Say Cheese: a snapshot of the massive DDoS attacks coming from IoT cameras
I&#x27;ve been warning about this kind of thing for <i>years</i> and years.  Both professionally and in my personal life.  On forums and anywhere people will listen...<p><i>IoT is a security disaster</i><p>I hate to suggest things like this but we may need <i>legal</i> remedies to solve the problem before it becomes an Internet Zombie Armageddon (IZA).  It&#x27;s <i>that</i> bad.<p>There&#x27;s going to be <i>tens of billions</i> of IoT devices installed at businesses and homes in just a few short years.  If they&#x27;re not receiving regular, timely security updates the Internet as we know it may just plain collapse from the sheer weight of all the zombies.<p>I propose a mandatory &quot;nutrition label&quot; of sorts for IoT device packaging.  Something like this:<p><pre><code>    * Updates itself regularly
    * Conforms to NIST security standards
    * Public penetration test results: https:&#x2F;&#x2F;ptr.iot.nist.gov&#x2F;A2L7P9D23345
    * Shares data with 3rd party: No
    * Administration by vendor: No
    * Requires Internet connection to administer: No
    * Requires 3rd party service to function: No
    * Notifies of intrusion: Yes
    * Logs all access: Yes
    * Encrypts all network traffic: Yes
</code></pre>
Something like a publicly-posted penetration test would be incredibly valuable.  Especially if it was performed after each update of the device and at regular intervals.  Even if it was an automated test (which in theory could be &#x27;gamed&#x27;) it would still be better than what we have now which is <i>nothing</i>!