34C3 - Internet of Fails

34c3 intro

Herald: So, to our next talk... Sit and
relax, you know what that means. Glass of

wine or mate, your favorite easy chair,
and of course your latest WIFI enabled toy

compromising your intimate moments.
Barbara Wimmer, as free author and

journalist, will tell you more about the
Internet of Fails,

will tell you more about where IoT goes
wrong. She's a free author and journalist

at futurezone.at, (DORF?), and will in the
near future release one or two public

stories and a book. Applause!
applause

Barbara Wimmer: Hello everybody. I'm
waiting for my slides to appear on the

screen. Where are my slides please? That's
not my slides.

Oh, thank you very much. So welcome to the
talk Internet of Fails when IoT has gone

wrong. This is a very negative topic title
actually and you're getting a lot of

negative stories in this next hour but I
don't want to talk only about negative

things so you can see "FAIL" as a "first
attempt in learning". So actually at the

end of the talk I want to talk about
solutions as well and I don't want to

provide only bad and negative examples
because that's what we hear every day. And

this is perfect for the congress motto
"tuwat" because this is all about let's

tuwat together. So nobody, most of you in
this room don't will not know me. So I'm

going to introduce myself a little bit and
why I'm talking to you about this topic,

because that's probably what everybody
asks me when I appear somewhere and say oh

I give talks about IoT. And so actually I
work as an IT journalist for more than 12

years. And I got in contact with internet
of things in 2014 when I talked to the

local CERT.at team in Austria. I'm from
Vienna. And they first told me that the

first refrigerator was caught that was
sending out spam mails and that was in

2014 and actually that was really a funny
story back then and we were laughing about

it but at the same time we already knew
that there is something coming up which is

quite going to be a huge development and
so from back then I watched the whole IoT

development in terms of security and
privacy. And in the next 45min you will

hear a lot of stuff about IoT, and where
the problem with IoT is currently and

examples of fails in terms of security and
privacy. But like I mentioned before I

wanna talk about solutions and when we
talk about solutions it will not be like

only one side, like only the consumer,
only the IT-security, only developers.

Actually what I'm going not to provide is
detailed IT-security stuff. So if you

wanna focus more on any story that I'm
talking about I'm mentioning most of the

the sources in the slides and if you
really wanna know this example got up,

please look it up if you're really
interested deeply into it. I'm a

journalist and not an IT-security person
so please don't expect me to go into

details in this talk. Thats why it's also
in the ethics talk - ethics section of the

congress and not the security part. So
coming to the internet of things I want to

start with a few numbers because these
numbers show the development of IoT. In

2016 we had 6.3 billions of devices out
there. This year we already had 8.3

billion of devices and in 2020 we will -
we are going to have 20.4 billion

connected devices out there. So the
numbers are from Gartner Institute from

January and I have one more slide with
more accurate data from June this year and

actually this slide shows that the
development is actually really growing.

17% more compared to the previous year.
And by 2021 global IoT spending is

expected to reach about 1.4 trillion
dollars. So maybe some you are asking

yourself: What is the internet of things?
Maybe some of you expected I'm only

talking about a smart home, because IoT is
often related to the smart home. And we're

having all the smart devices that we put
into our living rooms, but that's actually

not the main focus because it's more about
the connected everything. Which means

toys, sex toys, home automation,
lightbulbs, surveillance cameras,

thermostats, but also digital assistants
and wearables. So I wanna start with a few

examples of classical internet of things
stuff which is actually a smart coffee

maker. That's ... so what is smart about a
coffee maker? It only gets ... it doesn't

get smart when you regulate your coffee
machine by app because what's smart about

that? You can just press the button on the
machine. But when you connect your coffee

machine with fitness and sleeping trackers
the coffee machine already knows when you

get up if you need a strong or soft coffee
in the morning and so that might sound

comfortable for some of us, but it also
has a lot of dangers inside, because you

never know that the data is really safe
and only stays with you. Maybe your

insurance company get them one day. So you
all know Cars -probably-, the film, and

this is McLightning Queen and it got a toy
nowadays which is sold for 350 dollars -

no sorry, euros - and this car is able to
sit next to you and watch the film with

you and is going to comment the film.
laughter

And it is - this sounds very funny - but -
and it is funny - but it means that it has

a microphone integrated which is waiting
for the terms in the film on the right

stories and then it makes comments. And
the microphone can only be turned off by

app so there's no physical button to turn
it off and actually another thing is when

you first ... when you actually got this
present for Christmas, which is a really

expensive present with 350 euros, it's
actually first updating for more than

35min before you can even use it. The next
example - you're already laughing - is

internet of ... I call it internet of shit
because you can't say anything else to

that example. It's a toilet IoT sensor
which is actually a smart, small little

box which is put into the toilet. And this
box has sensors. It's an Intel box but I

don't know and this box has sensors and
these sensors help analyzing the stool.

And this data that is collected is going
to send into the cloud. And actually this

could be very useful for people who are
having chronical diseases like Colitis

Ulcerosa or other chronical diseases with
the digestion stuff but it is mainly

designed for healthy people who want to
make better nutrition and reduce their

stress levels with the stool analysis. And
maybe it sounds good at the beginning but

this data that is collected could also be
used for other things in the future. So

it's a perfect example for internet of
shit. But there is another internet of

shit which is a twitter account that
collects all these funny little stories.

It's not from me, so I'm not behind that.
I tried to reach the person but I never

got a replay so I can't tell you anything
about them but they collect examples - if

you don't follow them now and are
interested in this topic you might do

after this talk - so after presenting a
couple of IoT examples with the good and a

bit of the bad sides I first wanna focus a
little bit on the problem because as I

said before you might now think that
everything is nice, comfortable, why

shouldn't we do that and stuff like that.
So the problem is that most of the vendors

that are doing IoT stuff now, that start
to connect everything, they are creating

manually operated devices without
connectivity for long years and they had a

lot of knowledge in terms of materials,
ergonomics, mechanical engineering but

almost zero in the fields of IT security.
Actually I don't say that without having

talked to vendors that have said exactly
that when I interviewed them. Like there

was a lightbulb vendor from Austria who is
a really big vendor who is making

lightbulbs for years and years and years
and actually they started to make

connected lightbulbs in 2015 and when they
did that they ... and I asked them "Oh how

big is your IT security department?" "1
Person". So they didn't actually have the

knowledge that IT security might be more
important when they connect - when they

start to connect things. And actually the
result is that these vendors are making

the same sort of security errors than the
high tech industry was dealing with 15

years ago. So the early 2000s called and
want their web security, their lack of

security back. So there are all kinds of
problems we already know from past:

hardcoded passwords, unsecure bluetooth
connections, permanent cloud server

connections and a lot of other stuff. So
we're going to have from all these 20

billion devices out there, there will be a
lot of unsecure devices and the problem is

that they are collecting to a botnet and
are starting DDoS attacks and we are going

to have internet outages. For those who
are not familiar with the terms I made a

really really really short explanation so
that you are also understanding what I am

talking about. A botnet is a network of
private computers infected with malicious

software and controlled as a group without
the owners knowledge. Like the example of

the refrigerator that was sending out spam
I told you about earlier. This

refrigerator sent out ... one refrigerator
was sending out 750.000 spam mails by the

way. So the botnet, that has a botnet
owner of course, because it's not only a

zombie botnet, and the botnet owner can
control this network of infected computers

by issuing commands to perform malicious
activities like DDoS attacks. So DDoS is a

distributed denial of Service attack and
actually that's an attempt to stop

legitimate users form accessing the data
normally available on a website. And this

actually can lead to completely shutdown
of a service. And we had this already so

I'm not talking about something in the far
future but we had this in 2016 and most

people already recognized it but it didn't
recognized why - their twitter accounts

did not work, they couldn't use Reddit, or
Spotify, or they couldn't pay with PayPal

at the moment. And behind that attack was
Mirai so several other major services were

offline because an infrastructure provider
was attacked by zombie IoT devices. And

this was one year ago and now one year
later Mirai botnet infections are still

widespread so not every zombie device is
already secured so there are still some

around and not so little and actually
there is a study saying that every

unsecured - no every botnet infection
that's there - every security hole thats

there is staying there for at least 7
years which means that all the unsecure

devices which are out now could get
infected and could stay infected for 7

years. So that's why it's very important
that we are going to do something really

quickly and not starting like in 2020. So
Mirai was supposed to continue in 2017 and

actually a lot of DDoS attacks similar
attacks like Mirai happened in 2017. This

as an example could unleash at any moment
which was in November one few days later

exactly this attack was unleashed, so it
happened. In 2017 we also had a huge

increase in DDoS attacks 91% increase from
Q1 and it's going to increase more. I have

to take a short sip, sorry.
Now we're coming back to examples. One

really good example is the university that
was attacked by it's own vending machines

and smart lightbulbs and 5000 other IoT
devices. This was very very difficult to

get fixed because they couldn't get the
university network down so they had to

find a really difficult solution to get it
back up. And actually how did they even

notice about it? Because the students
complained that the internet was going so

slow. Another example which has nothing to
do with DDoS attacks anymore but with IoT

sensors - actually - in a fishtank in an
American casino - north American casino

there were sensors measuring the
temperature of the aquarium and the

fishtank - that the fishes didn't die -
and these sensors were sending the data to

a PC of this casino and this PC was the
same - was using the same network than the

sensors so actually the cybercriminals
could access to this data of the casino

and were stealing them and sending them to
their own servers in Finland. And the

amount was about 10GB of data. Another
example which is actually one of my most -

I don't know why but it's the example I
personally like most of the whole examples

that are collected in 2017. So there was a
surveillance camera bought by a

netherlands woman. Actually she wanted to
surveil her dog when she was out at work

but what did this camera do? It did
surveil the dog when she was out at work,

but when she was at home the camera
followed her through the room and was

watching her all over the place. And it
had a microphone integrated and one day it

started to talk with her and it said "hola
señorita". And this woman was so

frightened that she actually started to
record that because she thought that

nobody will buy this story. All will think
I’m crazy but this camera actually did not

surveil the dog but was hacked and
surveiled her. And it was a very cheap

camera by the way. She bought it in a
supermarket but we don't know the name of

the vendor in this case. So coming for a
very cheap camera to a very hightech

camera the cameras you see here is one
that is actually build in a lot of

companies and there was a security hole
found by some Vienna security specialists

from SEC consult and actually they
demonstrated me how they could actually

hack into this camera and how they could
make it possible that this camera shows

pictures of an empty room in a bank so the
pictures from the empty room in the bank

were shown to me and in reality the bank
was robbed - ok, not in reality. But it

could have been robbed. So thats actually
sounding a little bit like a movie scene

and actually this camera which is sold as
a security camera is kind of useless when

it doesn't have security and it doesn't
really show the picture. And the problem

with this camera was hardcoded passwords.
And the hardcoded password got fixed after

so it was responsible disclosure process
and this camera is safe now. So I'm coming

to a different example now. And this now
finally explains why this toy is sitting

here. Before my talk everybody was telling
me "Ah, you brought your favorite toy, to

protect you during your talk." and I was
laughing "Oh no. No no no no, it one of

the most unsecure devices out there." But
before we come to this in special I'm

going to talk a little bit about connected
toys. So the Germany Stiftung Warentest

had made a study regarding connected toys.
The people were testing them and actually

all of their tested bears, robot dogs and
dolls were very very unsecure and some of

them were even critical and are extremely
critical and others were critical. And

actually what was the problem with the
toys and also with this? They were using -

they are using bluetooth connections. And
these bluetooth connections are not

secured by a password or a PIN code. So
every smartphone user close enough could

connect to the toy and listen to children
or ask questions or threaten them and

another problem are the data collecting
apps related to this stuff. So actually

this little unicorn has an app where you
can send the messages. So what does this

actually? It can play messages and you can
- as a child you can record messages and

send it to you mom or your dad. And when
you play messages you never - the heart

blinks. So actually there's a message
waiting for you now. And I'm not sure if

it's the same that I recorded earlier
before. Maybe now it is, maybe at the end

of the talk when I press the button again
it might not be. And so everybody can - so

this - err sorry - This device does have
an app where you can send the message to.

And it also has a children interface and
where you are using the children interface

you're seeing that there are ads
integrated. And in the children's

interface there were ads for porn and
ehm... ...other stuff, which are not

really in the best hands of a child. And
this is also what Stiftung Warentest has

actually - yeah has actually found out.
The data is also used to send to third

party companies and they put trackers to
control the online behavior of their

parents. This is also done with this
device. So the Stiftung Warentest advises

a not connectible dumb teddy might be the
smarter choice in the future. And before I

finally press this button - you're
probably curious now - but first I'm going

to talk a little bit about Cayla. You
probably have heard of Cayla as a very

unsecure doll. Actually it got forbidden
in Germany by law. It is judged as a

prohibited broadcasting station. And
parents who do not destroy it will be

actually fined. And I tried to buy Cayla
in Austria and didn't get the doll. So

actually it should be really off the
market in the German speaking area. And

actually that is also a result of a
campaign from Norway called Toyfail, which

is a Norwegian consumer organization who
are actually - this is Cayla. You can see

her now. Which is actually going to the
European Parliament to make them

understand how unsecure toys is doing a
lot of harm and how we should put more

security into toys. And I've brought a
short little video and I hope we can hear

the audio here as well. We will see.
No. You don't hear anything.

But this doesn't matter because they
have...

Sign Language Interpreter: subtitles
Barbara: subtitles.

Person (Video): There's not added any kind
of security. With simple steps I can talk

through the doll and listen to other
people.

Person through doll (Video): No one wants
others to speak directly through the doll.

Barbara: He's speaking now at the moment.
Doll: inaudible

Person: And you may think... [see video
subs] ... Cayla, can I trust you?

Doll: I don't know.
laughter

applause
Barbara: Yeah and we don't trust Cayla and

we also don't trust our little unicorn.
button clicking

laughter
crying baby in background

Barbara: Ok, somebody has hacked it.
laughter

Yes.
Unicorn Toy: Hello, Chaos Communication

Congress.
Barbara: Ok, that's what I recorded

earlier. But there is some time left.
Maybe, maybe... but you're all sitting too

far actually and nobody of you brought
your computer, so... but we will see, we

will try it later on. So but actually you
shouldn't trust this unicorn, because this

unicorn is from the company called
Cloudpets, which is a - no sorry It's a

toy called Cloudpet and the company is
Spiraltoys from the US. So this is

Cloudpet and there are cats and dogs and
unicorns and it's very ugly but it's a

unicorn. And actually now I'm already
talking a lot about this. Why I'm

explaining you now. There already was a
data breach with this toy so the

children's messages in Cloudpets data
actually was stolen and was public on the

internet. 2 million voice messages
recorded on the cuddly toys has been

discovered free on the internet. And
actually Spiraltoys say that there was no

data breach but the data was there, so...
Thats also why I brought this, it was

still very easily available and actually
as I said before the app for child the

interface shows porn ads, so I would not
recommend that for your child. Actually

there are already a lot of institutions
out there which are warning for connected

toys also the consumer group Which? which
actually did a study about this and other

like also the Furby connected they
analyzed, the German Stiftung Warentest,

the Austrian Verein für
Konsumenteninformation, the Norwegian

consumer council, and the FBI. The list is
to be continued. So consider if you really

need a connected toy for your child or
yourself because the next section is about

sex toys.
laughter

applause
squeaky horn

more laughter and applause
I am not... It's not necessary say a lot

about this example. It's actually a
connected vibrator that has a build-in

camera and this camera is very very very
unsafe. Also this toy is really expensive,

so you can't say "Eh, it's only the cheap
stuff that is so unsecure." Also the high-

tech stuff can be really unsecure. I mean
this vibrator costs 250 dollars so it's

very expensive and it has a build-in web-
connected endoscope and they found out

that it's massively insecure. The password
of this... And if you forgot to change it

it's a few more players than expected that
might be watching your newest video about

your private sex adventures. There was
another example actually in this - sorry

go back one more time to this example -
there's a very funny video on it on

youtube about it, maybe you wanna watch
it. I didn't bring it because I couldn't

reach the makers of it. So I'm going to
the next example which is about a case of

sex toy company that actually admits to
recording users remote sex sessions and it

called it a "minor bug". It was this love
sensor remote app you can see the icon

here and actually this is a vibrator and
an app and the vibrator controlling app

was recording all the sex sounds, all the
sounds you're making when you're using

this vibrator and stores them on the phone
without your knowledge. And the company

says that no information or data was sent
to the servers so this audio file exists

only temporarily and only your device. And
they already had an update so actually

this is not as funny as the other story
but still it's an example of how unsecure

sex stuff can be. So there are lot of lot
of more sex examples out there. One you

should actually definitely search for
after - please don't search for now, but

after this talk. You could google or
duckduckgo or whatever you use the terms

"blowjob injection". And please add
"security" because otherwise you will land

on other sites.
laughter

And this was a female security expert who
was doing this research about a device

which actually was supposed to your
girlfriend could make you a special

blowjob program, your special blowjob and
this could be hacked so somebody else's

blowjob might appear instead your own.
laughter

So there's also a story about a map of
buttplugs in Berlin that are unsecure.

Also if you're interested in that please
also search for that story. Because it's

funny to talk about this, but I also wanna
talk little bit about things that we could

actually do. And one of the projects in
this part is actually doing something

thats called the "internet of dongs
project - hacking sex toys for security

and privacy". And as you can see it's
supported by PornHub, which in this case

means that they get money from PornHub
that they can buy sex toys for their

research. So PornHub is sponsoring them.
Actually I did for talk to the guy who is

behind this project. He's called
Randomman. That's a render of him and this

is the website by the way. So he told me
he's currently - they're currently a team

of about 15-20 people out there that are
doing their security research in their own

spare time. And they are not getting any
money for it and they also don't want to

get any money but they are already looking
for more security experts that wanna join

the team and also they have also an
ethical codex and stuff like that and

actually one of the most important things
that he was telling me is that he doesn't

want that you should stay off connected
sex toys at all, but to find the security

holes that we are all able to use them if
we want without any fear. So yeah, you can

get in contact with him if you're
interested. Coming to a different section

now. You can see I'm switching from
security to security and privacy and now

I'm landed on the privacy section. This is
Google Home. And we all know that there is

also Amazon Echo and digital assistants
are also smart IoT devices and this is why

I wanna talk a very very short time about
them because I'm sure a lot of people got

those devices for Christmas. Actually
there was a big increase of digital

assistants in the last year int this
quarter 3 of 2016 there were only 900.000

of such devices sold and in the quarter 3
2017 we had more than 7.4 million of those

devices sold. So there's a huge increase
and we don't even have the numbers of the

Christmas time. Yeah you have seen it. so
why I wanna talk about it, because when

you put this kind of stuff in your home it
might be very comfortable at the beginning

because you don't have to look up the
weather information you can - you don't

have to read your emails you can make the
device read your own emails you can use

them to program your list of what you're
going to buy and stuff like that but

that's how they learn a lot about the
users habits and their personalties and

those devices will learn more and more
information about you and this information

does not stay in your own home it actually
is going to send to the servers of amazon

and google and I don't need to tell you
what amazon an google are doing with this

data. current at least currently they are
only collecting it but that's very

valuable and they turn around and use it
or sell it in various ways to monetize

that information in one of the future
days. So all digital assistants send the

voice controls that are made after "Ok,
Google" or "Alexa" to their servers and

the data will be saved there and it was
not possible for me to find out for how

long and at which servers. It's not in
their terms of conditions and I couldn't

find it anywhere. So also the German data
privacy delegate Andrea Voßhoff didn't

find this information. She criticized that
"It is not easy for users to understand

how, to what extent and where the
information collected is processed. Also,

it is not clear how long the data will be
stored." So if you still want those

devices in your home now there are at
least physical mute button with google

home and amazon echo and you can also
change the settings to control the data so

all the data that is collected is regulary
deleted from the servers but of course you

never know in how may backups it's
collected as well. So yes it's only

recording after this voice control but
both devices already got hacked and yeah I

didn't amazon echo got hacked in 2016 and
google mini got hacked in 2017 of course

both problems got fixed and when I say got
hacked it means that the devices in your

home were listening to the conversations
all the time. So I'm coming -

unfortunately the funny examples are over.
I'm coming to the part where I wanna speak

about what we can do against the lack of
security and lack of privacy with the

internet of things. So we are currently
having the status quo where we are having an

information asymmetry between the vendor
and the customer. Currently the

manufacturers do not need to provide a
sample information but(?) how security of

a device such as how long it will receive
security updates. so when we buy a device

we never know... oh is it going to be safe
or not. So what we need ... actually what

we need. I did write a couple of things -
I write down a couple of things here which

are partly stolen by the green MEP Jan
Philipp Albrecht from his program because

he's dealing a lot with that kind of
question what we can do with his work and

I'm also - I also was stealing some of
those suggestions from the Renderman from

the Internet of Dongs project, he also had
some helpful tips. And I also stole some

of the information from security experts I
talked in interviews all of the time

because we never talk only about the bad
things we always - we all want to get the

internet of things safer at the end. So
some of them suggested that we could need

an security star rating system similar to
the energy labeling. And when we talk

about security star ratings that could
mean that we use a label. When a device

gets security updates for free for the
next five years it gets the A++ label, if

it's no updates at all and it stays
unsecure it gets the baddest rating or

such things. Actually vendors should also
be forced to close security holes instead

of ignoring them. And they should provide
the security researchers with email

addresses where we can easily report
security flaws because sometimes the

hardest part of the game is to actually
find the right contact to send out the

information about what is unsecure and
what's not. What we also need is a

mandatory offline mode for electronical
devices so this device at least has a

button where you can turn it off. so it
doesn't listen to you permanently. And we

need that for all devices - all connected
devices. Also an airbag and seatbelt for

the digital age and we also have to talk
about product liability and a clear update

policy. so there are also good examples
that we are having now. Actually all what

I was talking about here is regulation.
Regulation that is not existing at the

moment. But there is some regulation that
is existing in the kind of data which is

the GDPR the General Data Protection
Regulation which is coming up in May 2018

and it has included some really really
really helpful things: privacy by design

and privacy by default. And more
possibilities for law enforcement. And

this is very very important because it
doesn't say that because we are going to

have a regulation about privacy by design
and privacy by default this is really done

by the vendors. Actually when is was
interviewing some of them they already

told me that it's not their plan to
integrate that in their products they are

going to wait until they are sued. They
say "Oh, we don't need it. why should we

do it worked now - nope." So that's why
the law enforcement comes into place and

maybe some of you know Max Schrems, he's
also speaking here in two days about

something else though and he a data
protection activist. And he says that

everything that goes will be done in this
phase we are now, but if vendors won't

observe the law we have to remind them to
do it. So this is how he looks like and he

says that with this new regulation we can,
as a customer, ask for compensation when

data breaches occur. We couldn't do that
so easily now but with this new regulation

it will get a lot of easier. And if 4
billion people sue a company and ask for

compensation that could be a bit expensive
at the end. So if you are not able to sue

anybody yourself, which is not cheap so
nobody - not everybody will secure

companies you can support organizations
that help you with that like the new

organization from Max Schrems called "None
of Your Business" maybe you have seen this

already, I'm not saying that you should
support especially (???) this

organization but his plan is to actually
do that stuff I explained earlier: sue

companies that are not abiding to the law.
So if you wanna visit the website they

currently collecting money. What else can
consumers do? That are no easy tips but we

can't do much except a few easy things.
Does this product really need an internet

connection? Is it possible to turn it off?
Is it still working after that? What do we

find about it on the internet? Can we
reach the vendor? Does the vendor reply

when I have a question? Do we get more
information? Sometimes also clicktivism

helps to stop vendors making stupid
decisions. Here is another example from

the vacuum robot cleaning machine Roomba
who wanted to sell the data that is

collected from the home from the vacuum
cleaner and actually there was a huge huge

huge shitstorm after he was announcing
that - the CEO that was announcing that.

And after the shitstrorm the CEO said "Ok,
no nono. We're not collecting. We're not

selling your data. No no." So sometimes
this helps as well and of course follow

the basics in IT-security please update
everything that has updates, separate

networks from IoT products and use safe
passwords, support open hardware, open

software, products where the data is
stored locally is always better than in

the cloud and if you're tech savvy enough
start - which I think you are here - start

building your own tools. Because you have
the control. And what can developers do?

Support privacy by design, security by
design, think about it from the beginning

because you can change it and take
responsibility. And IT security can also

do some stuff or continue to do some
stuff. Point the vendor to the problems,

make helping IT security stronger, keep
reporting the flaws, publish your

research, help develop standards, labels
and seat belts and support each others

work to a stronger voice about this. So
I'm coming to the end of my talk now and

to the topic back to the internet of
fails: How many must be killed in the

Internet of Deadly Things train wrecks?
This is actually an article I was reading

with a huge interest myself because it was
starting to deal with making comparisons

to the great age of railway construction
that was likewise riddled with decades of

disasters before the introduction of
effective signaling and failsafe breaks.

And it was also comparisoned with the
automotive industry where the mandatory

fitting of seatbelts designing the bodies
of cars to reduce injury to pedestrians,

airbag and measures to reduce air
pollution were not introduced not early

enough. So this guy was asked: Do we
really need to kill a few people first?

And he said: Unfortunately that will happen.
So he says: Safety and security standards

for the internet of things can't come soon
enough. I agree with that. With that we

need standards really soon. So I am at the
end of my talk and if we have some time

left I'm waiting for your questions,
ideas, and input now. Otherwise I will

thank you very much for your attention.

applause

Herald: Thank you Barbara. A very warm
applause.

So a small information: If you want to
exit the room please exit the room to your

left over there. So, questions?
I see one question from the Signal Angel.

Q: Hello, ok. The internet wants to know,
well those companies don't have any IoT

security whatsoever or basically none, so
what can we do to make them have more?

B: What we as who, as consumers?
Q: Yeah, basically.

B: Yeah, actually I would - what I said
was I would write them and ask for

standards. I would - I think it can be the
first step that we can write emails or

call them and say "Well, what kind of
security is build in this device, can you

tell me? Otherwise I won't buy your
product."

Herald: Thank you. Any other question? Ok,
in this case again: Thank you Barbara for

your nice talk.
applause

A very warm round of applause. Thanks.

34c3 outro

subtitles created by c3subtitles.de
in the year 2018. Join, and help us!