The Internet of (Crap) Things

The kitchen used to be a safe space in your house - not counting all the sharp knives, burning hot surfaces, possible electrical shock from a bad combination of water and electricity, and the possibility of dropping that surprisingly heavy mixer on your foot - but NOW it's a cybersecurity Thunderdome!

OK, maybe I've gone a bit overboard, but the kitchen is now an additional battlefield in the cybersecurity fight. So is the utility room, the laundry room, even the bathroom and the patio. Online access has been coming to nearly every major appliance in our homes: ovens, refrigerators, televisions, radios, washing machines, driers, water heaters, furnaces, and even toothbrushes. For the love of all that is good, WHY? Do you need your washing machine to ping you while you're at work that the towels are clean? Should you have the ability to preheat the oven as you're driving home from the grocery store? (Let's just pause and consider the wildly dangerous safety issue that represents shall we?) Will monthly OS updates make your refrigerator stay colder better?

It seems to me that many online appliances - devices collectively part of what is referred to as the Internet of Things (IOT) - are a solution in search of a problem. And that leads to, well, more problems. In this case problems with both privacy and cybersecurity as tradeoffs for, um, having an app that automatically ties your shoes? Seems like kind of a crappy tradeoff to me.

Just Because You Can Doesn't Mean You Should

The risk/reward question for online appliances is one we all need to answer for ourselves as we each have our own risk tolerances. But in order to make such a decision we need to be informed of the tradeoffs and consequences of these choices.

What Problem Does Online Access Solve For This Appliance?

Is getting your refrigerator online actually making it better at doing refrigerator related things? How does getting your pellet smoker online help you smoke foods?

Once you've figured out what problem going online solves, I urge you to rank it:

• Need This To Function - If the appliance doesn't work properly without Internet access then you should have it (if there isn't another system that already provides this capability)
• Nice To Have Feature - If you like the feature but don't explicitly need it, then this is a very gray area that will really depend on how important that feature is to you
• The Feature Provides No Significant Value - This is the other easy category: don't allow Internet access from the appliance. Turn off it's connectivity and use it as a "dumb" appliance. Woot!
• Does Some Other System Already Provide This Feature Adequately? - Then, again, an easy answer of not connecting this appliance to the Internet.

What Is the Support Plan For This Device?

You expect a water heater to last 5-10 years. You expect a stove to last 10-20 years. You expect a TV to last 5-20 years, same with an audio receiver. You expect a cellphone to last 2-4 years. Laptops are ~3-5 years. Those are some significant differences in lifetimes.

However, we see a tendency (even with cell phones and laptops) to use them beyond their software lifecycle support. If companies won't support patching cell-phones past 2 or 3 years, what do we expect them to do for the software on a stove?

If you can't find a schedule or calendar for how long the manufacturer is going to support your device with security updates then you shouldn't even consider connecting it to a network. Security patches are critical to the determination as to how long a "smart" device is useful in your environment - unless you somehow believe that this one manufacturer has perfected writing all their code from scratch with zero errors or vulnerabilities (a feat which has never in the recorded history of software been achieved) and you can safely use it indefinitely without worry.

This is why I am a proponent of buying "dumb" TVs and augmenting them with external streaming devices, like Roku, Apple TV, or the like. A $100 Roku is much less expensive to replace every 4 years than a $1200 TV, is it not? Even if you're buying $400 TV's, that's a lot of extra e-waste compared to Rokus over the lifetime of the TV.

What Can the Device Tell Someone?

Let's pretend that you're the type of person who makes sure lights go on inside your house in the evening regardless of if you're home. You do this to deter burglaries, since a house that looks like people are at home is thought to deter criminals who will go look for a house that seems empty instead. But what if your smart thermostat is set to an "away" setting because you're not there, and those same burglars have that information? Now all you've done is make it easier for them to see what they want to take without neighbors being any the wiser.

Think that's not a good example? OK, let's change it up. Let's say your Ring credentials were lost and criminals now have access to see your camera feeds. What if your TV has a microphone on it, can attackers listen in on your conversations in the living room? Or because they hacked the website of your garage door opener company they can now track when you head out to work and come back later in the day?

The point is that many of these appliances know more about you then you care to realize. The risk about what can be done with that information is difficult to quantify, and the risk you're willing to take on is an individual choice for you, your family, and anyone likely to be in your household for any extended period of time.

I don't say any of that to cause paranoia, but to just point out the considerations that most of us just gloss over when we decide to connect the new furnace to the Internet.

Making Smart Decisions About IoT Devices

It is extremely likely that appliances you purchase going forward will have online capabilities. In many cases the only way to avoid this in things like major kitchen and utility room appliances will be to choose an off-brand or the cheapest option in the line of products. Those decisions are perhaps better guided by Consumer Reports than by me. But if you're considering a product that has built-in WiFi or an Ethernet port, here are my recommendations for making wise choices:

1. The longer you intend to keep the device the less you want it to be Internet enabled. Think about your 5 year old laptop, it seems really slow by today's standards, doesn't it? Does it still have enough memory (RAM)? Now pretend that's your refrigerator you're talking about. Along with that is the support lifetime we already talked about.
2. Prefer devices that do not REQUIRE you to enable Internet access. If your stove comes with Internet access features just make sure you don't have to connect it to the Internet in order to actually cook dinner.
3. Prefer devices that have an "off" switch for their wireless interfaces. Most devices with built-in wireless access and that don't have a full keyboard & monitor interface broadcast a "startup" WiFi or Bluetooth network for initial configuration. If you can't turn that off any miscreant can go ahead and try to take control of that individual device on your behalf. While that won't give then access to your home network it could allow them to set your oven to the self-clean cycle while you were trying to proof a loaf of bread, or turn your furnace down to 50 degrees on a cold winter's night. So look for the "disable WiFi" or similar feature before buying.
4. Prefer name brand products. Sorry off brands, but as a general axiom you're not nearly as likely to keep up with security updates and good security practices as the name brands are - after all, they have to defend their brand's value in accordance with how valuable that brand is. That means choosing a Roku over an ACME android streaming box, and picking a Samsung washing machine over the "store brand" one.
5. Read the manual before purchase. Sounds boring, sure, but if you can't find the answers to these questions before you buy it, well, let's just say returning a water heater after it has been installed is devilishly tricky. If you're shopping with a live salesperson, ask them to share the manual. If you're shopping online then download the manual and read it - at least skim it for these answers.

I used the word "prefer" for several of these intentionally. Because there's always an exception to each of these generalizations. There will be the niche product that's superior to the name brand. There's the fact that you just can't get the feature you need without mandatory online access. That's just how it goes, but the more we make buying patterns that follow these requirements the better chance manufacturers notice and adjust accordingly.

Advanced Options For Advanced Home Networks

If you're someone who likes having firewall segmented networks at home you can always choose to segment your "smart" appliances from your "internal" network. (and if that sentence did nothing but confuse you that's ok, it just means this section isn't necessarily for you and there's no harm in that) If you do choose to segment your IoT devices and appliances you may want to make sure the devices you use to control those are similarly segmented - use that older (though still up to date) phone or laptop on the "appliance network" to interact with the appliances, but don't let it straddle multiple networks.

Corporate Networks Are Not Immune

Please don't kid yourself, corporate networks aren't safe from this scourge either. HVAC systems are notorious for being ripe for attack. Programmable Logic Controllers, and all sorts of embedded controllers (literally, think Raspberry Pi devices but built-in) exist in systems meant to last 10-20 years before replacement that aren't really "computers" in the desktop/laptop/server sense but require being part of the network none-the-less. And let's not forget the smart-TV in the conference room and the smart-fridge in the break room and the smart speaker in the lobby...

Overall, consider the risks and rewards to choosing Internet connected devices. We're not yet at the point where we have no choice in the matter, and you can still provide control over your own destiny with regard to these systems, but only if you keep your wits about you and recognize what you're signing yourself up for.