Daniel Gessel wrote: ↑Wed Mar 29, 2023 2:29 am
Are IoT devices somehow less secure than, say, a laptop?
They shouldn't be and need not be but the way an IoT product is implemented can make it so.
The problem seems to me to be an issue of having minimised costs or maximised profit as the priority rather than security. To achieve either one can end up cutting corners, doing things which shouldn't be done, not doing things which should be done, and that can create security weaknesses.
That can manifest itself as services, servers and other software left in a final product which may be exploitable when they wouldn't be if they weren't there. Software may get used which is more buggy than it should be. Testing may not be as comprehensive as it could be. Weaknesses in design, bugs and flaws, may not be acted upon and may be ignored.
Additionally product may ship with hard-wired, default or guessable credentials, may rely upon security by way of obscurity, which can mean that once one device is cracked, many, most, or all have been. Mitigation against discovering credentials may not be as good as it could be.
That may be done to minimise costs, maximise profit, or simply to make things easier for the customer.
It's not a new problem but the increase in the number of IoT products deployed these days makes it a bigger one. In the Good Old Days such flaws in security were a godsend for hobbyists and makers, allowing them to do things a manufacturer never intended. These days they expose users of such device to risk they may not be aware of. Back in those Good Old Days, those looking for and exploiting security weaknesses were usually doing so on their own equipment, just for fun, or without malicious intent. These days they may be determined criminal gangs looking to profit themselves and exploit others.
The bottom line is that IoT doesn't have to be any less secure than any other system exposed to the internet and outside world, but it often can be.
But one can't solely blame the manufacturers. When purchasers demand the lowest price, choose product which is cheapest, that usually disadvantages those who do security properly, encourages not doing it properly. One way to get round that is to legislate for minimum standards to level the field but that will be opposed by consumers who don't want to pay more, manufacturers who don't want to lose their advantage from not being as secure as others, and, increasingly these days, insistence from some that it's an essential freedom to have and use product which isn't as secure as it could or should be, and that anything which stands in the way of that is fundamentally wrong, even evil.
