Coming Soon to a Refrigerator Near You

Bruce Schneier points out that the Internet of Things may well turn out to be the Botnet of Things.  Hackers have started to target routers and modems, which are, it turns out, easier to hack than home computers.  Routers use cheap, generic chips, and the manufacturers who make the actual router tend to use off-the-shelf software, maybe with a few proprietary tweaks.

The problem with this process is that no one entity has any incentive, expertise, or even ability to patch the software once it’s shipped. The chip manufacturer is busy shipping the next version of the chip, and the ODM is busy upgrading its product to work with this next chip. Maintaining the older chips and products just isn’t a priority.

And the software is old, even when the device is new. For example, one survey of common home routers found that the software components were four to five years older than the device. The minimum age of the Linux operating system was four years. The minimum age of the Samba file system software: six years. They may have had all the security patches applied, but most likely not. No one has that job . . . 

Even when a patch is possible, it’s rarely applied. Users usually have to manually download and install relevant patches. But since users never get alerted about security updates, and don’t have the expertise to manually administer these devices, it doesn’t happen. Sometimes the ISPs have the ability to remotely patch routers and modems, but this is also rare.

The result is hundreds of millions of devices that have been sitting on the Internet, unpatched and insecure, for the last five to ten years.

So as our refrigerators, cars, thermostats, home security systems, stoves, pets, televisions, game consoles, and entertainment systems are connected to the Internet, they (and we) become less secure.

My novel Deep State featured a variation on this threat.  Let’s hope it stays fiction.