The Wirecutter , an in-depth comparative review site for various electrical and electronic devices, just published an opinion piece on whether users should be worried about security issues in IoT devices . The summary: avoid devices that don't require passwords (or don't force you to change a default and devices that want you to disable security, follow general network security best practices but otherwise don't worry - criminals aren't likely to target you.
This is terrible, irresponsible advice. It's true that most users aren't likely to be individually targeted by random criminals, but that's a poor threat model. As I've mentioned before, you need to worry about people with an interest in you . Making purchasing decisions based on the assumption that you'll never end up dating someone with enough knowledge to compromise a cheap IoT device (or even meeting an especially creepy one in a bar) is not safe, and giving advice that doesn't take that into account is a huge disservice to many potentially vulnerable users.
Of course, there's also the larger question raised by the last week's problems. Insecure IoT devices still pose a threat to the wider internet, even if the owner's data isn't at risk. I may not be optimistic about the ease of fixing this problem , but that doesn't mean we should just give up. It is important that we improve the security of devices, and many vendors are just bad at that.
So, here's a few things that should be a minimum when considering an IoT device: Does the vendor publish a security contact? (If not, they don't care about security) Does the vendor provide frequent software updates, even for devices that are several years old? (If not, they don't care about security) Has the vendor ever denied a security issue that turned out to be real? (If so, they care more about PR than security) Is the vendor able to provide the source code to any open source components they use? (If not, they don't know which software is in their own product and so don't care about security, and also they're probably infringing my copyright) Do they mark updates as fixing security bugs? (If not, they care more about hiding security issues than fixing them) Has the vendor ever threatened to prosecute a security researcher? (If so, again, they care more about PR than security) Does the vendor provide a public minimum support period for the device? (If not, they don't care about security or their users)I've worked with big name vendors who did a brilliant job here. I've also worked with big name vendors who responded with hostility when I pointed out that they were selling a device with arbitrary remote code execution. Going with brand names is probably a good proxy for many of these requirements, but it's insufficient.
So here's my recommendations to The Wirecutter - talk to a wide range of security experts about the issues that users should be concerned about, and figure out how to test these things yourself. Don't just ask vendors whether they care about security, ask them what their processes and procedures look like. Look at their history. And don't assume that just because nobody's interested in you, everybody else's level of risk is equal.
