Why smart cities need to get wise to security – and fast
|
Version 0 of 1. The smart city is an alluring vision of the future, in which civic technology such as traffic lights, smart meters for utilities and public transport could all be connected and feed back invaluable data online. Glasgow has spent £24m installing technology such as smart street lights that brighten for pedestrians and cyclists, and traffic-tracking sensors in roads, while Bristol is collecting data on everything from health to pollution and interpreting it via a “city operating system”. While those cities may be streets ahead of others, most urban areas have some smart features. Yet a leading internet security researcher has warned that the smart cities of the future could be more vulnerable to hackers than the computers and smartphones of today. A city has plans for earthquakes or floods in some areas, but I don’t think many cities have any plans for cyber attacks Cesar Cerrudo, chief technology officer at security research firm IOActive Labs, warned that city authorities and governments that are the customers of technology firms aren’t testing the security of the systems they buy. “They do a lot of tests for functionality on the system and devices, but they don’t do any security testing. So, basically, they are trusting the vendors,” he said. Speaking at the RSA security conference in San Francisco in April, Cerrudo said many firms selling smart systems were failing to build in effective security, such as encryption – a significant problem when so many services transmitted their data wirelessly. “All the data goes over the air. If you don’t have a good encryption, anyone can capture the data over the air and compromise security,” he said. For example, he revealed that the 200,000 traffic control sensors installed around the world, from Melbourne to London, were vulnerable to attack from hackers. Sean Sullivan, a security analyst at F-Secure, said: “Smart cities can provide planning departments a lot of very value information for better city living – but it could also be a big vector for fraud unless properly secured. He agreed that smart cities are “highly hackable” but predicted that we are more likely to see pranks – such as fiddling with highway signs or one-day outages on transport systems that cause chaos – than large-scale attacks. Sullivan pointed to a smart power meter hack investigated by the FBI that could be costing utility firms millions by letting tech-savvy users reprogramme the meter and get energy for free. James Lyne, global head of security research at Sophos, said that some systems have relied on security through obscurity. “To date, the kinds of devices typically deployed to run our critical national infrastructure have relied heavily on obscurity or isolation to keep themselves safe – that is, that they’ve implemented odd protocols that the mainstream computing world doesn’t typically use, and they are placed on isolated networks to try and avoid tampering,” said Lyne. “Once one of these principles is degraded, issues are often identified.” Lyne added that: “So far there has not been a concerted effort from the attacker community to compromise such devices. I suspect this is predominantly because it has not met their financial or political goals (the former being the lion’s share of attackers’ interests). “The most popular target is still the traditional device used by you or me, as this makes the most money, but of course a more connected future might bring a change in this pattern.” Given the security risks, it may come as a surprise that some internet of things vendors (those who sell appliances and other technology that connects to, and functions via, the internet) aren’t letting researchers such as Cerrudo test their products – even when he’s willing to buy them himself. “Some vendors won’t sell it to you if they know you are a security company,” he said, without pointing the finger at any specific firms. “That happened to me with a smart street-lighting system. I tried to acquire the devices, but couldn’t even get a quote.” Cerrudo said less-established companies saw security research as a threat, despite the practice of more established manufacturers to routinely work with external researchers or hackers to identify security vulnerabilities. And even when companies did work with security researchers to identify software flaws, it could take months or even years to push out updates to city-wide systems. Related: Is India's 100 smart cities project a recipe for social apartheid? “Sometimes they don’t have proper mechanisms [for updates], where they can just produce a security fix and get it quickly installed on the systems and devices,” he said. “This is a really big challenge, because if they find a security issue, that should be solved very fast. If not, then you remain open to attacks.” What can be done to secure smart cities? Governments need to be more responsible when purchasing smart city solutions, looking not just for whizz-bang features, but taking the time to understand security systems and ensure they actually work. Cerrudo called for every city to have a Computer Emergency Response Team, or CERT – just as many big businesses do – to handle attacks or vulnerabilities, ensure vendors fix such flaws and run penetration tests to check their own systems. “In case of a security incident, it will be difficult for a city to know what to do, how to react. A city has plans for earthquakes or floods in some areas, but I don’t think many cities have any plans for cyber attacks.” |