The internet of things may be coming to us all faster and harder than we'd like.
Reports coming out of Russia suggest that some Chinese domestic appliances, notably kettles, come kitted out with malware—in the shape of small embedded computers that leech off the mains power to the device. The covert computational passenger hunts for unsecured wifi networks, connects to them, and joins a spam and malware pushing botnet. The theory is that a home computer user might eventually twig if their PC is a zombie, but who looks inside the base of their electric kettle, or the casing of their toaster? We tend to forget that the Raspberry Pi is as powerful as an early 90s UNIX server or a late 90s desktop; it costs £25, is the size of a credit card, and runs off a 5 watt USB power source. And there are cheaper, less competent small computers out there. Building them into kettles is a stroke of genius for a budding crime lord looking to build a covert botnet.
But that's not what I'm here to talk about.
I have an iPad. (You may be an Android or Windows RT proponent. Don't stop reading: this is just as applicable to you, too.) I mostly use it as a reacreational gizmo for reading and watching movies, and a little light gaming. But from time to time it's handy to have a keyboard—I use it for email too. So I bought one of these (warning: don't buy it direct, it costs a lot less than £90 on the high street). It's a lovely piece of kit: charges over micro-USB, magnetically clips to the front of the iPad to cover it when not in use, communicates via bluetooth.
But I suddenly had a worrying thought.
This keyboard contains an embedded device powerful enough to run a bluetooth stack. The additional complexity of adding wifi is minimal, as is the power draw if it's designed right. Here's an SD card, with wifi. It's aimed at camera owners: the idea is it can automatically upload your snapshots to the cloud. Turns out it runs Linux and it's hackable.
Look at that cute Logitech bluetooth keyboard. There's a lot of space in it, behind the slot the iPad sits in. Presumably that chunk of the case is full of battery, and the small embedded computer that handles the bluetooth stack. Even if it isn't hackable in its own right, what's to stop someone from buying a bunch of bluetooth keyboards and installing a hidden computer in them? Done properly it'll run a keylogger and some sniffing tools to gather data about the device it's connected to. It stays silent until it detects an open wifi network. Then it can hook up and hork up a hairball of personal data—anything you typed on it—at a command and control server. Best do it stealthily: between the hours of 1am and 4am, and in any event not less than an hour after the most recent keypress.
I hear tablets are catching on everywhere. Want to dabble in industrial espionage? Get a guy with a clipboard to walk into an executive's office and swap their keyboard for an identical-looking one. When they come back from lunch they'll suffer a moment of annoyance when their iPad or Microsoft Surface turns out to have forgotten it's keyboard. But they'll get it paired up again fast, and forget all about it.
I don't want you to think I'm picking on Logitech, by the way. Exactly the same headache applies to every battery-powered bluetooth keyboard. I'm dozy and slow on the uptake: I should have been all over this years ago.
And it's not just keyboards. It's ebook readers. Flashlights. Not your smartphone, but the removable battery in your smartphone. (Have you noticed it running down just a little bit faster?) Your toaster and your kettle are just the start. Could your electric blanket be spying on you? Koomey's law is going to keep pushing the power consumption of our devices down even after Moore's law grinds to a halt: and once Moore's law ends, the only way forward is to commoditize the product of those ultimate fab lines, and churn out chips for pennies. In another decade, we'll have embedded computers running some flavour of Linux where today we have smart inventory control tags—any item in a shop that costs more than about £50, basically. Some of those inventory control tags will be watching and listening to us; and some of their siblings will, repurposed, be piggy-backing a ride home and casing the joint.
The possibilities are endless: it's the dark side of the internet of things. If you'll excuse me now, I've got to go wallpaper my apartment in tinfoil ...