How Blockchain Can Protect IoT Devices

The world is full of connected devices — and more are coming. In 2017, there were an estimated 8.4 billion internet-enabled thermostats, cameras, streetlights, and other electronics. By 2020 that number could exceed 20 billion, and by 2030 there could be 500 billion or more.

Because they’ll all be online all the time, each of those devices — whether a voice-recognition personal assistant or a pay-by-phone parking meter or a temperature sensor deep in an industrial robot — will be vulnerable to a cyberattack and could even be part of one.

Today, many “smart” internet-connected devices are made by large companies with well-known brand names, like Google, Apple, Microsoft, and Samsung, which have both the technological systems and the marketing incentive to fix any security problems quickly. But that’s not the case in the increasingly crowded world of smaller internet-enabled devices, like light bulbs, doorbells, and even packages shipped by UPS. Those devices, and their digital “brains,” are typically made by unknown companies, many in developing countries, without the funds or ability — or the brand-recognition need — to incorporate strong security features.

Insecure “internet of things” devices have already contributed to major cyber-disasters, such as the October 2016 cyber attack on internet routing company Dyn that took down more than 80 popular websites and stalled internet traffic across the US. The solution to this problem, in my view as a scholar of “internet of things” technology, blockchain systems and cybersecurity, could be a new way of tracking and distributing security software updates using blockchains.

Making Security a Priority

Today’s big technology companies work hard to keep users safe, but they have set themselves a daunting task: Thousands of complex software packages running on systems all over the world will invariably have errors that make them vulnerable to hackers. They also have teams of researchers and security analysts who try to identify and fix flaws before they cause problems.

When those teams find out about vulnerabilities (whether from their own or others’ work, or from users’ reports of malicious activity), they are well positioned to program updates, and to send them out to users. These companies’ computers, phones, and even many software programs connect periodically to their manufacturers’ sites to check for updates, and can download and even install them automatically.

Beyond the staffing needed to track problems and create fixes, that effort requires enormous investment. It requires software to respond to the automated inquiries, storage space for new versions of software, and network bandwidth to send it all out to millions of users quickly. That’s how people’s iPhones, PlayStations, and copies of Microsoft Word all stay fairly seamlessly up to date with security fixes.

None of that is happening with the manufacturers of the next generation of internet devices. Take, for example, Hangzhou Xiongmai Technology, based near Shanghai, China. Xiongmai makes internet-connected cameras and accessories under its brand and sells parts to other vendors.

Many of its products — and those of many other similar companies — contained administrative passwords that were set in the factory and were difficult or impossible to change. That left the door open for hackers to connect to Xiongmai-made devices, enter the preset password, take control of webcams or other devices, and generate enormous amounts of malicious internet traffic.

When the problem — and its global scope — became clear, there was little Xiongmai and other manufacturers could do to update their devices. The ability to prevent future cyber attacks like that depends on creating a way these companies can quickly, easily, and cheaply issue software updates to customers when flaws are discovered.

A Potential Answer

Put simply, a blockchain is a transaction-recording computer database that’s stored in many different places at once. In a sense, it’s like a public bulletin board where people can post notices of transactions. Each post must be accompanied by a digital signature, and can never be changed or deleted.

I’m not the only person suggesting using blockchain systems to improve internet-connected devices’ security. In January 2017, a group including US networking giant Cisco, German engineering firm Bosch, Bank of New York Mellon, Chinese electronics maker Foxconn, Dutch cybersecurity company Gemalto, and a number of blockchain startup companies formed to develop just such a system.

It would be available for device makers to use in place of creating their own software update infrastructure the way the tech giants have. These smaller companies would have to program their products to check in with a blockchain system periodically to see if there was new software. Then they would securely upload their updates as they developed them. Each device would have a strong cryptographic identity, to ensure the manufacturer is communicating with the right device. As a result, device makers and their customers would know the equipment would efficiently keep its security up to date.

These sorts of systems would have to be easy to program into small devices with limited memory space and processing power. They would need standard ways to communicate and authenticate updates, to tell official messages from hackers’ efforts. Existing blockchains, including Bitcoin SPV and Ethereum Light Client Protocol, look promising. And blockchain innovators will continue to find better ways, making it even easier for billions of “internet of things” devices to check in and update their security automatically.

The Importance of External Pressure

It will not be enough to develop blockchain-based systems that are capable of protecting “internet of things” devices. If the devices’ manufacturers don’t actually use those systems, everyone’s cybersecurity will still be at risk. Companies that make cheap devices with small profit margins, so they won’t add these layers of protection without help and support from the outside. They’ll need technological assistance and pressure from government regulations and consumer expectations to make the shift from their current practices.

If it’s clear their products won’t sell unless they’re more secure, the unknown “internet of things” manufacturers will step up and make users and the internet as a whole safer.

Inverse:

You Might Also Read:

A Guide To Addressing Corporate IoT Security

« US Army Upgrades Cyber Protection Training
Trump Relaxes US Cyber Attack Rules »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

ReversingLabs

ReversingLabs

ReversingLabs develops cyber threat detection and mitigation tools that address the the latest directed attacks, advanced persistent threats and polymorphic malware.

macmon secure

macmon secure

macmon secure develops network security software, focussing on Network Access Control.

Netrix

Netrix

Netrix is a Mexican company specialized in IT Security, with more than 18 years of experience in Managed Services, Professional Services and Turnkey Solutions related to Security.

Acuant

Acuant

Acuant is a leading global provider of identity verification, regulatory compliance (AML/KYC) and digital identity solutions.

Exponential-e

Exponential-e

Exponential-e provide Cloud and Unified Communications services and world-class Managed IT Services including Cybersecurity.

Sixgill

Sixgill

Sixgill, an IoT sensor platform company, builds the universal data service and smart process automation software allowing any organization to effectively govern its IoE assets.

ProSearch Partners

ProSearch Partners

ProSearch Partners are national talent acquisition specialists exclusively focussing on Technology and Digital talent including Cybersecurity, Data Analytics and Execs.

Blue Hexagon

Blue Hexagon

Blue Hexagon is a deep learning innovator focused on protecting organizations from cyberthreats.

David Hayes-Export Controls

David Hayes-Export Controls

David Hayes-Export Controls provides assistance to companies affected by export controls or who are considering entering the market but are unsure of the commercial and regulatory implications.

eXate

eXate

eXate provides pioneering technology that empowers organisations to protect, control and manage their sensitive data centrally, providing a complete data privacy solution.

Towerwall

Towerwall

Towerwall offers a comprehensive suite of security services and solutions using best-of-breed tools and information security services.

Ballistic Ventures

Ballistic Ventures

Ballistic Ventures is a new kind of venture capital firm, built by and for cybersecurity entrepreneurs and investors.

Oregon Systems

Oregon Systems

Oregon Systems is a Regional Leader & Distributor with value added services for OT, IoT, IIoT & IT Cybersecurity products, Solutions & professional services throughout the middle-east region.

HashDit

HashDit

HashDit products and services focus on helping build a safe ecosystem for both protocol users and smart contract developers on BNB Chain.

ExtraHop

ExtraHop

ExtraHop's dynamic cyber defense platform uses cloud-scale AI to help enterprises detect and respond to advanced threats - before they compromise your business.

Parablu

Parablu

Parablu is a leading provider of data security and resiliency solutions for the digital enterprise.