CIS 110 San Mateo Internet of Things and Security Issues Discussion
I need help with a Computer Science question. All explanations and answers will be used to help me learn.
The topic of this discussion is Internet of
Things (IoT) and the resulting security
issues. What made me think of this is
something that happened on Friday, October
21, 2016. That’s when 145,000 small security
cameras all around the world were
maliciously programmed, via a wide-spread
virus, to send numerous phony messages – all
at the same time – to some of the main servers
that control Internet communications. Those
servers belong to DynDNS (a division of Oracle), a company that provides network
communications services to many large online companies. Their servers were so overwhelmed
by the onslaught of messages that it caused widespread disruption of legitimate Internet activity
in the U.S. Do any of you remember when that happened?
I read an interesting article about this attack, written by Stephen Cobb, Senior Security
Researcher at a consulting company name WeLiveSecurity. Cobb’s description of this event
includes the following quote:
This made it hard for some major websites to work properly, including Twitter, Pinterest,
Reddit, GitHub, Etsy, Tumblr, Spotify, PayPal, Verizon, Comcast, and the Playstation
network. Beyond these high-profile sites, it is likely that thousands of online retail
operations were disrupted.
There’s a name for the type of electronic attack – it’s called a Distributed Denial of Service
(DDoS). That type of security problem has been going on for a long time, but the attack last
October is believed to be the first one caused by small electronic devices (as opposed to
computers). To me, it’s almost absurd to think that a bunch of security cameras could shut down
a portion of the Internet, but that’s exactly what happened.
There are many aspects of this issue, and I’d like to see if I can dissect what happened. I’m sure
some of you will have things to add to this discussion, and I look forward to your comments.
First things first. What types of devices are included
in the IoT, and how (and perhaps why) are they
connected together? Here is an illustration from the
Cobb article that depicts the types of things that could
have been involved in the DynDNS attack. These
include some of the most commonplace electronic
devices we have come to rely on for a more
convenient “connected” world.
As I mentioned above, the name for all these connected devices is the Internet of Things
(abbreviated as IoT). The name is a perfect definition – it’s the use of the Internet (a worldwide
“network of networks”) to connect millions (or more) small electronic gadgets. Of course, this
really does provide a great deal of convenience for us and the things we can do. I guess that’s
why we have connected everything. The concern now is that there are serious security issues that
still haven’t been completely addressed. That’s a problem!
Let’s back up for a minute. When the Internet was invented, there was no such a thing as a
networked baby monitor (just to choose one example of a “thing” in the IoT). I’m sure an idea
like that would have caused lot of laughter at the time. The Internet was originally intended to
connect computers. The engineers who created the plans for the Internet realized that there
would have to be some finite number of connections, and they chose than number to be slightly
more than 4.2 billion. The actual number is 2 to the 32nd power. (OK, I was a math major, so I
can’t resist. That number is 4,294,967,296. My kids think I’m a “computer nerd,” and I guess I
just demonstrated that. Sorry.)
Can you imagine being one of those engineers? This was 1974 and they just had to think that
there would never be a time when there would be more than 4.2 billion connected computers.
Well, the immense network came to include more than just computers and, as we now know,
THEY WERE WRONG!
Nonetheless, those engineers were pretty clever. They made up a system whereby each
connected computer had its own unique number, and that number would be used by the
communications equipment to direct messages to their intended location. That number is called
the “Internet Protocol address” (abbreviated as “IP address”). We still call it that today, but the
technology has improved a great deal since the beginning days of the Internet. More on that in a
moment.
But first, here are a couple of related points:
There’s a name for the communications equipment
that directs the messages to all the computers in
the Internet. The original name was “Interface
Message Processor.” The picture to the right
shows one of the original 1968 processors being
operated by its inventor, Wes Clark, a physicist
who worked at M.I.T. Today, this device is simply
called a “router.” I think of the Internet as a
worldwide connection of millions of routers.
Without them, none of this would work.
Each IP address consists of a series of bits – 32 of them to be precise. As I said above,
every computer that’s part of the Internet has its own unique IP address. Instead of
writing out all 32 bits, we abbreviate it as 4 groups of numbers, where each group has
256 possible values, numbered from 0 to 255. (Nerd alert: 256 to the 4th power is the
same as 2 to the 32nd power.) Thus, we have an IP address that looks like this:
207.62.235.151
You’ve probably seen numbers like this before. By the way, I didn’t randomly choose the
above number. That’s the actual IP address for the main server at San Mateo Community
College District. When you used WebSmart to register for this class, your
communications were directed to that IP address.
Fortunately, we don’t have to remember IP addresses; we can simply refer to each
networked computer using a “domain name,” where each name is associated with a
specific IP address. That clever idea came about in 1984. It is called the Domain Name
System (DNS). You can read more about it on your own in the text book. By the way,
domain name for that above IP address is “smccd.edu.” Looks familiar, doesn’t it?
The DynDNS company mentioned above is a major provider of DNS services to other
companies. That’s why the attack on them caused such a major disruption of service.
Even though 4.2 billion was a huge number in 1974, it’s a serious limitation in today’s world.
There are actually a lot more than 4.2 billion things that we want to connect. It has been
estimated that within the next 2 years, there will be more than 1 million new things added to the
Internet every hour! So, something had to change, and it did back in 1990. That’s when a group
of experts called the Internet Engineering Task Force (IETF) re-defined the meaning of “IP
address.” Instead of using 32 bits for each address, they decided to use 128 bits. They named the
new protocol “IPv6” (meaning “Internet Protocol version 6”). This implies that there were 5
earlier incarnations of IP. That’s true, but it doesn’t have any impact on this discussion.
One more nerd alert: 2 to the 128th power is a HUGE number, namely:
340,282,366,920,938,463,374,607,431,768,211,456
No kidding!
The bottom line: Using IPv6, there are enough unique combinations to connect every blade of
grass on the planet (assuming that grass was electronic). Or, as you have probably guessed by
now, that means every “thing” in the Internet of Things.
You can even buy light bulbs that have their own IPv6 address. Those light bulbs come from
Philips, and they cost in the neighborhood of $45 each. You can get the “starter kit,” which
includes 3 bulbs and the required control unit, at Bed, Bath, and Beyond for $179.99. Costly,
yes, but you can control your lights from any smartphone anywhere on the Internet. How cool is
that? As I implied above, there’s a price for convenience.
While the Philips bulbs are excellent, there is a huge potential problem lurking in the background
– well, now in the foreground. Many of the “things” that are connected on the Internet have little
or no security features. A lot of the companies that make these gadgets want to manufacture
them as inexpensively as possible, so they bypass the security options that exist in the major
computer operating systems. You can bet that a lot of baby monitors don’t include a firewall!
That leaves the “things” vulnerable to malicious software such as viruses and worms. Back in
October 2016, that theoretical issue became a reality. That DDoS involved is universally
acknowledged as the largest such attack – at least for the time being. One of the IoT electronic
manufacturers whose products inadvertently played a role is Chinese firm Hangzhou Xiongmai
Technology. Their products include Internet-connected cameras.
Most Internet security experts say there’s more to come. This is the modern-day version of
warfare (the pundits call this “cyber-warfare”). My fear is that the DynDNS attack could be
viewed as a “proof of concept” for some nefarious organization, and a future attack could disrupt
a lot more than the October 2016 one did. I hate to be pessimistic, but that’s the reality of the
situation.
All of this means that we need to pay attention to the security risks here and become much more
vigilant than we are now. Do you think the “average” consumer even knows what this is all
about? Are you going to be a more cautious when you’re done with this class? I think your
comments are going to be very interesting.
To finish this portion of the discussion, here’s the final quote from the Cobb article:
What is the bottom line on the 10/21 IoT DDoS attacks? I think it is this: we have been
shown just how vulnerable the Internet, which is now an integral part of the critical
infrastructure of the US and many other countries, is to disruptive abuse conducted at
scale, by persons whose identity is not immediately ascertainable. Until this vulnerability
is addressed, it will cast a serious shadow over the future of connected technology, a
future in which much hope and massive resources have already been invested.
Sources of information:
The article by Steven Cobb can be found at:
https://www.welivesecurity.com/2016/10/24/10-thing…
Also, another interesting article on this topic was written by Steven J. Vaughn-Nichols, a
contributing editor for ZDnet It can be found here:
http://www.zdnet.com/article/the-dyn-report-what-w…
Here’s an article from “The Hacker News” about Hangzhou Xiongmai Technology:
http://thehackernews.com/2016/10/iot-camera-mirai-…
