Its even scarier when someone takes one of your IoT devices and intends to harm you. Like making your fridge's ice maker flood your house. They talked about this at Defcon 24.

I'm really having trouble finding a use case for connecting some of this stuff, especially one that merits the risk.

It's because advertisers have armies of psychologists and mountains of data they can use to pull your ear and put it right up against a loudspeaker telling you to purchase stupid stuff.

It's an arms race, and we measly individual consumers with real life concerns that don't center around defending our psyche from nonstop sensory ambush stand a very poor chance.

One word: convenience

I don't know what is convenient about a connected dishwasher. You still have to load the thing. Is pushing a physical start button that hard?

But it will tell you when it is done, same for a connected washer/dryer. Or a connected refrigerator that tells you when the filters are low or when you need to buy more eggs.

I think it is silly. You think it is silly, but people will buy this crap. They think apps will solve their problems.

They said we'd buy 3DTVs and such too, we didn't. The age of obsessing over appliance technology is over. They meet our basic needs and until they can save us massive amounts of time with more improvement the minimalist trend will continue and these will primarily be bought as designer item.

People with money to spend are choosing design, real estate (location over structure), experiences and food.

Yeah, but a lot of that stuff is already doable. It's just not telling you remotely. For instance, the filter light is on when you walk by the refrigerator or the dishwasher beeps and shows an indicator when it's done.

It's really more than sufficient to me. In fact, with everything else I have going on, I don't need my refrigerator texting me whenever it thinks it deserves my attention. That would actually be inconvenient.

Then, there's this hidden cost of the purported "convenience". More stuff updating, hacked etc. And, with the thousand other devices, now I have to spend time configuring what I want to manage, etc.

Reminds me of something I read years ago about the hidden costs of some tech. In one anecdote, subway riders were excited when A/C was installed on the train. Now, they could ride in comfort. What they didn't realize was the A/C exhaust heated the platform another 10 degrees or so, and they were actually less comfortable while waiting.

Oh great, so my dishwasher can flood my kitchen and my network. Woohoo!

Whatever. What's the worst that could happen? My dishwasher opening and spraying pressurized water at me?

In all seriousness, it could be a good niche market "not internet capable".

With an internet connected thermostat, someone could turn off your heat while you are away during the winter, causing your pipes to burst and flooding your home.

Alternatively, in the summertime they could crank up your heat and potentially kill any pets you have at home.

To give in, what about blowing up? If some dishwashers do this without tampering, imagine what a dedicated attacker could do.

http://www.recode.net/2016/9/29/13099092/samsung-exploding-r...

Water damage could run to hundreds of thousands of dollars in a few hours.

I think that there has been a report of an IOT running machine being hacked and the settings suddenly being changed to max speed - causing the user to be thrown off the back of it.

And because these devices are proprietary, there is no way to know. None of this stuff is going to be in my house any time soon.

There was a talk at DEF CON where they ransomwared a thermostat. Example, it could turn the temp in your house up to 105F and demand 1 BTC from you to work normal again.

I'm quite interested in what will happen when a significant proportion of people have internet-connected thermostats, and malware of some kind makes them all turn the heating to full power at the same time. I think it would be interesting to see what happens to utility distribution grids in that case.

Your machine can go in flames and burn your house: https://www.youtube.com/watch?v=dq6T5BojXc8

Your dishwasher potentially flooding your house doesn't sound bad enough to you?

What if you have wood floors? What if water shorted electrical devices? All of this could cost you thousands in repairs.

My main concern is these devices causing bodily harm. The dishwasher spraying hot water at me is pretty scary. A flooded house isn't nearly as bad as being disfigured.

  My main concern is these devices causing bodily harm

That's a reasonable, genuine concern, and one that should require physical interlocks (not just software code) to guard against.

That's a good situation for mandatory safety codes (such as the FDA requirements for 2 physical interlocks on microwaves [1]).

[1] http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRS...

What about food poisoning when I make your refridgerator turn off?

A flooded house is effectively extorting you with threat of bodily harm, because it costs money to dry it, and if you don't dry it promptly then mold will grow, which will cause health problems.

What I find even scarier is that, with computers and mobile devices, at least someone might notice when they're running slower than usual or consuming more data than usual. Most people have at least heard of computer viruses, and antivirus vendors have been trying pretty hard to get their crap on Android phones as well.

But would you notice if your thermostat was running a little slower than usual? Would it even occur to anyone that their dishwasher might have caught a virus? These things could participate in DDoS attacks all year long and nobody would suspect a thing. And even if someone did, fixing them would be much more difficult than taking your laptop to the nearest Best Buy (or even impossible, thanks to DRM).

I can also imagine that the microchips and their connected components wear out faster because they are under high load and therefore become hotter than usual. So after a few months your fridge is mysteriously dead just because of malware and you won't even know about it.

Imagine an army of fridge-hosted bitcoin miners…it'd be extraordinarily inefficient, but the bot-herders wouldn't care about the electricity bill.

Are there consumer routers (that are relatively easy to use) that can alert you or shut down a device, when all of a sudden your thermostat is making tons of network requests?

There are routers that can control how much data a given downstream device can transfer in a given time, shut them down entirely during certain times of day, etc.

But then I'd guess the crooks will just compromise the router itself.

And the average IOT user is unlikely to understand the security implications and correctly configure the router.

We first need consumer routers which are not themselves that device on a regular basis before we can think of detecting misbehavior in other devices.

Just last week i heard a talk at a conference about this very topic because many of these smart IoT devices have horrible software and shoddy security practices and are basically never checked by their owners, while having quite powerful socs nowadays.

The IoTification is fast approaching and I believe that only OpenBSD can save us now. Well, one can wish anyway... for a safe and open source future.

How does OpenBSD save us from poorly written software?

>safe

In 99% of cases these devices are exploited using vulnerabilities in the software or configuration added by the vendor (such as telnet access with root:root), not bugs in Linux.

>open source

How exactly would a permissively licensed kernel get vendors to disclose the source code?

Yeah, and these things will continue to proliferate. Probably near hopeless to expect all of these manufacturers to stem this.

But, it seems that ISPs could play a more pivotal role in combating this, and that they'd have financial incentive to do so.

For instance, what if we built more security/detection into routers/gateways (especially those that ISPs push)?

What if we combined this with mandates for ISPs to better monitor their traffic and established minimum standards for doing so?

Creating a framework where my ISP is legally required to perform deep packet inspection on my traffic seems like the wrong way to handle this for a whole pile of reasons.

What financial incentive?

I won't be surprised if we see, before the end of the year, news along the lines of "Toaster catches virus, leaves owner with $5K data bill." Why bear any costs when you can pass them on to your captive customers?

>What financial incentive?

If the network starts to serve an increasingly disproportionate amount of illegitimate traffic for n customers, then the ISP will have to increase throughput (and costs) to continue serving n customers.

It's tempting to argue that they could just pass the extra costs on to customers, but that obviously makes them less competitive, especially vs an ISP that better manages costs.

Many ISPs have basically no real competition. Don't like your cable company? Your alternative is <5Mbps DSL with a tiny amount of upload, high-latency and low data caps on satellite, and if you're lucky, a wireless connection that's even worse than DSL.

Maybe in some places. But, that says they could raise prices now. And, to the extent that this is true (or not), they are still better off with reduced costs.

Make the manufacturers of these faulty devices liable for the damages.

aren't IoT connections throttled by default?

Throttled by what?

Most home/consumer routers lack the capability to throttle a specific device, and most consumers wouldn't think to configure this if the capability was there.

There's a good argument to say that they should be throttled by their own software, but the basic premise of the issue is that IoT software is badly designed, badly programmed, and badly maintained, so I wouldn't hold out much hope of throttling in the device itself.