back to article IoT DANGERS: BYOD’s trashier cousin becoming a right tearaway

Bring Your Own Device is problematic enough, but now staff are increasingly bringing inherently insecure, internet-connected smart devices into work, making a mockery of established security policies in the process. Staff and bosses bringing their own smartphones and laptops into enterprises can be managed using mobile device …

  1. Chris Evans

    Suggestion

    o.k. having IOT equipment on your home network is big security risk. Why not operate two separate networks in a house with an IOT network and another for your computers etc were the more sensitive data is.

    The IOT network not being able to access the 'Computer' network but the 'Computer' network being able to access the IOT network for control/monitoring etc.

    Setting up and operating two networks would have to be made child's play to get it widely adopted.

    1. NotWorkAdmin

      Re: Suggestion

      Aye carumba. Your saying if my mum buys an IoT kettle I'm going to have to pop in and setup a separate network? Because one things for sure, she ain't going to do it.

      Actually, having said that I have already taken the precaution of setting up an allowed MAC address list on her router.

      As for at work, this is already an uncontrollable nightmare with smartphones & tablets wandering into the building and gobbling up IP addresses like Smarties. Hopefully no-one buys a new kettle.

      1. Peter Gathercole Silver badge

        Re: Suggestion

        OK, it should not be that simple for an IoT device to join a network. Presumably, you've got WPA2-PSK set up as a minimum for your Mum's network.

        So, a new device entering the house cannot even join the network.

        So, nothing to do.

        Of course, if you've got WPS enabled, then every time you press that button on the router, all your IoT devices that have been denied access to the network so far have an opportunity to jump on to it, but you don't use WPS and have support turned off, haven't you.

        Wait. What! you haven't........... And you're allowing uPNP as well!!!!!

        Excuse me, I've somewhere else to be.

        Goodbye.

        1. NotWorkAdmin

          Re: Suggestion

          Come on now Peter, you realize quite a lot of what you've said is insulting right? Had I said I was an idiot it would be fair enough - I don't believe I did though.

          1. Peter Gathercole Silver badge

            Re: Suggestion @NotWorkAdmin

            Maybe there should be a tongue-in-cheek icon as well as a joke icon.

            I meant this in a very light-hearted way, and it was actually addressed at other people than you. You had already demonstrated with your comments about another network that you were far from the average person who just plugs in a router and leaves it with it's default settings.

            If I had actually addressed it at you, I would have done it in the same way as I have here, by actually referencing your handle.

            I meant no offence.

        2. wabbit347

          Re: Suggestion

          Funnily enough, I was at Infosec yesterday and watched a demo involving an internet enabled kettle. The demonstrators setup a rogue Wireless network with same SSID as the one the kettle's connected to, but at a much higher gain. They sent a spoof packet to force the kettle to disassociate itself from the good network, it then reconnected to the rogue network with the higher broadcast power (which is unencrypted). Telnet to kettle, issue some Hayes modem style AT commands and voila! WPA2 key available, stored on kettle in plain text...

    2. Mage Silver badge
      Devil

      Re: Suggestion

      IP6 will be fun.

      Do I trust any security mechanism for IP6

      It's pretty easy to stop IP4 devices phoning home.

      Smart TV?

      Epoxy in the ethernet socket. Let them use it with tuner and HDMI.

      1. Alan Brown Silver badge

        Re: Suggestion

        ipv4 and ipv6 firewalling work the same way. My router is dualstack and has both running happily (in both directions)

        whitelisting MACs works up to a point, but it's trivial to spoof the things.

    3. swschrad

      much better idea... NO connectivity

      The Internet of Trojans stops at our door. we did install a security system, but we filter its call-home abilities. the "smart TV" that only gets smart if you link to Yahoo Video, not connected. Samsung posts no upgrades for the thing.

    4. Stuart Castle Silver badge

      Re: Suggestion

      " Why not operate two separate networks in a house with an IOT network and another for your computers etc were the more sensitive data is."

      Some routers (e.g. the newer Linksys ones) already offer something that could be used for this. They offer a guest network on the WiFi, which is blocked from accessing resources on the main network.

      This does have a couple of problems though. One being that not all devices have WiFi, and it can be quite an expensive add on.

      The other problem is that some devices (such as Smart TVs and smart thermostats) need access to the main network. Lets be honest, a lot of people don't buy a Smart TV because they can look at facebook on it, or to watch Youtube. They will probably use the On Demand services (such as iPlayer, Netflix etc), but they are likely to be using it a lot to view the collection of dodgy copies of TV shows they have stored on their computer. The problem for Smart Thermostats (and other smart devices, such as smart plugs) is that they are often controlled by an app, which would obviously need a way to both find the devices, and connect to them. Neither of which is going to happen if one network is separated from the other, unless the device and the app both connect to an external webservice, in which case you lose the advantage given by separation..

  2. Alan Bourke

    I'll say it again

    it's a bad idea, and it mostly only exists to harvest more data and to target more advertising. We can't even keep a lot of existing networked stuff secure, why would you be connecting fucking fridges to the internet.

    This decade's cloud. Something for marketing to spin.

  3. Anonymous Coward
    WTF?

    But why

    would you have 90% of these devices on the network in the 1st place?

    A half decent firewall and proxy will kill these of dead. Lock down the switches and you have an even better situation.

    1. Stevie

      Re: But why

      Or, you know, get over the nerd-need to switch everything on and off using a smartphone.

      Can you order this pwned kettle to boil itself dry using a smartphone? I saw a network switch bay brought down by an exploding kettle once.

      1. tfewster
        Facepalm

        Re: But why

        But..but... remote control _must_ be better. Instead of walking in to the kitchen, filling the kettle and pressing a switch then washing up while it boils I just ...err...Walk in to the kitchen to fill the kettle, back to the living room to my smartphone, watch the ads on TV that I would have previously have avoided, walk back in to the kitchen to make the tea, start washing up while it brews, miss the start of the programme.

        Or I could completely fill the kettle at the start of the evening so it takes ages to boil and wastes electricity, but only means one trip?

        Oh, I see now - The IoT isn't for my benefit, is it?

        1. Alan Brown Silver badge

          Re: But why

          "I could completely fill the kettle at the start of the evening so it takes ages to boil "

          I fill mine once a day, but it only boils one cup at a time.

          No way I'm letting it near the IoT

        2. DropBear
          Trollface

          Re: But why

          Now, now.... thou shalt not disparage the illustrious, time-honoured tradition of on-line coffee pots! The Hypertext Coffee Pot Control Protocol (HTCPCP a.k.a. RFC2324) also come to mind...

    2. Anonymous Coward
      Anonymous Coward

      Re: But why

      Because HR bought them because they were shinny and the MD wants his new automated cup warmer plugged into the wireless and he's not taking fuck yourself for an answer?

    3. gerdesj Silver badge
      Linux

      Re: But why

      A firewall and proxy wont help too much if you don't plan ahead - they'll still be plugged in. OK they won't get to t'interwebs but you can bet the Boss will soon fix that. You are better off putting them where you can see them and using VLANs and extra WiFi SSIDs to segregate the things from your real LANs. Get your IDS and whatever else sniffing and poking around to watch what they are up to. Investigate NAC as well while you are at it (mmm Packet Fence)

      At the rate I'm creating VLANs I'm going to be looking into QinQ fairly soon .... and that's just at home.

  4. Anonymous Coward
    Anonymous Coward

    Vagrearg bs Guvatf

    FTFY, now you can refer to that-which-shall-not-be-named without giving it more publicity in the form of bad publicity (search results). Note the preposition's fate.

  5. Anonymous Coward
    Anonymous Coward

    Oh, I see now - The IoT isn't for my benefit, is it?

    No, nor mine. I don't know much at all about this IoT stuff (or is that 'IoS thing'?) having, until now, paid about as much attention to it as a molecule of Hydrogen in deep space to a brass monkey. Having read the comments I still don't 'get' why a kettle would be internet enabled. To let you know it's boiled? Really?? Anyone who wants that has to be ready for the funny farm. Is this a meme that started April 1st, and I'm in effect a mug in molasses?

    I can just see me starting a job where one of the bosses had an internet-enabled kettle and me getting sacked for repeatedly laughing so hard the whole site hears me. Even though I know if I can't stop I will be fired.

  6. Mark 85 Silver badge

    So far, so good...

    We have very few devices that phone home.. TV, DVD player/recorder and there's a couple of odds and ends that were gifts. None are plugged into an network cable and the router rejects them connecting to it if they try wifi.

    The crap will surely hit the rotating air movement device when the devices won't work with unless connect to a network with internet access. Meantime, I'll continue to play Luddite with IoS/T and try to ignore it.

    1. Andy A Bronze badge
      Unhappy

      Re: So far, so good...

      Unfortunately the world is moving to a model where "it only works while you have a net connection".

      Office365, Photoshop, the many Clouds, nearly everything on your smartphone.

      Other devices demand that they periodically "phone home" or stop working. That's just like the "tags" that they fit offenders with rather than holding them in prison.

      It's only a matter of time before it becomes a crime NOT to be online.

      1. Anonymous Coward
        Anonymous Coward

        Re: So far, so good...

        "Unfortunately the world is moving to a model where "it only works while you have a net connection"......Office365....."

        Aahhh, yes. The ghastly abomination that is Office 365. Always f***ing deciding to uninstall itself without a buy your leave, regardless of the actual licence status.

        All involved in Office 365's concept, development and specifications should be given free one way tickets to Syria.

  7. Sampler
    Coat

    Postal

    what does (arguably) Uwe Boll's only funny film have to do with IoT? One average turn out in a sea of shit?

  8. Ru'

    So yeah, how many of us came into work and brought our tv with us?

    1. Anonymous Coward
      Meh

      few I imagine, but the Boss bought a SmartTV for Reception, the girls there like it

  9. Anonymous Coward
    Anonymous Coward

    The acronym IoT stands for

    Internet of Trojans

    1. atlatl265

      Re: The acronym IoT stands for

      Right on AC, and everyone knows, hopefully about "Greeks bearing gifts". No IoT devices in the work space. No BYOD in the workspace. The whole idea is a travesty of security. It violates even a basic OpSec environment. At home, if you have IoT devices, No connecting to the company VPN, even if you have separate networks, allowable MAC lists, WPA2 whatever. The idea of an IoT kettle is ludicrous, right up there with the IoT toilet, sex toys and beer/gin dispensers. atlatl

  10. Little Mouse

    Tenuous header photo?

    I'm usually OK with obscure-references, but what's the connection with the scantily-clad ladies?

    Are they bringing their own devices? If so, where are they hiding them?

    1. Teiwaz

      Re: Tenuous header photo?

      I thought it was a still frame from the opening sequence to a Betty Boo music video...

      (either that, or someone brought their tablet into the office with their 'Action Girls' sub password discoverable)

  11. Teiwaz
    Mushroom

    TVs, toasters, kettles, cars

    Toasters and kettles I'm not too worried about, if it gets to the point that you cannot buy the first three without IOT, you can do without, back to the grill and saucepan on the hob.

    Cars are likely to be tracking by government mandate, and I don't trust them with IT.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2022