Japan to Hack 200 Million IoT Devices | EE Times

In mid-February, the Japanese government plans to start openly hacking more than 200 million IoT devices already installed at home and elsewhere in Japan.

The government’s plan — announced a week ago — is likely to expose the uncomfortable truth known to many experts but unknown to most consumers: Many IoT devices in use are vulnerable to cyberattacks.

Insecurity in IoT is triggered by many factors — including consumer indifference and inaction. Too often, consumers don’t bother to change the initial settings in an IoT device after purchase and installation. Second, peer-to-peer communication among IoT devices, by nature, remain unchecked and unsupervised. Third, service providers aren’t doing automated updates of firmware frequently enough.

While security experts hail the Japanese government plan as a necessary step, many Japanese media reports have balked, criticizing the heavy hand of the government.

Critics call the action a violation of citizens’ privacy. Indeed, who is comfortable with the idea of the the government peering into every personal life? Second, most people don’t trust the government to keep the collected data safe. How could anyone be sure the government won’t expose some data — even unwittingly? Finally, the Japanese harbor the undeniable fear that Japan is becoming a surveillance nation in the name of public safety. Is Japan becoming China?

In its public announcement, the National Institute of Information and Communications Technology (NICT) said it will use default passwords and other tactics to attempt hacks of randomly-selected IoT devices, seeking to compile a list of vulnerable devices.

NICT will then share the information with Internet service providers, who will be advised to alert consumers and to secure the devices. The government has not specified the targeted IoT devices, but it will most likely start with routers and webcams. The NICT said the program could last for up to five years.