Internet of Things (IoT) Security Issues






A Fuller Understanding of the Internet of Things







Discerning Where the Internet of Things (IoT) Really Fits





Our Borders are Porous

No, I’m not talking physical borders here—I’m talking cyber borders. I’ve talked a number of times about the relative insecurity of Supervisory Control and Data Acquisition (SCADA) systems. My biggest personal concern is how leaks in these systems can affect people with special needs. At a minimum, implanted devices used by people today are open to hacking. However, there are some reports that say that hackers could eventually become murderers. I wrote Accessibility for Everybody: Understanding the Section 508 Accessibility Requirements with the idea that implanted devices and other aids should help people, not hurt them.

However, other sorts of devices are leaky. Just about any hacker could attack our water supply, power grid, or any other utility. A hacker could turn off your car engine by remote control, lock you into the car, and then do whatever nefarious deed seemed pleasant at the time. These posts aren’t meant to scare you as much as to inform you that the borders of your devices are wide open to attack in many cases. Yet, despite a huge number of newspaper articles, radio talk shows, government inquiries, and odd assorted other do nothing activities, surprisingly little has been done to secure anything.

It probably won’t surprise you to know that the latest casualty, in a long list of problematic devices, is the gas pump. Yep, your gas pump can turn against you. I hadn’t really thought about a gas pump as being anything particularly worthwhile to hack. Yes, you could possibly turn on the pump and get free gas or deny someone else their gas, but it really didn’t strike me as something that hackers would invest time in learning about. Actually, it turns out that gas pumps are connected to all sorts of monitors and messing with the pump can cause those monitors to go off. It doesn’t seem like alarms are anything to worry about either, but think about someone intent on disrupting the emergency services network in a city so that they can attack in some other way. While everyone is distracted with the gas pump spills that haven’t actually happened, someone could do something that would cause the city to go into overload because emergency services are already overwhelmed.

The thing that gets me about a lot of these deficiencies is that they aren’t caused by systems that are secured, but someone has manged to get into anyway. They’re caused by systems that have no security at all. That’s right—someone connected those gas pumps to the Internet so they could monitor them remotely and didn’t add any security at all. Someone who knows the right information can just walk right in and cause all sorts of mischief.

From direct attacks on our infrastructure, to feints used for distraction, to personal attacks, SCADA systems will let us down at some point. I’m surprised that we haven’t had a major issue so far. Perhaps someone is out there right now planning just the right sort of attack that’s designed to cause a maximum of damage. Until we make security a priority, these open systems will continue to pose a serious risk to everyone, whether you have special needs or not. Let me know your thoughts about insecure SCADA systems at


Death by Connected Device

The title for this post is dramatic on purpose. In my book, Accessibility for Everybody: Understanding the Section 508 Accessibility Requirements, I describe all sorts of useful technologies for making the lives of those with special needs better. In fact, this particular book has received so much attention that I’ve expanded its coverage significantly by devoting forty (and counting) posts to it. The fact is that implanted devices will continue to be a part of our lives and their use will only increase, which is why articles, such as Cyber crime: First online murder will happen by end of year, warns US firm, have me more than a little concerned. The fact is that we’re all in line for a major wake-up call at some point if something isn’t done to secure the Supervisory Control and Data Acquisition (SCADA) systems we all rely on to connect devices to the Internet today. The hardware, software, and other functionality required to make everything happen is encapsulated in a technology known as the Internet of Things (IoT). Soon, everyone will know about IoT, but few people will know or understand the underlying SCADA systems that goes with it.

The part of the articles that I’ve read so far that intrigues me most is that politicians and others in the know have been disconnecting themselves from the Internet. Note the mention of Dick Chaney disconnecting himself from the wireless part of his implanted device in the aforementioned article. If the devices and their connections were secured, our former vice president wouldn’t be quite so worried. Unfortunately, the rest of us probably won’t be quite so lucky unless we refuse to have the devices implanted at all (which would seem to be a self-defeating stance to take). I’ve actually been discussing this issue for quite some time now. The latest significant treatment of the topic appears in my An Update On Special Needs Device Hacking post. I’ve also broached the topic in Determining When Technology Hurts. The point is that this issue isn’t new, but we certainly haven’t done anything about it.

Will it actually require a slew of front page news stories depicting people assassinated through their implanted devices for someone to get the idea that there are really awful people out there who would like to kill someone (anyone) with impunity? It seems to be the case. So, now we’re seeing stories about the event actually taking place sometime soon. Even if we don’t see someone killed, I can see a situation where people have money extorted from them by hackers who have gained illegal access to their implanted devices.

I’m all for the advancement of technology that has significant potential to help people. I’ve written more than a few posts on the topic. Helping people to walk, see, hear, touch, and have generally better lives is a great idea in my book. However, the time is long past for securing these devices in a meaningful way so that only those who really need access will actually get it. Just why there hasn’t been any legislation regarding this need is beyond me. Our politicians are obviously aware of the problem and have done the work required to protect themselves, but they don’t see to be in much of a hurry to protect their constituents.

Given what I’ve seen in the past, I’m sure the medical community won’t be in any hurry to secure these devices because security has been a legislated requirement in the past. With this in mind, what do you feel needs to happen with these devices to make them a better deal for those who need them? Let me know your thoughts about the lack of security for implanted devices and devices connected to IoT in general at