. Google inspects all of their app postings, and all apps have to ask permission to access information on your phone. Samsung and other smart-TV providers are in the wild-west still. Samsung for instance is using proprietary apps that anyone can post, and they don't seem to have the know-how to check for malicious postings.

 

[Kaido]

The Google Play store is actually pretty secure now. Google inspects all of their app postings, and all apps have to ask permission to access information on your phone. Samsung and other smart-TV providers are in the wild-west still. Samsung for instance is using proprietary apps that anyone can post, and they don't seem to have the know-how to check for malicious postings.

Eh...

https://www.grahamcluley.com/400-android-apps-hiding-dresscode-malware-google-play-store/

 

[Red Squirrel]

The Google Play store is actually pretty secure now. Google inspects all of their app postings, and all apps have to ask permission to access information on your phone. Samsung and other smart-TV providers are in the wild-west still. Samsung for instance is using proprietary apps that anyone can post, and they don't seem to have the know-how to check for malicious postings.

The problem is that because it's google, most of the stuff is also full of spyware, google basically IS spyware. So you can't trust stuff just because it's in the play store. It seems everything wants access to your contacts, files etc. It seems the mobile ecosystem is basically built around it being a spy device. Next phone I get I want to experiment with a custom rom to try to get away from the spy stuff.

As for IOT the biggest thing is that these things should not even be facing the internet anyway. It should be treated as "LAN of things". There is absolutely no reason a light bulb needs to be serving up HTTP requests for the whole world.

 

[Ichinisan]

My SmartTV actually got infected by a "free movie" app on the Samsung store. I detected the traffic on my Juniper firewall a few weeks ago and ended up resetting the TV.

Wonder if something similar was the entry-point on other devices.

Reading Krebs' article, no. These are mostly security camera DVR systems that were deliberately made to be accessible (port-forwarding/DMZ and such to bypass NAT) so they can be viewed remotely.

 

[Fritzo]

Reading Krebs' article, no. These are mostly security camera DVR systems that were deliberately made to be accessible (port-forwarding/DMZ and such to bypass NAT) so they can be viewed remotely.

Ah. I actually know a lot of people that do this because they don't understand networking. Some of the crappier systems even instruct you to do this "On your router, turn on DMZ and enter your DVR's IP address."

 

[Fritzo]

The problem is that because it's google, most of the stuff is also full of spyware, google basically IS spyware. So you can't trust stuff just because it's in the play store. It seems everything wants access to your contacts, files etc. It seems the mobile ecosystem is basically built around it being a spy device. Next phone I get I want to experiment with a custom rom to try to get away from the spy stuff.

As for IOT the biggest thing is that these things should not even be facing the internet anyway. It should be treated as "LAN of things". There is absolutely no reason a light bulb needs to be serving up HTTP requests for the whole world.

It's not spyware, it's how social networking works today. If an app has an option to share with Facebook or other social apps, it needs access to your contacts list to do that (contacts aren't just email addresses anymore- it handles all of your accounts). If you don't want that ability, you can easily turn it off. Google's security standard now dictates that all apps must prompt you if they need access to hardware or personal lists, and you can allow or deny it. If you change your mind, the option can be reversed in Settings/Applications. The biggest security threats come from getting apps that DON'T come from the Play store. Google allows you to install 3rd party APKs through an option in settings.

 

[John Connor]

I asked OpenDNS if their Smartcache would mitigate this and they said yes. Been using OpenDNS since '08. Great DNS provider for your network. Especially if you have kids you want to filter traffic from.