NSA Hacking Chief: Internet of Things Security Keeps Me Up at Night
The trend to connect devices such as air conditioners and door locks to the Internet is making life easier for the National Security Agency’s hackers—but also keeping their boss awake at night.
Rob Joyce, chief of the NSA’s Tailored Access Operations unit, leads what is likely the best resourced group of hackers in the world. They are tasked with infiltrating computer networks to gather foreign intelligence, and also with probing U.S. government networks to improve their security.
Speaking in San Francisco Wednesday about how nation-backed teams like his operate, Joyce said that the so-called “Internet of things” is a major boon when the TAO group needs to attack a target. He singled out heating and cooling systems as examples of Internet-connected devices that offer national-level hackers a route into organizations that computer network administrators often overlook. Joyce spoke at the Enigma security conference.
However, Joyce also said that the poor security of such devices is one of his primary concerns when it comes to the safety of U.S. networks.
In recent years researchers have found that hundreds of thousands of industrial and commercial control systems—referred to as SCADA systems—have been blithely hooked up to the Internet without proper protections, including power plants and other critical infrastructure (see “What Happened When One Man Pinged the Whole Internet”).
“SCADA security is something that keeps me up at night,” said Joyce. He suggested that it might need new ideas from academia, which works on more fundamentally new ideas than industry, to improve the situation.
Nicholas Weaver, a computer security researcher at the International Computer Science Institute in Berkeley, California, who attended Joyce’s talk, said that he had correctly highlighted a significant problem, and an area where scary discoveries are easily made but possible solutions very scarce. “I don’t do SCADA research because I like to sleep at night,” said Weaver.
Researchers that do work on SCADA security have found evidence that there are groups trawling the Internet looking for industrial systems to infiltrate (see “Chinese Hacking Team Caught Taking Over Decoy Water Plant”). A recent report by the Nuclear Threat Initiative said that many nuclear power and weapons facilities are not adequately protected against computer-based attacks.
Keep Reading
Most Popular
This new data poisoning tool lets artists fight back against generative AI
The tool, called Nightshade, messes up training data in ways that could cause serious damage to image-generating AI models.
The Biggest Questions: What is death?
New neuroscience is challenging our understanding of the dying process—bringing opportunities for the living.
Rogue superintelligence and merging with machines: Inside the mind of OpenAI’s chief scientist
An exclusive conversation with Ilya Sutskever on his fears for the future of AI and why they’ve made him change the focus of his life’s work.
How to fix the internet
If we want online discourse to improve, we need to move beyond the big platforms.
Stay connected
Get the latest updates from
MIT Technology Review
Discover special offers, top stories, upcoming events, and more.