Week 7--Shodan, Part 2

To be honest, I was planning on moving on to a different topic this week. However, a new article about Shodan was recently published, and it made a small amount of commotion on the social media world. (If you're unfamiliar with what Shodan is, see my Week 5 post.)
Basically, Shodan came out with a new feature: an image feed of insecure webcams using a specific Internet protocol.  The concept behind the feature isn't really new--the ability to search for webcams has been on Shodan for a while now--but the implementation has made it easier for people to actually access vulnerable cameras connected to the Internet. Obviously, this creates some very large privacy and security concerns.
So that's the overview. Now I want to make a few observations:

• Before Shodan came out with this image feed, it already had enough capabilities so a determined user could access those vulnerable webcams anyway. In other words, this new Shodan feature that has people up in arms (search Facebook for "shodan" if you don't believe me) has been available to the most determined--and by extension threatening--people for a while now. This recent news coverage is good because it raises awareness of security issues in cameras linked to the web, but the problem needed to be addressed months before Shodan's camera feed became an outrage.
• On the flip side, this new camera feed is making it easier for people to access those cameras. Now, it only takes a Shodan account to access those webcams; before, it also required a decent knowledge of search engine queries to get similar results. The trend here is an increasing ability of "regular" people to commit cyber acts that could be considered unethical. While Shodan is not illegal by any means, I think it's an indication of a widespread trend towards making cybercrime easier and easier to commit or get involved in.
• The webcam creators, in sacrificing security to focus on other things, have essentially created a situation where they are asking for legislation. The article I posted earlier devotes most of its time towards explaining the government's response to such threats, with the basic conclusion that government will likely step in to create a standard of security in the camera and other IoT device industry. While I definitely see this government intervention as a good idea, if for no other reason than forcing a level of security into the IoT industry, I am disappointed that an entire industry was unwilling to take responsibility for the safety and security of their own products before it was too late. Such a perspective in a technology-saturated world is doomed to failure, and it is sad to see that the IoT industry, for the most part, is ignoring this. As the article I referenced says, “Our dependence on technology is growing faster than our ability to secure it.” And as the eminent security expert Yoda would say on this issue, "This, my friend, a problem is."

InfoSec is a significant problem of the 21st Century. This insecurity in webcams is only a small bit of the insecurity on the Internet, and it appears that little is being done to remedy the problem. Shodan just pointed out the problem--it didn't create it--and now the world needs to decide what to do with this new knowledge and awareness of the problem.