Actions
Forum Thread Details
  • Replies 24 replies
  • Subscribers 396 subscribers
  • Views 2043 views
  • Users 0 members are here
Related

Internet of Things... Security

gadget.iom

I have recently purchased an ENC28J60 module and started experimenting with ethernet connectivity on my various Arduino boards. As to be expected with the Arduino community there are a good number of resources, on here and the wider web, for support in getting a basic project up and running.

 

I have mainly been experimenting with sending GET requests to a web server and acting upon the responses, and while there is a great deal of guidance about how to achieve this, none of them seem to contemplate the aspect of secure communications. While this may not be so much of an issue on a private LAN, the very nature of 'Internet of Things' would suggest that this communication will take place over a third party network at some point.

 

I have spent some time investigating the process of implementing some basic encryption on these communications and have found the availability of such information to be very weak. Methods I have looked into so far are RC4 and XOR, and some of the examples actually work on the local microcontroller, but fail to encrypt/decrypt successfully in the PHP implementations at the server.

 

Have you implemented any kind of encryption in your microcontroller projects? How successful were they? Do you think there are enough resources for data encryption? Or is there something obvious that I've missed? image

 

Would love to hear your thoughts and opinions.

Paul

  • in reply to markvenn

    there seems to be a general lack of knowledge in the general population how these things work

    You'd be surprised at the assumptions non-technical people make.

     

    While we understand some of the process'es involved, they don't and wouldn't consider that the speech is digitised.

     

    It is worrying that the manufacturer would even contemplate the ability to have the information sent out, and there must have been some motive behind it, but the real issue here is why are these devices subject to inspection by a consumer agency ...we have them tested for electrical safety ...so what about consumer privacy.

     

    Mark

  • in reply to mcb1

    Ill bet there is some small print in the manual that gets them off that hook and squarely back with the consumer, some have a web cam in addition to the microphone

     

    So disclaimer like the following image

     

    "By Turning on the TV you agree to us recording everything it hears and and sees and using the streamed content for what ever purpose we see fit in order to improve our ratings and profit and while were at it, hopefully remote operating your TV based on what we think you said or gestured. If you disagree with this policy then please don't turn on your TV"

    In order to provide better service to our consumers, this recorded content may be used at any time as "Training Material"  image for potential support engineers or group research purposes. We will not share your personal details with the recipients of this live feed in order to protect your privacy and anonymity

     

    probably in like 4 point at the bottom of the page in amongst a bunch of other illegible stuff so your most lightly to miss it if you even bother to read the manual.

  • in reply to Robert Peter Oakes

    Like this I guess:

    "Samsung may collect and your device may capture voice commands and associated texts so that we can provide you with Voice Recognition features and evaluate and improve the features. Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party through your use of Voice Recognition."

    source: SmartTV | Samsung

     

    Don't tell your TV any secrets. image

  • in reply to Robert Peter Oakes

    Yes exactly but probably not quite as easily understood or suitably vague so it gets away with it with out mentioning the real crux of the matter.