The Internet of Things (IoT) should be called the idiotic attempt to connect every mundane device to the Internet whether there’s a good reason or not. I admit that my more honest version is a mouthful but I believe it would remind people about what they’re actually buying and that could avoid fiasco like this:
Since Christmas day of last year and at least until the first week of January, Spiral Toys left customer data of its CloudPets brand on a database that wasn’t behind a firewall or password-protected. The MongoDB was easy to find using Shodan, a search engine makes it easy to find unprotected websites and servers, according to several security researchers who found and inspected the data.
The exposed data included more than 800,000 emails and passwords, which are secured with the strong, and thus supposedly harder to crack, hashing function bcrypt. Unfortunately, however, a large number of these passwords were so weak that it’s possible to crack them, according to Troy Hunt, a security researcher who maintains Have I Been Pwned and has analyzed the CloudPets data.
When you buy something you should ask yourself what the benefits and costs are. People often make the mistake of thinking that the cost is purely the amount you have to pay at the store. But there are always other hidden costs. In the case of these IoT stuffed animals one of the costs is brining a surveillance apparatus into your home. Sure, most people probably aren’t too worried about toy manufacturers having a bug in their home. But another cost is the risk of the remotely accessible surveillance device being accessed by an unauthorized party, which is what happened here.
The sordid history of security failures that plagues the IoT market should be considered whenever you’re buying an IoT product.
Having spent a ton of time dealing with IoT in general. I can honestly say there are very few use cases which would compel me to buy an IoT device. It has to provide enough utility. The company needs to be one that is proficient in tech, and provide security updates. Examples of companies that do IoT are few and far between. Nest is a good one.
Many appliance companies are throwing smart into devices that don’t really need them. “Smart dryer, smart fridge etc”. They aren’t going to spend the time and money needed to do it right. They certainly aren’t going to provide security updates for their devices.