All right. Hi, everybody. I'm Mark Eichhorn. I'm with the Federal Trade Commission.
And I wanted to speak to you with my colleague Aaron Alva today about our IOT Home Inspector Challenge.
And we actually have the winner of the challenge on the phone. He's going to chime in later about his project.
But before we dig in, I just wanted to let you know I'm in the Bureau of Consumer Protection at the Federal Trade Commission.
And I work in a division that does privacy and data security work.
I'm Aaron Alva. I'm a technologist at the FTC. I'm in our relatively new security and our new research group, OTEC.
So we do security and privacy research, a whole host of research, anything from network traffic.
analysis of smart TVs to ransomware and so forth.
And so here we also need to give our general disclaimer.
We both work for the FTC, but the views are here our own and not necessarily those of the commission or any one commissioner.
But we want to talk to you about what the FTC has done when it comes to IOT security over the last year and a half or so,
as well as the challenge that we announced this week.
Okay.
So just a word about the FTC.
Our big boss was here, actually, and she was at DEF CON and she was here.
We have two commissioners who are sort of in charge of our agency at the moment, and one of them was here.
And so what we do is, in my division and with support from our friends in OTEC, we do privacy and data security work.
So this chapter is a little bit different.
So the challenge was related to sort of updating IOT devices.
So just to give you some background about what led us to do this challenge, we had done some workshops.
They're sort of like conferences, essentially, on issues relating to, like, mobile security.
So the question of, well, you know, how often are devices updated?
And if the device manufacturer releases an update, how and when does that actually get to consumers?
We also held a workshop on the Internet of Things.
And part of that was learning that, yeah, consumers don't actually do that great a job of, like, finding and downloading patches or updates,
often because they don't know that they're out there.
And we recently did, last month, a workshop on connected cars, privacy and security concerns.
So we also do enforcement work, so case enforcement.
So in that context, we had a case called ASIS involving ASIS routers.
We resolved it through a consent agreement with the company.
But in the course of that, we alleged several things.
And one was that the company actually had received...
Security researchers had reached out to the company over time to alert them to vulnerabilities.
And they just didn't have a good process for handling and processing those.
So they didn't necessarily sort of act on certain tips that they got from researchers.
They also...
fix things, at one point they had fixed the problem and released a patch but it was eight
months before they actually sort of let people know, like if a consumer had registered with
them, it was eight months before they let them know, hey, a patch is available. And then
finally they had a tool that would allow you to find out whether there was an update
available to the firmware and that tool didn't work. So it didn't, sometimes there was a patch
available but the tool would tell you that there wasn't. So among the relief in that case,
that we required them to provide notice to users, you know, if there's a vulnerability patch
available or an upgrade available.
A couple of other cases that we brought, both again consent agreements, but one
was the HTC matter involving basically some software that HTC had put on top of the Android
smart phone system. And they introduced some vulnerabilities in doing that. So as part
of our relief in that order, we required them to release patches for about a couple million
HTC smart phones. And then finally in the Oracle matter,
Oracle was releasing updated software to address
vulnerabilities. But then they weren't necessarily replacing the
outdated software. So sometimes the new, the newer updated
software would just be installed alongside the old still
vulnerable software. So those were a few of the things that
sort of led us to think about a challenge related to consumer
updates. And we sort of realized obviously companies don't always
update the software when maybe they should. But particularly
when they do release updates, we wanted to make sure consumers
had an easier way to sort of find out about those updates and
download them. Aaron?
So the FTC has authority under what's called the America
Competes Act. And we can bring challenges that help come up with
some sort of technical solution out there that consumers can use.
In the past, FTC has done challenges at DEF CON related to
robocalls. We had Nomo Robo and Zapping Rachel here, DEF CONs
22 and 23. And we're interested in challenges such as the
Home Inspector Challenge that really answer these questions
that are difficult questions to do with, from a policy standpoint
sometimes, but actually scream out for a technical solution. So
in particular with the IoT Security Challenge, the scope of
this challenge was around being able to equip consumers with
understanding what devices are on the market, what devices are on
their network, and whether those devices were up to date, and
potentially what vulnerabilities, common vulnerabilities were in
those devices, and then have some way to help facilitate updates to
those devices on the network. So a lot of what happens when it comes
to a consumer and consumers' understanding of IoT security is we want to be able
to equip these consumers with better understanding the potential attack
surfaces on their home networks and ways that they can actually help facilitate
updates so that updates actually happen to devices. And one of the
discussions that we had here in terms of the scoping of this particular
challenge was around facilitating updates. There was a recognition that
the FTC has said through other processes, including NTIA, comments around IoT upgrades
and patching that automatic updates would be the preferable way to go. But for the devices
that don't have automatic updates, how are there ways that we can still help protect
consumers and facilitate updates? And so this particular challenge ran through the
FTC from January, I believe? From January through May this year. And we, the acting chairman
of the FTC announced the winner this week. The criteria around the challenge was we asked
people to submit an abstract, a video, as well as a detailed paper that would talk about what
they had built. And what they had built had gone around certain criteria that was crafted to
help address and kind of tease out the things that the challenge was trying to accomplish. This
criteria was in three large parts. The biggest part was how well does your submission work? And the
idea around that was how do we kind of address the technical feasibility of device
identification on a home network? So can you automatically recognize devices of a home network?
Or provide instructions for input to help facilitate that too if needed? Can you actually profile
the devices to determine the software level that is currently on the device? So you could imagine in
some context this would be easy. Maybe it's broadcast. Maybe it's made known in some way. And in
other cases with devices, particularly devices that are potentially older, it may actually be technically
more difficult to identify at what level, what level, what software level or formal level is on the
device at a particular point. And so being able to do this in an automated fashion is one of the
things that we wanted to help facilitate so that, so that consumers without having to do anything
technical could actually see this information in their homes and have a better sense of all the
devices that were on their network and what they were and crucially whether they were up to date. So,
another part was of the overall criteria around how well does the submission work was around
assisting and facilitating updates. And that's something that you'll see addressed as our winner will
kind of briefly talk about his approach. And something that we are continuing to be interested in.
There was also a wild card approach that we did. And that was to make sure that we were able to
make the device connected to the network. And we also made a new app called the). app which
the honorable mention made use of to kind of take a step out of the criteria and show us kind of a blue sky
approach. So that's, that was the first criteria. How well does it work, what are the technical
feasibilities that we need to facilitate consumers better knowing what's in their network and whether
those devices were up to date. The second part was around how user friendly your tool is. So when we talk about the
our friends and family members that are not in IT that may not know even what antivirus does or
may not know the difference between WPA2 or any other sort of encryption on Wi-Fi. We want to
talk about the consumers that can use this in a user-friendly way and can understand the
information that's being provided to them through this particular tool. So things like how easy is
this tool to use for the average consumer without technical expertise? How easy is it to set up? We
don't want a substantial effort in setting this up. We want this something that anyone can roll
out on their home networks. And then also, you know, does it display or convey information about
the devices that it's assessed and does it accurately communicate in a way that's
understandable to the users? Does it allow consumers also to control, ask the
user for specific aspects of information in case there needs to be analysis done off the
particular device or solution that is being submitted? So if you need to hit back your servers
or cloud or however you want to call it, do you give that type of control to the users for that
particular information? So that was the second criteria. So how user-friendly your tool is to the
reasonable person, to the reasonable consumer. The third was how skilled the user is. So the
key criteria was how scalable your tool is. The key criteria was explaining how the tool could be
used for products other than those specifically addressed in the challenge itself. So is your tool
extendable into other areas? Or can it be extended in other ways? There were also other, and
then there was also an optional aspect of the criteria that dealt with vulnerabilities. The main
focus of the, of the challenge was around facilitating the tool. And then there was also an
additional aspect of the criteria that dealt with creating updates where the manufacturer had an
update available. But we also wanted to address as part of the criteria other ways that could,
that would help consumers guard against broader security vulnerabilities. And so that was
provided as points that you could get as part of your criteria. So that was kind of the overall
criteria. How well does it work? Does it profile the device and understand the level that it's at?
Facilitate updates, usability, user friendliness for the, for the common user, the non IT user, the
consumers that are out there that, uh, have never heard of DefCon, have, don't know anything about
security. Um, and that how scalable your tool is. Um, so we addressed those in, uh, we had a panel
of five independent judges that were outside the FTC that, uh, came together and at, and, uh,
evaluated all of the submissions that came in. And they all turned out to be fairly smooth, and, uh,
in and led to our winner. So before we talk to our winner who is on the phone with us, there was
also an honorable mention that was announced. And I wanted to just briefly talk about the
honorable mention because the honorable mention made use of what we call the wildcard option. And
that was essentially kind of a blue sky approach for a technical solution that would help
consumers in this area. And it was the team pink, pinc persistent internal network
containment. Their honorable mention made use of sandboxing so that each device would have its
own configuration baseline and reporting so that you isolated each device on the network in a
very user friendly way that consumers would understand how to do so that we would be able to
would limit the attack surface and if a device was compromised,
it would limit the risk of the rest of your home network being
potentially vulnerable. So that was the honorable mention. And
then do you want to address the winner? Yeah. Let's get him on
the phone. Steve is muted right now. Let's get him on. This is
Steve Castle, who is the winner of our $25,000 top prize. And
Steve, are you on? Yes, I am. All right. Do you want to talk a
little bit about your winning idea? Yeah, absolutely. So what I
did was the SDPharm mobile application. What it does is it
takes a holistic look in your network. And you run some
What it does, it asks you to log into, it clearly says that all the application credentials
aren't going to be sent anywhere else.
And it does that.
It backgrounds WebView for the mobile file.
And what it does, that we do the application for those steps of the UG.
From there, we take steps.
Steve, we can't quite hear you.
Okay.
Sorry about that.
So, I will try my best to summarize what your tool has done as much as I can understand it right now.
So, Steve Castle was our winner.
And he came up with an app called the IoT Watchdog that enables simple secure management of IoT devices
on the home network.
And it's a really cool app.
And through his app, it facilitates kind of what we talked about in the criteria,
which is an app that has the devices that have been identified on the network
and the type of device it is.
And for devices that can't be identified, there's actually a user flow that can go by quite easily
that starts at kind of company name and walks the consumer through identifying which device it is in particular
so that they can use it.
And it helps to make it so that you have a better inventory, the consumer has a better inventory of devices on the network.
And it helps then scan the local network for things such as default or weak passwords.
And users can use an app to know about the devices inventoried and their known implementations and configurations.
And also has a part that helps facilitate the user's ability to follow the device.
facilitate updates and notify the consumers and give them a really user friendly way to
describe what's on the network and what might need to be done to help facilitate updates.
Right. So what excited us about this was, again, we're looking for some way, you know, where
companies release an update, you know, like Mirai obviously happened at the time that we were
planning this workshop, but to the extent that these IoT devices might be out there for a long
time, it's great if companies release the updates, but then consumers, if they don't know where
they are, how to get to them, whether there's been an update for their device, you know, that's
not a great situation for our overall security. So Steve's IoT watchdog sort of helped surface
the information.
Yeah. So in summary, we're right up against our time. So in summary, we wanted this
challenge to help equip consumers, non-IT consumers that know nothing about security or anything
technical to help have them understand what's on their network and what they need to know about
their devices. So we're excited to have these devices, and for devices that don't do automatic
updates, help facilitate those updates in a way that is easy for the consumer and helps get those
devices up to the level at which is updated based on the manufacturer and then also takes a step
further in going and addressing vulnerabilities and common design flaws. So we're around here at
DEF CON if you want to talk to us or have other questions about the FTC. But thank you so much for
your time.
Thank you.
Yes.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
We wanted a component that was easy to use, to emphasize, and to try to really make sure that whatever comes out of this challenge does get adopted.
I think your question is separate, like out in the marketplace, is FTC going to require ease of use?
And if the market doesn't, if a product's not easy to use, it's just going to fail?
That's an area where I don't, you know, there's no, I don't know personally of any requirements along those lines.
No, we're a law enforcement agency in general, and we leave the legislation for the most part to Congress.
Yes.
Yeah, question.
Yeah, that's a.
We have authority to do reports under our statute, and that report is underway.
I think that the deadline is this fall sometime for announcing that.
Appreciate that.
And the report, just so everyone here is around, FTC has an authority called 6B that says we can go and ask,
different companies to provide us information for the basis of an overall report of what is happening around a particular area.
And that report that we've asked for is around mobile updates and mobile security.
And as part of that, we asked a number of, was it OEMs?
OEMs in conjunction with FTC.
Or with the FCC about what they do for mobile security updates and what their process is and so forth,
so that we can help understand what's going on in that marketplace.
I believe there is an automatic component to AS.
Yeah, I believe there's both an automatic component.
There's an automatic component to it, and there's also a way to add individual devices to it, is my understanding.
I believe so.
I believe so.
But Steve is on the phone, but I could also follow up with you or point you to the winner, too.
All right, well, thank you, everyone.
Thank you.
Thank you.