WEBVTT
00:00:00.000 --> 00:00:14.985
34c3 intro
00:00:14.985 --> 00:00:23.670
Herald: So, to our next talk... Sit and
relax, you know what that means. Glass of
00:00:23.670 --> 00:00:30.599
wine or mate, your favorite easy chair,
and of course your latest WIFI enabled toy
00:00:30.599 --> 00:00:36.099
compromising your intimate moments.
Barbara Wimmer, as free author and
00:00:36.099 --> 00:00:40.649
journalist, will tell you more about the
Internet of Fails,
00:00:40.649 --> 00:00:47.190
will tell you more about where IoT goes
wrong. She's a free author and journalist
00:00:47.190 --> 00:00:57.440
at futurezone.at, (DORF?), and will in the
near future release one or two public
00:00:57.440 --> 00:01:11.769
stories and a book. Applause!
applause
00:01:11.769 --> 00:01:15.780
Barbara Wimmer: Hello everybody. I'm
waiting for my slides to appear on the
00:01:15.780 --> 00:01:23.740
screen. Where are my slides please? That's
not my slides.
00:01:37.420 --> 00:01:48.630
Oh, thank you very much. So welcome to the
talk Internet of Fails when IoT has gone
00:01:48.630 --> 00:01:59.140
wrong. This is a very negative topic title
actually and you're getting a lot of
00:01:59.140 --> 00:02:06.710
negative stories in this next hour but I
don't want to talk only about negative
00:02:06.710 --> 00:02:13.610
things so you can see "FAIL" as a "first
attempt in learning". So actually at the
00:02:13.610 --> 00:02:19.030
end of the talk I want to talk about
solutions as well and I don't want to
00:02:19.030 --> 00:02:27.290
provide only bad and negative examples
because that's what we hear every day. And
00:02:27.290 --> 00:02:33.500
this is perfect for the congress motto
"tuwat" because this is all about let's
00:02:33.500 --> 00:02:44.770
tuwat together. So nobody, most of you in
this room don't will not know me. So I'm
00:02:44.770 --> 00:02:51.850
going to introduce myself a little bit and
why I'm talking to you about this topic,
00:02:51.850 --> 00:02:58.040
because that's probably what everybody
asks me when I appear somewhere and say oh
00:02:58.040 --> 00:03:07.490
I give talks about IoT. And so actually I
work as an IT journalist for more than 12
00:03:07.490 --> 00:03:17.490
years. And I got in contact with internet
of things in 2014 when I talked to the
00:03:17.490 --> 00:03:26.430
local CERT.at team in Austria. I'm from
Vienna. And they first told me that the
00:03:26.430 --> 00:03:32.420
first refrigerator was caught that was
sending out spam mails and that was in
00:03:32.420 --> 00:03:42.470
2014 and actually that was really a funny
story back then and we were laughing about
00:03:42.470 --> 00:03:48.530
it but at the same time we already knew
that there is something coming up which is
00:03:48.530 --> 00:03:59.870
quite going to be a huge development and
so from back then I watched the whole IoT
00:03:59.870 --> 00:04:09.150
development in terms of security and
privacy. And in the next 45min you will
00:04:09.150 --> 00:04:19.219
hear a lot of stuff about IoT, and where
the problem with IoT is currently and
00:04:19.219 --> 00:04:26.400
examples of fails in terms of security and
privacy. But like I mentioned before I
00:04:26.400 --> 00:04:31.760
wanna talk about solutions and when we
talk about solutions it will not be like
00:04:31.760 --> 00:04:38.019
only one side, like only the consumer,
only the IT-security, only developers.
00:04:38.019 --> 00:04:46.740
Actually what I'm going not to provide is
detailed IT-security stuff. So if you
00:04:46.740 --> 00:04:53.789
wanna focus more on any story that I'm
talking about I'm mentioning most of the
00:04:53.789 --> 00:05:01.709
the sources in the slides and if you
really wanna know this example got up,
00:05:01.709 --> 00:05:06.559
please look it up if you're really
interested deeply into it. I'm a
00:05:06.559 --> 00:05:12.889
journalist and not an IT-security person
so please don't expect me to go into
00:05:12.889 --> 00:05:19.770
details in this talk. Thats why it's also
in the ethics talk - ethics section of the
00:05:19.770 --> 00:05:28.759
congress and not the security part. So
coming to the internet of things I want to
00:05:28.759 --> 00:05:39.759
start with a few numbers because these
numbers show the development of IoT. In
00:05:39.759 --> 00:05:48.700
2016 we had 6.3 billions of devices out
there. This year we already had 8.3
00:05:48.700 --> 00:05:58.830
billion of devices and in 2020 we will -
we are going to have 20.4 billion
00:05:58.830 --> 00:06:05.159
connected devices out there. So the
numbers are from Gartner Institute from
00:06:05.159 --> 00:06:13.699
January and I have one more slide with
more accurate data from June this year and
00:06:13.699 --> 00:06:23.400
actually this slide shows that the
development is actually really growing.
00:06:23.400 --> 00:06:32.400
17% more compared to the previous year.
And by 2021 global IoT spending is
00:06:32.400 --> 00:06:42.389
expected to reach about 1.4 trillion
dollars. So maybe some you are asking
00:06:42.389 --> 00:06:49.809
yourself: What is the internet of things?
Maybe some of you expected I'm only
00:06:49.809 --> 00:06:59.669
talking about a smart home, because IoT is
often related to the smart home. And we're
00:06:59.669 --> 00:07:06.139
having all the smart devices that we put
into our living rooms, but that's actually
00:07:06.139 --> 00:07:12.740
not the main focus because it's more about
the connected everything. Which means
00:07:12.740 --> 00:07:19.239
toys, sex toys, home automation,
lightbulbs, surveillance cameras,
00:07:19.239 --> 00:07:28.569
thermostats, but also digital assistants
and wearables. So I wanna start with a few
00:07:28.569 --> 00:07:37.580
examples of classical internet of things
stuff which is actually a smart coffee
00:07:37.580 --> 00:07:45.430
maker. That's ... so what is smart about a
coffee maker? It only gets ... it doesn't
00:07:45.430 --> 00:07:51.429
get smart when you regulate your coffee
machine by app because what's smart about
00:07:51.429 --> 00:07:58.189
that? You can just press the button on the
machine. But when you connect your coffee
00:07:58.189 --> 00:08:05.750
machine with fitness and sleeping trackers
the coffee machine already knows when you
00:08:05.750 --> 00:08:13.179
get up if you need a strong or soft coffee
in the morning and so that might sound
00:08:13.179 --> 00:08:20.469
comfortable for some of us, but it also
has a lot of dangers inside, because you
00:08:20.469 --> 00:08:25.709
never know that the data is really safe
and only stays with you. Maybe your
00:08:25.709 --> 00:08:37.429
insurance company get them one day. So you
all know Cars -probably-, the film, and
00:08:37.429 --> 00:08:46.040
this is McLightning Queen and it got a toy
nowadays which is sold for 350 dollars -
00:08:46.040 --> 00:08:55.490
no sorry, euros - and this car is able to
sit next to you and watch the film with
00:08:55.490 --> 00:09:02.310
you and is going to comment the film.
laughter
00:09:02.310 --> 00:09:09.740
And it is - this sounds very funny - but -
and it is funny - but it means that it has
00:09:09.740 --> 00:09:15.130
a microphone integrated which is waiting
for the terms in the film on the right
00:09:15.130 --> 00:09:22.750
stories and then it makes comments. And
the microphone can only be turned off by
00:09:22.750 --> 00:09:30.810
app so there's no physical button to turn
it off and actually another thing is when
00:09:30.810 --> 00:09:36.410
you first ... when you actually got this
present for Christmas, which is a really
00:09:36.410 --> 00:09:46.589
expensive present with 350 euros, it's
actually first updating for more than
00:09:46.589 --> 00:10:01.230
35min before you can even use it. The next
example - you're already laughing - is
00:10:01.230 --> 00:10:09.120
internet of ... I call it internet of shit
because you can't say anything else to
00:10:09.120 --> 00:10:16.350
that example. It's a toilet IoT sensor
which is actually a smart, small little
00:10:16.350 --> 00:10:25.269
box which is put into the toilet. And this
box has sensors. It's an Intel box but I
00:10:25.269 --> 00:10:34.760
don't know and this box has sensors and
these sensors help analyzing the stool.
00:10:34.760 --> 00:10:44.360
And this data that is collected is going
to send into the cloud. And actually this
00:10:44.360 --> 00:10:49.550
could be very useful for people who are
having chronical diseases like Colitis
00:10:49.550 --> 00:10:59.319
Ulcerosa or other chronical diseases with
the digestion stuff but it is mainly
00:10:59.319 --> 00:11:05.480
designed for healthy people who want to
make better nutrition and reduce their
00:11:05.480 --> 00:11:13.870
stress levels with the stool analysis. And
maybe it sounds good at the beginning but
00:11:13.870 --> 00:11:21.709
this data that is collected could also be
used for other things in the future. So
00:11:21.709 --> 00:11:30.889
it's a perfect example for internet of
shit. But there is another internet of
00:11:30.889 --> 00:11:37.970
shit which is a twitter account that
collects all these funny little stories.
00:11:37.970 --> 00:11:44.920
It's not from me, so I'm not behind that.
I tried to reach the person but I never
00:11:44.920 --> 00:11:50.730
got a replay so I can't tell you anything
about them but they collect examples - if
00:11:50.730 --> 00:11:55.579
you don't follow them now and are
interested in this topic you might do
00:11:55.579 --> 00:12:05.410
after this talk - so after presenting a
couple of IoT examples with the good and a
00:12:05.410 --> 00:12:13.089
bit of the bad sides I first wanna focus a
little bit on the problem because as I
00:12:13.089 --> 00:12:20.149
said before you might now think that
everything is nice, comfortable, why
00:12:20.149 --> 00:12:26.690
shouldn't we do that and stuff like that.
So the problem is that most of the vendors
00:12:26.690 --> 00:12:33.730
that are doing IoT stuff now, that start
to connect everything, they are creating
00:12:33.730 --> 00:12:41.350
manually operated devices without
connectivity for long years and they had a
00:12:41.350 --> 00:12:48.060
lot of knowledge in terms of materials,
ergonomics, mechanical engineering but
00:12:48.060 --> 00:12:58.199
almost zero in the fields of IT security.
Actually I don't say that without having
00:12:58.199 --> 00:13:06.959
talked to vendors that have said exactly
that when I interviewed them. Like there
00:13:06.959 --> 00:13:14.509
was a lightbulb vendor from Austria who is
a really big vendor who is making
00:13:14.509 --> 00:13:22.399
lightbulbs for years and years and years
and actually they started to make
00:13:22.399 --> 00:13:34.610
connected lightbulbs in 2015 and when they
did that they ... and I asked them "Oh how
00:13:34.610 --> 00:13:44.959
big is your IT security department?" "1
Person". So they didn't actually have the
00:13:44.959 --> 00:13:51.579
knowledge that IT security might be more
important when they connect - when they
00:13:51.579 --> 00:14:00.079
start to connect things. And actually the
result is that these vendors are making
00:14:00.079 --> 00:14:05.519
the same sort of security errors than the
high tech industry was dealing with 15
00:14:05.519 --> 00:14:14.269
years ago. So the early 2000s called and
want their web security, their lack of
00:14:14.269 --> 00:14:23.700
security back. So there are all kinds of
problems we already know from past:
00:14:23.700 --> 00:14:28.709
hardcoded passwords, unsecure bluetooth
connections, permanent cloud server
00:14:28.709 --> 00:14:38.920
connections and a lot of other stuff. So
we're going to have from all these 20
00:14:38.920 --> 00:14:45.709
billion devices out there, there will be a
lot of unsecure devices and the problem is
00:14:45.709 --> 00:14:53.410
that they are collecting to a botnet and
are starting DDoS attacks and we are going
00:14:53.410 --> 00:15:02.579
to have internet outages. For those who
are not familiar with the terms I made a
00:15:02.579 --> 00:15:07.550
really really really short explanation so
that you are also understanding what I am
00:15:07.550 --> 00:15:14.709
talking about. A botnet is a network of
private computers infected with malicious
00:15:14.709 --> 00:15:21.749
software and controlled as a group without
the owners knowledge. Like the example of
00:15:21.749 --> 00:15:29.060
the refrigerator that was sending out spam
I told you about earlier. This
00:15:29.060 --> 00:15:35.870
refrigerator sent out ... one refrigerator
was sending out 750.000 spam mails by the
00:15:35.870 --> 00:15:43.029
way. So the botnet, that has a botnet
owner of course, because it's not only a
00:15:43.029 --> 00:15:50.430
zombie botnet, and the botnet owner can
control this network of infected computers
00:15:50.430 --> 00:15:57.611
by issuing commands to perform malicious
activities like DDoS attacks. So DDoS is a
00:15:57.611 --> 00:16:04.300
distributed denial of Service attack and
actually that's an attempt to stop
00:16:04.300 --> 00:16:10.459
legitimate users form accessing the data
normally available on a website. And this
00:16:10.459 --> 00:16:19.590
actually can lead to completely shutdown
of a service. And we had this already so
00:16:19.590 --> 00:16:30.070
I'm not talking about something in the far
future but we had this in 2016 and most
00:16:30.070 --> 00:16:37.639
people already recognized it but it didn't
recognized why - their twitter accounts
00:16:37.639 --> 00:16:43.750
did not work, they couldn't use Reddit, or
Spotify, or they couldn't pay with PayPal
00:16:43.750 --> 00:16:52.850
at the moment. And behind that attack was
Mirai so several other major services were
00:16:52.850 --> 00:17:03.230
offline because an infrastructure provider
was attacked by zombie IoT devices. And
00:17:03.230 --> 00:17:11.579
this was one year ago and now one year
later Mirai botnet infections are still
00:17:11.579 --> 00:17:21.400
widespread so not every zombie device is
already secured so there are still some
00:17:21.400 --> 00:17:26.829
around and not so little and actually
there is a study saying that every
00:17:26.829 --> 00:17:35.800
unsecured - no every botnet infection
that's there - every security hole thats
00:17:35.800 --> 00:17:42.910
there is staying there for at least 7
years which means that all the unsecure
00:17:42.910 --> 00:17:50.890
devices which are out now could get
infected and could stay infected for 7
00:17:50.890 --> 00:17:56.680
years. So that's why it's very important
that we are going to do something really
00:17:56.680 --> 00:18:10.170
quickly and not starting like in 2020. So
Mirai was supposed to continue in 2017 and
00:18:10.170 --> 00:18:20.220
actually a lot of DDoS attacks similar
attacks like Mirai happened in 2017. This
00:18:20.220 --> 00:18:29.870
as an example could unleash at any moment
which was in November one few days later
00:18:29.870 --> 00:18:41.650
exactly this attack was unleashed, so it
happened. In 2017 we also had a huge
00:18:41.650 --> 00:18:54.400
increase in DDoS attacks 91% increase from
Q1 and it's going to increase more. I have
00:18:54.400 --> 00:19:09.290
to take a short sip, sorry.
Now we're coming back to examples. One
00:19:09.290 --> 00:19:15.720
really good example is the university that
was attacked by it's own vending machines
00:19:15.720 --> 00:19:26.250
and smart lightbulbs and 5000 other IoT
devices. This was very very difficult to
00:19:26.250 --> 00:19:31.740
get fixed because they couldn't get the
university network down so they had to
00:19:31.740 --> 00:19:38.260
find a really difficult solution to get it
back up. And actually how did they even
00:19:38.260 --> 00:19:42.650
notice about it? Because the students
complained that the internet was going so
00:19:42.650 --> 00:19:53.240
slow. Another example which has nothing to
do with DDoS attacks anymore but with IoT
00:19:53.240 --> 00:20:03.480
sensors - actually - in a fishtank in an
American casino - north American casino
00:20:03.480 --> 00:20:12.140
there were sensors measuring the
temperature of the aquarium and the
00:20:12.140 --> 00:20:18.900
fishtank - that the fishes didn't die -
and these sensors were sending the data to
00:20:18.900 --> 00:20:28.500
a PC of this casino and this PC was the
same - was using the same network than the
00:20:28.500 --> 00:20:37.870
sensors so actually the cybercriminals
could access to this data of the casino
00:20:37.870 --> 00:20:43.210
and were stealing them and sending them to
their own servers in Finland. And the
00:20:43.210 --> 00:20:56.500
amount was about 10GB of data. Another
example which is actually one of my most -
00:20:56.500 --> 00:21:03.490
I don't know why but it's the example I
personally like most of the whole examples
00:21:03.490 --> 00:21:11.190
that are collected in 2017. So there was a
surveillance camera bought by a
00:21:11.190 --> 00:21:22.060
netherlands woman. Actually she wanted to
surveil her dog when she was out at work
00:21:22.060 --> 00:21:29.840
but what did this camera do? It did
surveil the dog when she was out at work,
00:21:29.840 --> 00:21:37.260
but when she was at home the camera
followed her through the room and was
00:21:37.260 --> 00:21:44.410
watching her all over the place. And it
had a microphone integrated and one day it
00:21:44.410 --> 00:21:51.680
started to talk with her and it said "hola
señorita". And this woman was so
00:21:51.680 --> 00:21:59.890
frightened that she actually started to
record that because she thought that
00:21:59.890 --> 00:22:08.290
nobody will buy this story. All will think
I’m crazy but this camera actually did not
00:22:08.290 --> 00:22:15.580
surveil the dog but was hacked and
surveiled her. And it was a very cheap
00:22:15.580 --> 00:22:21.870
camera by the way. She bought it in a
supermarket but we don't know the name of
00:22:21.870 --> 00:22:29.330
the vendor in this case. So coming for a
very cheap camera to a very hightech
00:22:29.330 --> 00:22:40.140
camera the cameras you see here is one
that is actually build in a lot of
00:22:40.140 --> 00:22:48.180
companies and there was a security hole
found by some Vienna security specialists
00:22:48.180 --> 00:22:53.240
from SEC consult and actually they
demonstrated me how they could actually
00:22:53.240 --> 00:23:03.450
hack into this camera and how they could
make it possible that this camera shows
00:23:03.450 --> 00:23:13.240
pictures of an empty room in a bank so the
pictures from the empty room in the bank
00:23:13.240 --> 00:23:20.240
were shown to me and in reality the bank
was robbed - ok, not in reality. But it
00:23:20.240 --> 00:23:29.210
could have been robbed. So thats actually
sounding a little bit like a movie scene
00:23:29.210 --> 00:23:37.530
and actually this camera which is sold as
a security camera is kind of useless when
00:23:37.530 --> 00:23:42.840
it doesn't have security and it doesn't
really show the picture. And the problem
00:23:42.840 --> 00:23:53.970
with this camera was hardcoded passwords.
And the hardcoded password got fixed after
00:23:53.970 --> 00:24:02.690
so it was responsible disclosure process
and this camera is safe now. So I'm coming
00:24:02.690 --> 00:24:11.800
to a different example now. And this now
finally explains why this toy is sitting
00:24:11.800 --> 00:24:19.670
here. Before my talk everybody was telling
me "Ah, you brought your favorite toy, to
00:24:19.670 --> 00:24:26.140
protect you during your talk." and I was
laughing "Oh no. No no no no, it one of
00:24:26.140 --> 00:24:36.570
the most unsecure devices out there." But
before we come to this in special I'm
00:24:36.570 --> 00:24:46.790
going to talk a little bit about connected
toys. So the Germany Stiftung Warentest
00:24:46.790 --> 00:24:54.650
had made a study regarding connected toys.
The people were testing them and actually
00:24:54.650 --> 00:25:04.820
all of their tested bears, robot dogs and
dolls were very very unsecure and some of
00:25:04.820 --> 00:25:12.779
them were even critical and are extremely
critical and others were critical. And
00:25:12.779 --> 00:25:22.370
actually what was the problem with the
toys and also with this? They were using -
00:25:22.370 --> 00:25:28.210
they are using bluetooth connections. And
these bluetooth connections are not
00:25:28.210 --> 00:25:34.360
secured by a password or a PIN code. So
every smartphone user close enough could
00:25:34.360 --> 00:25:42.630
connect to the toy and listen to children
or ask questions or threaten them and
00:25:42.630 --> 00:25:49.670
another problem are the data collecting
apps related to this stuff. So actually
00:25:49.670 --> 00:25:58.640
this little unicorn has an app where you
can send the messages. So what does this
00:25:58.640 --> 00:26:07.790
actually? It can play messages and you can
- as a child you can record messages and
00:26:07.790 --> 00:26:17.460
send it to you mom or your dad. And when
you play messages you never - the heart
00:26:17.460 --> 00:26:24.690
blinks. So actually there's a message
waiting for you now. And I'm not sure if
00:26:24.690 --> 00:26:32.710
it's the same that I recorded earlier
before. Maybe now it is, maybe at the end
00:26:32.710 --> 00:26:42.730
of the talk when I press the button again
it might not be. And so everybody can - so
00:26:42.730 --> 00:26:49.840
this - err sorry - This device does have
an app where you can send the message to.
00:26:49.840 --> 00:26:55.730
And it also has a children interface and
where you are using the children interface
00:26:55.730 --> 00:27:02.660
you're seeing that there are ads
integrated. And in the children's
00:27:02.660 --> 00:27:13.230
interface there were ads for porn and
ehm... ...other stuff, which are not
00:27:13.230 --> 00:27:20.320
really in the best hands of a child. And
this is also what Stiftung Warentest has
00:27:20.320 --> 00:27:31.140
actually - yeah has actually found out.
The data is also used to send to third
00:27:31.140 --> 00:27:35.700
party companies and they put trackers to
control the online behavior of their
00:27:35.700 --> 00:27:42.700
parents. This is also done with this
device. So the Stiftung Warentest advises
00:27:42.700 --> 00:27:51.290
a not connectible dumb teddy might be the
smarter choice in the future. And before I
00:27:51.290 --> 00:27:56.530
finally press this button - you're
probably curious now - but first I'm going
00:27:56.530 --> 00:28:07.420
to talk a little bit about Cayla. You
probably have heard of Cayla as a very
00:28:07.420 --> 00:28:14.880
unsecure doll. Actually it got forbidden
in Germany by law. It is judged as a
00:28:14.880 --> 00:28:22.080
prohibited broadcasting station. And
parents who do not destroy it will be
00:28:22.080 --> 00:28:28.710
actually fined. And I tried to buy Cayla
in Austria and didn't get the doll. So
00:28:28.710 --> 00:28:35.050
actually it should be really off the
market in the German speaking area. And
00:28:35.050 --> 00:28:43.500
actually that is also a result of a
campaign from Norway called Toyfail, which
00:28:43.500 --> 00:28:49.800
is a Norwegian consumer organization who
are actually - this is Cayla. You can see
00:28:49.800 --> 00:29:00.110
her now. Which is actually going to the
European Parliament to make them
00:29:00.110 --> 00:29:07.830
understand how unsecure toys is doing a
lot of harm and how we should put more
00:29:07.830 --> 00:29:17.130
security into toys. And I've brought a
short little video and I hope we can hear
00:29:17.130 --> 00:29:27.810
the audio here as well. We will see.
No. You don't hear anything.
00:29:27.810 --> 00:29:31.660
But this doesn't matter because they
have...
00:29:31.660 --> 00:29:35.960
Sign Language Interpreter: subtitles
Barbara: subtitles.
00:29:35.960 --> 00:29:40.530
Person (Video): There's not added any kind
of security. With simple steps I can talk
00:29:40.530 --> 00:29:44.990
through the doll and listen to other
people.
00:29:44.990 --> 00:29:47.740
Person through doll (Video): No one wants
others to speak directly through the doll.
00:29:47.740 --> 00:29:56.790
Barbara: He's speaking now at the moment.
Doll: inaudible
00:29:56.790 --> 00:30:38.900
Person: And you may think... [see video
subs] ... Cayla, can I trust you?
00:30:38.900 --> 00:30:44.010
Doll: I don't know.
laughter
00:30:44.010 --> 00:30:58.150
applause
Barbara: Yeah and we don't trust Cayla and
00:30:58.150 --> 00:31:07.910
we also don't trust our little unicorn.
button clicking
00:31:07.910 --> 00:31:25.040
laughter
crying baby in background
00:31:25.040 --> 00:31:34.810
Barbara: Ok, somebody has hacked it.
laughter
00:31:34.810 --> 00:31:42.920
Yes.
Unicorn Toy: Hello, Chaos Communication
00:31:42.920 --> 00:31:48.000
Congress.
Barbara: Ok, that's what I recorded
00:31:48.000 --> 00:31:57.140
earlier. But there is some time left.
Maybe, maybe... but you're all sitting too
00:31:57.140 --> 00:32:04.120
far actually and nobody of you brought
your computer, so... but we will see, we
00:32:04.120 --> 00:32:10.040
will try it later on. So but actually you
shouldn't trust this unicorn, because this
00:32:10.040 --> 00:32:22.360
unicorn is from the company called
Cloudpets, which is a - no sorry It's a
00:32:22.360 --> 00:32:29.680
toy called Cloudpet and the company is
Spiraltoys from the US. So this is
00:32:29.680 --> 00:32:39.110
Cloudpet and there are cats and dogs and
unicorns and it's very ugly but it's a
00:32:39.110 --> 00:32:48.640
unicorn. And actually now I'm already
talking a lot about this. Why I'm
00:32:48.640 --> 00:32:57.550
explaining you now. There already was a
data breach with this toy so the
00:32:57.550 --> 00:33:05.610
children's messages in Cloudpets data
actually was stolen and was public on the
00:33:05.610 --> 00:33:13.740
internet. 2 million voice messages
recorded on the cuddly toys has been
00:33:13.740 --> 00:33:25.060
discovered free on the internet. And
actually Spiraltoys say that there was no
00:33:25.060 --> 00:33:33.631
data breach but the data was there, so...
Thats also why I brought this, it was
00:33:33.631 --> 00:33:40.360
still very easily available and actually
as I said before the app for child the
00:33:40.360 --> 00:33:51.250
interface shows porn ads, so I would not
recommend that for your child. Actually
00:33:51.250 --> 00:33:55.600
there are already a lot of institutions
out there which are warning for connected
00:33:55.600 --> 00:34:03.490
toys also the consumer group Which? which
actually did a study about this and other
00:34:03.490 --> 00:34:10.000
like also the Furby connected they
analyzed, the German Stiftung Warentest,
00:34:10.000 --> 00:34:13.949
the Austrian Verein für
Konsumenteninformation, the Norwegian
00:34:13.949 --> 00:34:22.429
consumer council, and the FBI. The list is
to be continued. So consider if you really
00:34:22.429 --> 00:34:31.480
need a connected toy for your child or
yourself because the next section is about
00:34:31.480 --> 00:34:37.979
sex toys.
laughter
00:34:37.979 --> 00:34:49.900
applause
squeaky horn
00:34:49.900 --> 00:34:57.170
more laughter and applause
I am not... It's not necessary say a lot
00:34:57.170 --> 00:35:04.330
about this example. It's actually a
connected vibrator that has a build-in
00:35:04.330 --> 00:35:18.870
camera and this camera is very very very
unsafe. Also this toy is really expensive,
00:35:18.870 --> 00:35:24.670
so you can't say "Eh, it's only the cheap
stuff that is so unsecure." Also the high-
00:35:24.670 --> 00:35:32.480
tech stuff can be really unsecure. I mean
this vibrator costs 250 dollars so it's
00:35:32.480 --> 00:35:42.610
very expensive and it has a build-in web-
connected endoscope and they found out
00:35:42.610 --> 00:35:55.640
that it's massively insecure. The password
of this... And if you forgot to change it
00:35:55.640 --> 00:36:01.740
it's a few more players than expected that
might be watching your newest video about
00:36:01.740 --> 00:36:09.950
your private sex adventures. There was
another example actually in this - sorry
00:36:09.950 --> 00:36:14.640
go back one more time to this example -
there's a very funny video on it on
00:36:14.640 --> 00:36:20.490
youtube about it, maybe you wanna watch
it. I didn't bring it because I couldn't
00:36:20.490 --> 00:36:31.600
reach the makers of it. So I'm going to
the next example which is about a case of
00:36:31.600 --> 00:36:39.040
sex toy company that actually admits to
recording users remote sex sessions and it
00:36:39.040 --> 00:36:48.110
called it a "minor bug". It was this love
sensor remote app you can see the icon
00:36:48.110 --> 00:36:56.050
here and actually this is a vibrator and
an app and the vibrator controlling app
00:36:56.050 --> 00:37:03.080
was recording all the sex sounds, all the
sounds you're making when you're using
00:37:03.080 --> 00:37:09.610
this vibrator and stores them on the phone
without your knowledge. And the company
00:37:09.610 --> 00:37:15.600
says that no information or data was sent
to the servers so this audio file exists
00:37:15.600 --> 00:37:21.570
only temporarily and only your device. And
they already had an update so actually
00:37:21.570 --> 00:37:28.280
this is not as funny as the other story
but still it's an example of how unsecure
00:37:28.280 --> 00:37:38.450
sex stuff can be. So there are lot of lot
of more sex examples out there. One you
00:37:38.450 --> 00:37:45.780
should actually definitely search for
after - please don't search for now, but
00:37:45.780 --> 00:37:55.250
after this talk. You could google or
duckduckgo or whatever you use the terms
00:37:55.250 --> 00:38:04.280
"blowjob injection". And please add
"security" because otherwise you will land
00:38:04.280 --> 00:38:07.920
on other sites.
laughter
00:38:07.920 --> 00:38:18.360
And this was a female security expert who
was doing this research about a device
00:38:18.360 --> 00:38:24.760
which actually was supposed to your
girlfriend could make you a special
00:38:24.760 --> 00:38:31.050
blowjob program, your special blowjob and
this could be hacked so somebody else's
00:38:31.050 --> 00:38:39.120
blowjob might appear instead your own.
laughter
00:38:39.120 --> 00:38:47.520
So there's also a story about a map of
buttplugs in Berlin that are unsecure.
00:38:47.520 --> 00:38:56.460
Also if you're interested in that please
also search for that story. Because it's
00:38:56.460 --> 00:39:01.450
funny to talk about this, but I also wanna
talk little bit about things that we could
00:39:01.450 --> 00:39:08.890
actually do. And one of the projects in
this part is actually doing something
00:39:08.890 --> 00:39:14.480
thats called the "internet of dongs
project - hacking sex toys for security
00:39:14.480 --> 00:39:22.190
and privacy". And as you can see it's
supported by PornHub, which in this case
00:39:22.190 --> 00:39:29.030
means that they get money from PornHub
that they can buy sex toys for their
00:39:29.030 --> 00:39:41.680
research. So PornHub is sponsoring them.
Actually I did for talk to the guy who is
00:39:41.680 --> 00:39:49.510
behind this project. He's called
Randomman. That's a render of him and this
00:39:49.510 --> 00:39:57.210
is the website by the way. So he told me
he's currently - they're currently a team
00:39:57.210 --> 00:40:05.600
of about 15-20 people out there that are
doing their security research in their own
00:40:05.600 --> 00:40:10.980
spare time. And they are not getting any
money for it and they also don't want to
00:40:10.980 --> 00:40:17.670
get any money but they are already looking
for more security experts that wanna join
00:40:17.670 --> 00:40:24.440
the team and also they have also an
ethical codex and stuff like that and
00:40:24.440 --> 00:40:32.180
actually one of the most important things
that he was telling me is that he doesn't
00:40:32.180 --> 00:40:41.110
want that you should stay off connected
sex toys at all, but to find the security
00:40:41.110 --> 00:40:54.760
holes that we are all able to use them if
we want without any fear. So yeah, you can
00:40:54.760 --> 00:41:02.710
get in contact with him if you're
interested. Coming to a different section
00:41:02.710 --> 00:41:14.110
now. You can see I'm switching from
security to security and privacy and now
00:41:14.110 --> 00:41:23.900
I'm landed on the privacy section. This is
Google Home. And we all know that there is
00:41:23.900 --> 00:41:32.869
also Amazon Echo and digital assistants
are also smart IoT devices and this is why
00:41:32.869 --> 00:41:38.810
I wanna talk a very very short time about
them because I'm sure a lot of people got
00:41:38.810 --> 00:41:46.290
those devices for Christmas. Actually
there was a big increase of digital
00:41:46.290 --> 00:41:56.630
assistants in the last year int this
quarter 3 of 2016 there were only 900.000
00:41:56.630 --> 00:42:11.040
of such devices sold and in the quarter 3
2017 we had more than 7.4 million of those
00:42:11.040 --> 00:42:17.180
devices sold. So there's a huge increase
and we don't even have the numbers of the
00:42:17.180 --> 00:42:29.110
Christmas time. Yeah you have seen it. so
why I wanna talk about it, because when
00:42:29.110 --> 00:42:36.510
you put this kind of stuff in your home it
might be very comfortable at the beginning
00:42:36.510 --> 00:42:41.520
because you don't have to look up the
weather information you can - you don't
00:42:41.520 --> 00:42:47.250
have to read your emails you can make the
device read your own emails you can use
00:42:47.250 --> 00:42:55.880
them to program your list of what you're
going to buy and stuff like that but
00:42:55.880 --> 00:43:02.380
that's how they learn a lot about the
users habits and their personalties and
00:43:02.380 --> 00:43:07.480
those devices will learn more and more
information about you and this information
00:43:07.480 --> 00:43:16.350
does not stay in your own home it actually
is going to send to the servers of amazon
00:43:16.350 --> 00:43:22.720
and google and I don't need to tell you
what amazon an google are doing with this
00:43:22.720 --> 00:43:31.170
data. current at least currently they are
only collecting it but that's very
00:43:31.170 --> 00:43:39.760
valuable and they turn around and use it
or sell it in various ways to monetize
00:43:39.760 --> 00:43:48.760
that information in one of the future
days. So all digital assistants send the
00:43:48.760 --> 00:43:54.440
voice controls that are made after "Ok,
Google" or "Alexa" to their servers and
00:43:54.440 --> 00:44:00.850
the data will be saved there and it was
not possible for me to find out for how
00:44:00.850 --> 00:44:07.460
long and at which servers. It's not in
their terms of conditions and I couldn't
00:44:07.460 --> 00:44:15.600
find it anywhere. So also the German data
privacy delegate Andrea Voßhoff didn't
00:44:15.600 --> 00:44:21.580
find this information. She criticized that
"It is not easy for users to understand
00:44:21.580 --> 00:44:28.340
how, to what extent and where the
information collected is processed. Also,
00:44:28.340 --> 00:44:37.300
it is not clear how long the data will be
stored." So if you still want those
00:44:37.300 --> 00:44:45.369
devices in your home now there are at
least physical mute button with google
00:44:45.369 --> 00:44:52.150
home and amazon echo and you can also
change the settings to control the data so
00:44:52.150 --> 00:45:00.400
all the data that is collected is regulary
deleted from the servers but of course you
00:45:00.400 --> 00:45:08.490
never know in how may backups it's
collected as well. So yes it's only
00:45:08.490 --> 00:45:22.480
recording after this voice control but
both devices already got hacked and yeah I
00:45:22.480 --> 00:45:32.370
didn't amazon echo got hacked in 2016 and
google mini got hacked in 2017 of course
00:45:32.370 --> 00:45:39.610
both problems got fixed and when I say got
hacked it means that the devices in your
00:45:39.610 --> 00:45:54.000
home were listening to the conversations
all the time. So I'm coming -
00:45:54.000 --> 00:46:01.110
unfortunately the funny examples are over.
I'm coming to the part where I wanna speak
00:46:01.110 --> 00:46:09.960
about what we can do against the lack of
security and lack of privacy with the
00:46:09.960 --> 00:46:18.560
internet of things. So we are currently
having the status quo where we are having an
00:46:18.560 --> 00:46:23.510
information asymmetry between the vendor
and the customer. Currently the
00:46:23.510 --> 00:46:29.100
manufacturers do not need to provide a
sample information but(?) how security of
00:46:29.100 --> 00:46:36.900
a device such as how long it will receive
security updates. so when we buy a device
00:46:36.900 --> 00:46:52.150
we never know... oh is it going to be safe
or not. So what we need ... actually what
00:46:52.150 --> 00:47:00.300
we need. I did write a couple of things -
I write down a couple of things here which
00:47:00.300 --> 00:47:10.410
are partly stolen by the green MEP Jan
Philipp Albrecht from his program because
00:47:10.410 --> 00:47:18.300
he's dealing a lot with that kind of
question what we can do with his work and
00:47:18.300 --> 00:47:27.590
I'm also - I also was stealing some of
those suggestions from the Renderman from
00:47:27.590 --> 00:47:34.520
the Internet of Dongs project, he also had
some helpful tips. And I also stole some
00:47:34.520 --> 00:47:40.000
of the information from security experts I
talked in interviews all of the time
00:47:40.000 --> 00:47:45.080
because we never talk only about the bad
things we always - we all want to get the
00:47:45.080 --> 00:47:52.690
internet of things safer at the end. So
some of them suggested that we could need
00:47:52.690 --> 00:48:01.070
an security star rating system similar to
the energy labeling. And when we talk
00:48:01.070 --> 00:48:13.130
about security star ratings that could
mean that we use a label. When a device
00:48:13.130 --> 00:48:19.551
gets security updates for free for the
next five years it gets the A++ label, if
00:48:19.551 --> 00:48:24.900
it's no updates at all and it stays
unsecure it gets the baddest rating or
00:48:24.900 --> 00:48:32.330
such things. Actually vendors should also
be forced to close security holes instead
00:48:32.330 --> 00:48:39.620
of ignoring them. And they should provide
the security researchers with email
00:48:39.620 --> 00:48:45.850
addresses where we can easily report
security flaws because sometimes the
00:48:45.850 --> 00:48:52.330
hardest part of the game is to actually
find the right contact to send out the
00:48:52.330 --> 00:49:01.450
information about what is unsecure and
what's not. What we also need is a
00:49:01.450 --> 00:49:09.480
mandatory offline mode for electronical
devices so this device at least has a
00:49:09.480 --> 00:49:19.710
button where you can turn it off. so it
doesn't listen to you permanently. And we
00:49:19.710 --> 00:49:28.090
need that for all devices - all connected
devices. Also an airbag and seatbelt for
00:49:28.090 --> 00:49:35.160
the digital age and we also have to talk
about product liability and a clear update
00:49:35.160 --> 00:49:46.090
policy. so there are also good examples
that we are having now. Actually all what
00:49:46.090 --> 00:49:54.920
I was talking about here is regulation.
Regulation that is not existing at the
00:49:54.920 --> 00:50:05.080
moment. But there is some regulation that
is existing in the kind of data which is
00:50:05.080 --> 00:50:12.870
the GDPR the General Data Protection
Regulation which is coming up in May 2018
00:50:12.870 --> 00:50:20.170
and it has included some really really
really helpful things: privacy by design
00:50:20.170 --> 00:50:27.750
and privacy by default. And more
possibilities for law enforcement. And
00:50:27.750 --> 00:50:36.090
this is very very important because it
doesn't say that because we are going to
00:50:36.090 --> 00:50:43.330
have a regulation about privacy by design
and privacy by default this is really done
00:50:43.330 --> 00:50:47.800
by the vendors. Actually when is was
interviewing some of them they already
00:50:47.800 --> 00:50:55.270
told me that it's not their plan to
integrate that in their products they are
00:50:55.270 --> 00:51:03.820
going to wait until they are sued. They
say "Oh, we don't need it. why should we
00:51:03.820 --> 00:51:16.090
do it worked now - nope." So that's why
the law enforcement comes into place and
00:51:16.090 --> 00:51:21.430
maybe some of you know Max Schrems, he's
also speaking here in two days about
00:51:21.430 --> 00:51:28.490
something else though and he a data
protection activist. And he says that
00:51:28.490 --> 00:51:33.780
everything that goes will be done in this
phase we are now, but if vendors won't
00:51:33.780 --> 00:51:44.601
observe the law we have to remind them to
do it. So this is how he looks like and he
00:51:44.601 --> 00:51:51.770
says that with this new regulation we can,
as a customer, ask for compensation when
00:51:51.770 --> 00:51:57.790
data breaches occur. We couldn't do that
so easily now but with this new regulation
00:51:57.790 --> 00:52:05.160
it will get a lot of easier. And if 4
billion people sue a company and ask for
00:52:05.160 --> 00:52:16.160
compensation that could be a bit expensive
at the end. So if you are not able to sue
00:52:16.160 --> 00:52:24.590
anybody yourself, which is not cheap so
nobody - not everybody will secure
00:52:24.590 --> 00:52:32.140
companies you can support organizations
that help you with that like the new
00:52:32.140 --> 00:52:39.150
organization from Max Schrems called "None
of Your Business" maybe you have seen this
00:52:39.150 --> 00:52:45.980
already, I'm not saying that you should
support especially (???) this
00:52:45.980 --> 00:52:52.020
organization but his plan is to actually
do that stuff I explained earlier: sue
00:52:52.020 --> 00:52:59.270
companies that are not abiding to the law.
So if you wanna visit the website they
00:52:59.270 --> 00:53:13.350
currently collecting money. What else can
consumers do? That are no easy tips but we
00:53:13.350 --> 00:53:20.280
can't do much except a few easy things.
Does this product really need an internet
00:53:20.280 --> 00:53:28.000
connection? Is it possible to turn it off?
Is it still working after that? What do we
00:53:28.000 --> 00:53:36.590
find about it on the internet? Can we
reach the vendor? Does the vendor reply
00:53:36.590 --> 00:53:45.030
when I have a question? Do we get more
information? Sometimes also clicktivism
00:53:45.030 --> 00:53:53.179
helps to stop vendors making stupid
decisions. Here is another example from
00:53:53.179 --> 00:54:00.010
the vacuum robot cleaning machine Roomba
who wanted to sell the data that is
00:54:00.010 --> 00:54:08.350
collected from the home from the vacuum
cleaner and actually there was a huge huge
00:54:08.350 --> 00:54:14.080
huge shitstorm after he was announcing
that - the CEO that was announcing that.
00:54:14.080 --> 00:54:20.270
And after the shitstrorm the CEO said "Ok,
no nono. We're not collecting. We're not
00:54:20.270 --> 00:54:28.490
selling your data. No no." So sometimes
this helps as well and of course follow
00:54:28.490 --> 00:54:35.940
the basics in IT-security please update
everything that has updates, separate
00:54:35.940 --> 00:54:45.270
networks from IoT products and use safe
passwords, support open hardware, open
00:54:45.270 --> 00:54:50.890
software, products where the data is
stored locally is always better than in
00:54:50.890 --> 00:54:58.050
the cloud and if you're tech savvy enough
start - which I think you are here - start
00:54:58.050 --> 00:55:09.110
building your own tools. Because you have
the control. And what can developers do?
00:55:09.110 --> 00:55:14.710
Support privacy by design, security by
design, think about it from the beginning
00:55:14.710 --> 00:55:22.150
because you can change it and take
responsibility. And IT security can also
00:55:22.150 --> 00:55:30.010
do some stuff or continue to do some
stuff. Point the vendor to the problems,
00:55:30.010 --> 00:55:36.240
make helping IT security stronger, keep
reporting the flaws, publish your
00:55:36.240 --> 00:55:43.270
research, help develop standards, labels
and seat belts and support each others
00:55:43.270 --> 00:55:52.100
work to a stronger voice about this. So
I'm coming to the end of my talk now and
00:55:52.100 --> 00:55:57.920
to the topic back to the internet of
fails: How many must be killed in the
00:55:57.920 --> 00:56:04.730
Internet of Deadly Things train wrecks?
This is actually an article I was reading
00:56:04.730 --> 00:56:12.750
with a huge interest myself because it was
starting to deal with making comparisons
00:56:12.750 --> 00:56:17.550
to the great age of railway construction
that was likewise riddled with decades of
00:56:17.550 --> 00:56:25.820
disasters before the introduction of
effective signaling and failsafe breaks.
00:56:25.820 --> 00:56:30.140
And it was also comparisoned with the
automotive industry where the mandatory
00:56:30.140 --> 00:56:36.650
fitting of seatbelts designing the bodies
of cars to reduce injury to pedestrians,
00:56:36.650 --> 00:56:42.330
airbag and measures to reduce air
pollution were not introduced not early
00:56:42.330 --> 00:56:51.369
enough. So this guy was asked: Do we
really need to kill a few people first?
00:56:51.369 --> 00:56:58.400
And he said: Unfortunately that will happen.
So he says: Safety and security standards
00:56:58.400 --> 00:57:06.349
for the internet of things can't come soon
enough. I agree with that. With that we
00:57:06.349 --> 00:57:15.960
need standards really soon. So I am at the
end of my talk and if we have some time
00:57:15.960 --> 00:57:22.210
left I'm waiting for your questions,
ideas, and input now. Otherwise I will
00:57:22.210 --> 00:57:25.370
thank you very much for your attention.
00:57:25.370 --> 00:57:28.370
applause
00:57:28.370 --> 00:57:33.890
Herald: Thank you Barbara. A very warm
applause.
00:57:33.890 --> 00:57:37.630
So a small information: If you want to
exit the room please exit the room to your
00:57:37.630 --> 00:57:47.770
left over there. So, questions?
I see one question from the Signal Angel.
00:57:47.770 --> 00:57:54.040
Q: Hello, ok. The internet wants to know,
well those companies don't have any IoT
00:57:54.040 --> 00:58:03.370
security whatsoever or basically none, so
what can we do to make them have more?
00:58:03.370 --> 00:58:07.710
B: What we as who, as consumers?
Q: Yeah, basically.
00:58:07.710 --> 00:58:15.220
B: Yeah, actually I would - what I said
was I would write them and ask for
00:58:15.220 --> 00:58:25.720
standards. I would - I think it can be the
first step that we can write emails or
00:58:25.720 --> 00:58:32.851
call them and say "Well, what kind of
security is build in this device, can you
00:58:32.851 --> 00:58:40.139
tell me? Otherwise I won't buy your
product."
00:58:40.139 --> 00:58:50.270
Herald: Thank you. Any other question? Ok,
in this case again: Thank you Barbara for
00:58:50.270 --> 00:58:53.250
your nice talk.
applause
00:58:53.250 --> 00:58:59.774
A very warm round of applause. Thanks.
00:58:59.774 --> 00:59:05.287
34c3 outro
00:59:05.287 --> 00:59:20.741
subtitles created by c3subtitles.de
in the year 2018. Join, and help us!