Can your smart TV spy on you? Absolutely, says the US director of national intelligence. The ever-widening array of “smart” web-enabled devices pundits have dubbed the internet of things (IoT) is a welcome gift to intelligence officials and law enforcement, according to director James Clapper.
“In the future, intelligence services might use the (internet of things) for identification, surveillance, monitoring, location tracking, and targeting for recruitment, or to gain access to networks or user credentials,” Clapper told the Senate in public testimony on Tuesday.
As a category, the internet of things is useful to eavesdroppers both official and unofficial for a variety of reasons, the main one being the leakiness of the data. “One helpful feature for surveillance is that private sector IoT generally blabs a lot, routinely into some server, somewhere,” said Lee Tien, a senior staff attorney at the Electronic Frontier Foundation. “That data blabbing can be insecure in the air, or obtained from storage.”
There are a wide variety of devices that can be used to listen in, and some compound devices (like cars) that have enough hardware to form a very effective surveillance suite all by themselves. There are, of course, legitimate and tightly warranted reasons for law enforcement surveillance, and there are also companies that take hard lines against turning their users over to the government. But hardware manufacturers often default to crummy security, or don’t offer a choice, and consumers often make themselves more vulnerable than they should.
“One of my technologists has a phrase: ‘internet of other people’s things,’” Tien said. “E ven if you bought it, it’s not necessarily truly yours – it may need to talk to the vendor’s machines to work, handing over data about you or those around you (if it has sensors); it may have features you don’t know about or don’t know how to control or can’t control.”
Intelligence officials are not the only ones interested in cracking our hi-tech homes. Knowing when you are in and out, what you have and where you keep it is invaluable information for thieves. And just think what tales your devices could tell divorce lawyers.
Dan Kaminsky, security researcher and chief scientist of White Ops, said despite the worries the internet of things is here to stay. “There’s a lot of work to do building the secure and maintainable platforms of the future, but I think it’ll happen,” he said. “We know this technology isn’t perfect but we know the tremendous human potential it unlocks.”
What’s watching you in today’s houses:
Baby monitors and other household video cameras
“All of a sudden, I heard what sounded like a man’s voice but I was asleep so I wasn’t sure,” Heather Shreck told Fox 19 in August 2014. She hadn’t been dreaming: her baby monitor had been hacked by someone who yelled things at her and her baby until she shut the monitor off. More recent models have fewer vulnerabilities, but in that case, the monitor was simply available to anyone who wanted to get in. There’s an established history of law enforcement trying to compel private companies to spy on their users, and in many cases, rigorous analysis of your movements is a feature, not a bug: Google-owned Nest’s security video hardware, Nest Cam, offers a service that records 30 days’ worth of video to the cloud and analyzes it for you.
Smart TVs
There’s no getting around the fundamental creepiness of the little pinhole cameras in new smart TVs (and Xbox Kinects, and laptops, and cellphones), but the less-remarked-on aspect – the audio – may actually be more pertinent to anyone with a warrant trying to listen in. Harvard’s Berkman Center for Internet and Society observed that Samsung’s voice recognition software in its smart TVs had to routinely send various commands “home” to a server where they were processed for relevant information; their microphones are also always on, in case you’re trying to talk to them. Televisions are also much easier to turn on than they used to be: a feature creeping into higher-end TVs called “wake on LAN” allows users to power on televisions over the internet (this is already standard on many desktop PCs). New York University’s Brennan Center published an article by Michael Price about smart TVs saying he was “scared to turn this thing on” because of its myriad disturbing features, among them facial recognition. He might not have to.
Kaminsky observed that a great deal of security risk lies in devices we never think about and rarely have updated. “There’s this universe of technology that trades power and maintainability for size, battery life, and price,” he said. People don’t necessarily buy the highest-end computer with the most secure operating system, and they tend to keep it around until it’s vulnerable. “We actually did a tremendous amount to secure the high end of computers,” he said. But you might have three years’ of tax documents on an eight-year-old laptop that won’t run a new operating system, or you might skimp on your tablet and end up with a model made by a small company that goes out of business and thus never fixes new security holes. “There’s an old quote in computers,” Kaminsky said: “The high end keeps getting higher, the low end never goes away.”
Full-home automation
Since the Futurama exhibition at the 1933 World’s Fair, homemakers have fantasized about hi-tech living spaces. That’s the pitch behind Amazon Echo, Google Nest, and many other suites of home technology that sync up everything from your thermostat to your refrigerator. But, as with the “smart” devices above, they’re not actually individually that bright and have to refer back to a centralized server to ask a large database what the user is talking about. Collectively, however, that data tells a lot about the people who generate it and, as Tien points out, is vulnerable – both while it’s in the air and to legal compulsion.
Toys
A cyberattack on toymaker VTech exposed the personal data of 6.4m children last year; it was a sobering reminder of the vulnerability of kids on the web. But technology waits for no man. Mattel’s Hello Barbie doll works the same way the Nest and Samsung voice operators do, by passing kids’ interactions into the cloud and returning verbal responses through a speaker in the doll. HereO manufactures a watch for kids with a GPS chip in it; Fisher-Price makes a WiFi-enabled stuffed animal. Security researchers at Rapid7 looked at both and found that they were easy to compromise on company databases, and in the case of the watch, use to locate the wearer.
Your car
The Berkman Center report details an FBI case indicating that the agency has been aware of this possibility for a long while: “During the course of an investigation, the FBI sought to use the microphone in a car equipped with [a commercial emergency response system] to capture conversations taking place in the car’s cabin between two alleged senior members of organized crime. In 2001, a federal court in Nevada issued ex parte orders that required the company to assist the FBI with the intercept.” The company won on appeal on other grounds, and the possibility of legal compulsion is still very much alive. Now that rear-view video and GPS are ever more common, a large number of in-car systems are correspondingly more available to a remote user.
Courtesy: http://www.theguardian.com/world/2016/feb/10/internet-of-things-surveillance-smart-tv-cars-toys
