4 ms·
One may consider that an incentive for manufacturers to make sure their code is working correctly before shipping it. In many cases that would probably be proh
by krylon 10y ago
One may consider that an incentive for manufacturers to make sure their code is working correctly before shipping it.
In many cases that would probably be prohibitively expensive, but for a thermostat or a light switch, it should not be that difficult to do.
- infinite8s 10y agoAre you including the capability to control it over a network? Burning potentially unfixable 0-day exploits into ROM would probably be a non-starter.
- WalterBright 10y agoIf you can update the firmware over a network, you have an uncloseable exploit vector. ROMs are not unfixable. They do require physical access, though, which eliminates nearly all of the risk.
- infinite8s 10y agoEven if those updates require signature verification with a public key stored in ROM? I guess the signing key cold get out or you could patch the firmware to skip the signature check (the way the initial iPhone was jailbroken)
- heavenlyhash 10y agoWe also literally just had the Windows key leaks within the last week. Un-updatable signing keys are still an uncloseable exploit vector. (And updatable signing keys are an uncloseable exploit vector. You can't win.) Physical-access-only updates: yes please. We know what the security boundary is on those, and how to reset it.
- WalterBright 10y agoProhibitively expensive? That's how things have been done for decades. Only recently have manufacturers decided that everything should be redoable over the internet.