Skip to main content

Yes, China is probably watching us through our IoT devices

Wyze Cam Pan Review
Terry Walsh/Digital Trends

Is your phone/laptop/home security camera spying on you for the Chinese government?

Well, probably.

Should you care?

Recommended Videos

Yes … but also, how much of a choice do we all have?

Internet of Things (IoT) device security — particularly in home security camera systems like Wyze, Aqara, and Ring — has been a hot topic lately. The devices have repeatedly been shown to be leaky and insecure at best, with no two-factor authentication or encryption present. This has allowed for a multitude of incidents wherein hackers have gained control of people’s digital lives and threatened them.

Ring Video Doorbell Pro
Image used with permission by copyright holder

Holistic approach lacking

But a wider problem still is the passive watching that might be happening. Many of the devices are assembled in China, using Chinese parts. Even if the companies are not explicitly Chinese, this presents a threat. So much so that the U.S. Department of Interior at the end of January instituted a ban on Chinese-made drones and drone parts over fears that the tech might be sending information back to the Chinese government.

“In general, IoT devices contain many third-party components and different communication stacks, which provide many ways for malicious parties to hack into them,” said Natali Tshuva, CEO and co-founder of Sternum, an Israeli cybersecurity company that works on secure connectivity for IoT devices, in an email to Digital Trends.

This is changing, somewhat, Tshuva said. Common vulnerabilities in IoT systems like Elasticsearch databases being left open for access without credentials are problematic, she said. This emphasizes the need for end-to-end encryption.

“Companies are taking steps to enhance the security of their devices, but they are lacking a holistic approach that covers all security aspects of their devices, leaving an opening for attackers to exploit them,” Tshuva wrote. “With billions of IoT devices coming to market now and over the next few years, it’s critical that each device is embedded with security.”

ATYCBY 3-19-2017
Osiris: IoT water pipe monitor Image used with permission by copyright holder

Price drives the bus

The problem, said Jimmy Jones, telecoms cybersecurity expert at Positive Technologies, is that these companies care most about being first to market, and this means cutting costs. “Everything is driven by price point. People don’t want to pay that extra dollar,” Jones told Digital Trends. “So they [the companies] end up using third-party software and third-party parts. The problem is, a lot of [the devices] do come from China.”

“It’s hard to tell what’s malicious and what’s just incompetent,” said Ron Gula, a former National Security Administration white hat hacker and current investor in cybersecurity startups. “Let’s say there are some companies that have perfect security on their devices, but they are still based in China,” he said. “All of that data they collect, the Chinese government can ask for access to it. Or it might even have implied access, and they don’t have to tell us about it.”

Who is China spying on then, if is indeedspying? “In a word, indirectly, probably everyone,” Jones said. “But it’s not necessarily cause for alarm; it’s a trust situation.”

So much of our lives are produced in China now. Where do we draw the line as to what products we’re willing to accept from there, Jones asked. “Is it a car? Is it a drone? Is it a light bulb? Is it a central heating system?” Jones said, pointing to two stories, one about a DDOS attack in Finland that shut down a city’s central heating system, another another about smart light bulbs leaking Wi-Fi credentials.

LIFX 2.0 update
Image used with permission by copyright holder

“We’ve seen it with Huawei,” Jones said, referring to the Chinese phone manufacturing giant that has been the target of much ire from the Trump administration. “These companies, or their holding companies, are all owned by the trade unions. The Chinese Communist Party is essentially the head of the trade unions, so reall,y everyone is just two steps away from being owned by the Chinese government.”

“There has to be a point where trust needs to take precedence,” Jones said. “Or, do we create a new superpower to manufacture our stuff, and then in 10 years we decide we don’t trust them either?”

Requiring everything to be made here in the U.S. isn’t really that feasible, said Gula. “Our iPhones are built in China,” he said. “Like most Cisco routers and most laptops.” And honestly, he said, that isn’t what matters here. The best antidote right now is just to educate the public.

“When your data’s in the Cloud, you hope it’s protected, but it’s honestly subject to the laws of wherever it’s hosted,” he said. And then there’s a question of where the data that’s transmitted through these devices is stored. “Data provenance, and where it’s stored, and who has access is a big deal.”

“I don’t want to see ‘Made in China’ stickers,” Gula said. “I wanted to see ‘Data Hosted in China’ stickers.”

Maya Shwayder
I'm a multimedia journalist currently based in New England. I previously worked for DW News/Deutsche Welle as an anchor and…
This modular Pebble and Apple Watch underdog just smashed funding goals
UNA Watch

Both the Pebble Watch and Apple Watch are due some fierce competition as a new modular brand, UNA, is gaining some serous backing and excitement.

The UNA Watch is the creation of a Scottish company that wants to give everyone modular control of smartwatch upgrades and repairs.

Read more
Tesla, Warner Bros. dodge some claims in ‘Blade Runner 2049’ lawsuit, copyright battle continues
Tesla Cybercab at night

Tesla and Warner Bros. scored a partial legal victory as a federal judge dismissed several claims in a lawsuit filed by Alcon Entertainment, a production company behind the 2017 sci-fi movie Blade Runner 2049, Reuters reports.
The lawsuit accused the two companies of using imagery from the film to promote Tesla’s autonomous Cybercab vehicle at an event hosted by Tesla CEO Elon Musk at Warner Bros. Discovery (WBD) Studios in Hollywood in October of last year.
U.S. District Judge George Wu indicated he was inclined to dismiss Alcon’s allegations that Tesla and Warner Bros. violated trademark law, according to Reuters. Specifically, the judge said Musk only referenced the original Blade Runner movie at the event, and noted that Tesla and Alcon are not competitors.
"Tesla and Musk are looking to sell cars," Reuters quoted Wu as saying. "Plaintiff is plainly not in that line of business."
Wu also dismissed most of Alcon's claims against Warner Bros., the distributor of the Blade Runner franchise.
However, the judge allowed Alcon to continue its copyright infringement claims against Tesla for its alleged use of AI-generated images mimicking scenes from Blade Runner 2049 without permission.
Alcan says that just hours before the Cybercab event, it had turned down a request from Tesla and WBD to use “an icononic still image” from the movie.
In the lawsuit, Alcon explained its decision by saying that “any prudent brand considering any Tesla partnership has to take Musk’s massively amplified, highly politicized, capricious and arbitrary behavior, which sometimes veers into hate speech, into account.”
Alcon further said it did not want Blade Runner 2049 “to be affiliated with Musk, Tesla, or any Musk company, for all of these reasons.”
But according to Alcon, Tesla went ahead with feeding images from Blade Runner 2049 into an AI image generator to yield a still image that appeared on screen for 10 seconds during the Cybercab event. With the image featured in the background, Musk directly referenced Blade Runner.
Alcon also said that Musk’s reference to Blade Runner 2049 was not a coincidence as the movie features a “strikingly designed, artificially intelligent, fully autonomous car.”

Read more
Apple TV+ just got a price slash that’s tough to resist, and it won’t last long
The Apple TV main screen.

Apple has just quietly announced that it will be slashing the price on its Apple TV+ offering for a limited time deal.

While Apple prices the service at a standard $9.99 per month usually, it has just cut that way down to $2.99 per month.

Read more