By now, I’m sure you’ve heard of it. IoT.  Even if you don’t know the acronym  The Internet of Things.

The joke is that “things”is not what it’s about. Sure, these are devices with a computer chip (albeit generally dumbed down) and an internet (wireless) connection.  But, the killer app (see, there’s the hint) is that devices are not what will drive this market.   It’s all about services.

Just this past Friday, I was with a client when a customer came in trying to buy an (old-fashioned) address book.  She’d been searching for a while and no one has one in stock.  (I told her that she needed to “Bing” it and buy it online.  She didn’t get that- until I told her, “OK.  Google it.”}

This actually is the underlying issue driving IoT.  Over the past two or three decades, we’ve converted our “storage” from analog to digital.  And, by and large, no one considered the security needs that would support this change.  (OK.  We have.  Our devices only use our secure Wi-Fi networks.  And, we’ve changed the passwords that are standard.  Admin, password, or the vendor’s name simply don’t satisfy our security needs.)

That is the major problem.  It’s why you and I shouldn’t be happy with the “services”.  Because they are way too easy to hack.  Let’s consider a toy for a second.

Genesis has introduced a doll with long blond hair, My Friend Cayla.  This doll (running off 3 AA batteries) employs speech recognition (an embedded microphone via Bluetooth connects with either Android OS or Apple iOS) that can effect a conversation with your child.  (Or you.)  Basically, the toy searches the internet for similarities in what was said and then answers with what the online world recommends.  (It parses the words into speech for the reply, with about a one second delay.  Moreover, it engages with Google Translate so it is adept with languages.)  Oh, and each doll has a “database” detailing her family and pets, plus her favorite foods, pop stars, and movies.

Not surprisingly, this doll has been banned and panned in a few countries.  Because it is considered an illegal espionage apparatus.  (The only way you can have the doll in some countries is to disconnect it from the internet, which means it’s basically a static toy.)

You see, there is no real security on this doll’s chip.  So, anyone (ok, a hacker) can hone in on the toy and spy (via the microphone; thankfully, this doll doesn’t have a camera) and track the tyke with no one the wiser.

I am not just picking on Genesis. No, the same situation exists with Furby’s Connect doll by Hasbro, or the StarWars BB-8 by Sphero, among many other “toys”.  (By the way, that last toy has a camera- which means the spying can lead to the filming of “kiddy porn”.)  The problem is that these devices all lack the “knowledge” to only connect to the internet via a select group of “trusted” devices.

(Furby can accept connections from almost anyone within 100 feet of the toy- who can then have a conversation with your child.  Since the child trusts the toy, who knows what s/he can be enticed to do/perform.  My Friend Cayla has a smaller radius- 50 feet, but still…)

Nor, am I picking on toys.  There are about 9 billion IoT things in use as of this year- and that number will more than double within two years.

Tomorrow, we’ll delve into what this really means for our (in)security.

Share this: