12 ms·

I've been warning about this kind of thing for years and years. Both professionally and in my personal life. On forums and anywhere people will listen... IoT

I've been warning about this kind of thing for years and years. Both professionally and in my personal life. On forums and anywhere people will listen... IoT is a security disaster I hate to suggest things like this but we may need legal remedies to solve the problem before it becomes an Internet Zombie Armageddon (IZA). It's that bad. There's going to be tens of billions of IoT devices installed at businesses and homes in just a few short years. If they're not receiving regular, timely security updates the Internet as we know it may just plain collapse from the sheer weight of all the zombies. I propose a mandatory "nutrition label" of sorts for IoT device packaging. Something like this: * Updates itself regularly * Conforms to NIST security standards * Public penetration test results: https://ptr.iot.nist.gov/A2L7P9D23345 * Shares data with 3rd party: No * Administration by vendor: No * Requires Internet connection to administer: No * Requires 3rd party service to function: No * Notifies of intrusion: Yes * Logs all access: Yes * Encrypts all network traffic: Yes Something like a publicly-posted penetration test would be incredibly valuable. Especially if it was performed after each update of the device and at regular intervals. Even if it was an automated test (which in theory could be 'gamed') it would still be better than what we have now which is nothing!

elthran 10y ago
All very well in theory, but I'm sure it will suffer the same fate as ordinary nutrition labels - the general populace just doesn't care/isn't motivated enough to care
- tjr 10y ago
  Bundle all of those points up into some sort of standard level of acceptance and let conforming products have a big shiny sticker saying so on the front of the package? As a bit of an analogy, while I may enjoy poring over computer system security details, I'm pretty novice at a lot of more real-world things. Yesterday I was buying a new dryer exhaust hose. I read some reviews online, and looked at boxes in the store. I managed to learn enough to realize I wanted an all-metal construction so it wouldn't catch on fire. But I really wanted some big shiny signal to let me know "HEY YES IF YOU HAVE NO IDEA WHAT YOU'RE DOING, BUY THIS ONE!"...
api 10y ago
Legislation would only be used as a vehicle to achieve monopoly control by large tech companies who would have their lobbyists write the law. The Internet would become a true oligopoly with other uses of the wire forbidden. The only answer is to fix the Internet to make DDOS harder and less effective. Implementing standards to block IP spoofing is a start since it would make source quench actually work. Another not mutually exclusive answer is decentralization. DDOS works because you can use it to take down all but the largest central servers or those that don't buy protection. But if apps are decentralized, an attacker can only play whack a mole with individual endpoints to far less effect. If decentralized protocols do mobility well victims could just switch connections or their ISPs could react by rotating IPs.
- riskable 10y ago
  > Legislation would only be used as a vehicle to achieve monopoly control by large tech companies... Food labeling requirements haven't lead to monopoly control over food. Why would IoT labeling be different? Don't get me wrong, I'm cynical too! The lobbyists that control our legislators with purse strings will most certainly do everything in their power to ensure any such labeling only makes things better for their corporate overlords! I just think, "what's good for corporate overlords" is actually good for everyone in this case. I would expect VC-funded businesses to reject any such, "Requires 3rd party service to function" label since they're all about locking customers in with "network effects". I would also expect established, old-school businesses like Microsoft to reject any label that would identify a product as "open source". ...but what corporate overlord is going to object to labeling like, "Regularly updates itself"? That's something that's cheap for them to do but can be expensive for upstart competitors. There's much to be gained and almost nothing to be lost with labeling IoT devices.
  - api 10y ago
    Food is a commodity. It would be very very hard to accomplish the same kind of lock-in. Lock-in is easy with software because of its brittleness.
Moru 10y ago
There is always the risk of too many standards. People doesn't know even now what all the green labels mean on the food they buy. https://xkcd.com/927/ https://xkcd.com/927/
- GFK_of_xmaspast 10y ago
  > People doesn't know even now what all the green labels mean on the food they buy You don't need to know what they all mean, you only need to know what the ones you care about mean.
mxuribe 10y ago
While I'm not a security professional nor am I always a fan of adding bureaucracy or overhead if there is no clear benefit, I absolutely agree with you. Even if this information is not easily consumable at first to the layperson, it would be helpful to security professionals. It would also allow for easier comparison - at least from a security perspective. Let's face it, some IoT things like security systems get installed by installation companies, so I'm sure they would appreciate knowing more details about the various products, and which to recommend for their installations, etc. Furthermore, it would set a precedent, and who knows, maybe in the future the newer iterations (of these "labels/label info") could improve enough for the ease of reading/understanding by consumers. If I put my consumer/layperson hat on for a moment...Even if there is no government mandate to add this type of "label" to these IoT products, if I see 2 comparable products side-by-side on a shelf (or ecommerce website), but one has this "label/label info", and one lacks it, I would definitely purchase the one which HAS the label.
arviewer 10y ago
This as QR-code with an app that somehow helps you out. Just a thought
- riskable 10y ago
  My initial thought was to provide the penetration test/general security info URL as a QR Code =) SECURITY INFO <QR Code Here> https://some.thirdparty.org/info/ABC123456789 Something like that... Easy for anyone with a phone to scan or someone at home to enter by hand if need be.
3pt14159 10y ago
I've been trying too. On Reddit I just get downvoted - which I actually don't understand. I've also been warning governments about how bad things are and how bad things are going to be. I can see some movement, but it is too slow. We need more mandatory, automated penetration testing of all corporations by regulation. We also need cyber army reserves to help bring some of the knowledge that we have in the private sector to our governments without having to work in a shitty beige office downtown Ottawa. A bunch of Teslas hacked at the same time is a weapon of mass destruction. We need to recognize that we have weapons of mass destruction online and take countermeasures now so we don't wake up one day to the news that 20 million cars accelerated to 200km/h and crashed into gas plants and government buildings all around the country. We need to regulate industry so the "move fast and break things" doesn't actually move fast and break things.
- pavel_lishin 10y ago
  > A bunch of Teslas hacked at the same time is a weapon of mass destruction. Daemon[1] was a fun read, but I have no desire to see it become reality. [1] https://www.goodreads.com/book/show/6665847-daemon https://www.goodreads.com/book/show/6665847-daemon
  - BatFastard 10y ago
    Fantastic book, great ideas.
    - warfangle 10y ago
      And terrible prose :(
- wyldfire 10y ago
  > We need more mandatory, automated penetration testing of all corporations by regulation. No thank you, there be dragons there. Before you know it that regulation leaks to all software development that includes calls to connect() or bind(). But an Underwriters Laboratory for pen testing? Yes, please. (Or even UL themselves!) I saw an article on HN within the last 12-18 months about a similar concept/security auditing.
zzzcpan 10y ago
The problem is going to solve itself, just like it solves itself already. Before volumetric DDOS became widespread, no ISPs cared enough to do anything about it, the risk simply didn't worth anything to put resources into dealing with it. Today it does and many deploy some measures to quickly react and at least null route targeting IPs to minimize impact on the rest of their customer. Some IXs and large networks even provide filtering capabilities for free to filter those attacks closer to the sources and avoid sending large volumes of traffic through their networks. So, don't worry about it.
- bisby 10y ago
  You say that like "ISPs" are some mythical non-human entity. SOMEONE has to make that decision, and the more educated on the topic of potential threats the person making the decision is, the better the reaction time and mitigation of issues will be. The post above was publicly broadcast in hopes that the person who makes the decision reads HN, not because it is expected that the common everyday Joe reader will do something about it.
  - zzzcpan 10y ago
    ISPs are well aware about these kinds of problems, but don't make decisions based on potential threats. It has to become a real threat first.
    - TeMPOraL 10y ago
      Correction: it has to become a real threat to their bottom-line first. Before that, there's no business incentive to care.
pdkl95 10y ago
As Dan Geer warned[1], embedded devices must not be both unfixable and immortal. Either they have some sort of remove management interface and receive regular security updates, or they must have a limited lifespan. Creating embedded systems that won't be updated and live indefinitely is knowingly creating a hazard and nuisance to society. [1] http://geer.tinho.net/geer.blackhat.6viii14.txt http://geer.tinho.net/geer.blackhat.6viii14.txt
- pavel_lishin 10y ago
  > or they must have a limited lifespan This seems like it would give free range to sell shitty devices that are obsolete the moment they come out of packaging - or worse, that brick themselves on a timer for supposed security purposes (think HP ink cartridges.)
  - pdkl95 10y ago
    I agree, but the unfixable+immortal combination isn't really an acceptable situation. The solution for most devices is to simply keep them off the internet. Being a host on the internet requires some level of care and maintenance so you don't become a hazard to others. I doubt most light-bulbs or thermostats are worth the ongoing expenses of maintaining security updates into the indefinite future. In theory, traditional goods that last more than a few years should be more successful on the market than self-destructing devices with dubious internet features.
  - Already__Taken 10y ago
    This is fine, there is a market for that like anything else. The problem is where that is not a function the consumer is aware off at the time of purchase. Now perhaps some good recycling laws would combat abuses of such an effect.
- fucking_tragedy 10y ago
  Tying IoT devices to cloud services almost guarantees a limited lifespan.
  - 10y ago
logicallee 10y ago
your first and fifth points are an oxymoron. Obviously nobody wants their dishwasher, washing machine, fridge, microwave, to put up messages, "is it okay to update now?" - can you imagine dozens of devices in people's homes doing that? so your first point, automatically updates, implies your fifth point, administered by vendor, should be "yes". (Not "no", as you've put it.) Further, I would like you to think more broadly about infrastructure. I think every person's home should have a local network called "shitty backdoored and malicious IoT crap". The question is how to administer that network, what its topology should be, how these devices should be able to receive information from the Internet, and in general what their capabilities should be and the way in which they should be firewalled off. Having these devices on users' home wifi via their home router (the status quo) is obviously wrong and insufficient. I'm afraid your checklist is also, therefore, wrong and insufficient. so, think harder at the architectural level, please. the existence of IoT stuff is obviously good. (as in, obviously there can be a benefit to devices being able to be connected - in the abstract, not based on today's very flawed infrastructural and architectural choices) the infrastructure we have for it today is obviously insufficient. I don't have a comprehensive solution in mind or anything but it is worth giving serious attention to by people who have spent years on the subject. today, they are failing. It's not that people are ignoring their advice: they just don't have any. They've thrown up their hands and given lists like yours, which are not a comprehensive solution and are not even internally consistent. They need to think outside the box and propose completely new infrastructure. there needs to be different infrastructure in place, not an SOP for the current infrastructure. we need better security baked into the topology and architecture of how the devices are connected.
- pdkl95 10y ago
  > Obviously nobody wants their microwave to put up a message, "is it okay to update now?" Then why are you putting it on the internet?! Either you create devices that are secure - which may include things that neither the manufacturer or the user want to do - or you shouldn't be putting it on the internet. > I think every person's home should have a local network called "shitty backdoored and malicious IoT crap". Relying on border security is a terrible idea. A firewall is not an excuse to ignore host security.
ComodoHacker 10y ago
>we may need legal remedies to solve the problem I doubt we can solve this problem legal way because all economic forces are against us. Making a product secure costs many times more than making a product itself. "Regular security updates" is a nightmare to vendors. Nobody actually does it, especially on consumer market. Vendors react to massively exploited vulnerabilities at best. Any long-term maintenance, including security, simply don't fit into current business models. And people want cheap products, they don't want secure products. Government contractors want super cheap products (with support but this doesn't change much). And education/propaganda won't change that until some big disaster happen.
- mgbmtl 10y ago
  I think there's an analogy to be made with the FCC (and non-US equivalents). IoT consumer devices are not general purpose devices. They are mass-produced and serve a specific purpose. They should be certified and accountable in a way. If not, they should get fined for being irresponsible.
  - ubernostrum 10y ago
    If we can't force manufacturers and carriers to ship security updates to Android phones, there's zero chance of forcing it for light bulbs.
- bloaf 10y ago
  Get insurance companies interested. Force IoT vendors to buy insurance against potential damages caused by vulnerabilities in their devices.
mtgx 10y ago
The European Commission is trying to push for something like that, but I don't know if it's going to be anywhere as "strict" as what you suggest. It may be just something like C, B, A, A+, A++ ratings for security, which wouldn't be too bad, unless what's behind those ratings are really some inadequate rules. SSL Labs' HTTPS ratings work because the developer of the test is also constantly tweaking and optimizing for current "best practices", and the ratings are not too far off from what the sites should be rated at in terms of HTTPS security. http://www.euractiv.com/section/innovation-industry/news/commission-plans-cybersecurity-rules-for-internet-connected-machines/ http://www.euractiv.com/section/innovation-industry/news/com...
marcosdumay 10y ago
Well, as I keep repeating... Do not plug your "things" on the Internet unless there's a serious gain from it! This solves most of the problem. The rest will only get solved by free software, and if the government should mandate anything, it is that the software can be managed by the user, not a laundry list of warnings that will mean nothing in practice. (By the way, that "conforms to NIST security standards" is intended as a "yes" mean "bad" kind of warning, right?)
- pavel_lishin 10y ago
  > Do not plug your "things" on the Internet unless there's a serious gain from it! Why not? It's kind of a tragedy-of-the-commons situation. I gain a fancy lightbulb that can change colors when I play with my phone. Do I, personally, really care if that lightbulb is part of a botnet that's beating someone's website into submission? Statistically, it's unlikely to affect me, so it's all gain for no cost beyond paying for the bulb.
  - elwell 10y ago
    But you would care if the lightbulb was caused to heat up and start a fire.
    - lmm 10y ago
      Sure, but manufacturers have adequate incentives to avoid that, because they will be held liable.
  - marcosdumay 10y ago
    It's way more likely to affect you than that it making any relevant harm to anybody else. Do you care about thieves checking your lights from anywhere on the city? And what about your lights launching attacks against your other computers?
    - pavel_lishin 10y ago
      > Do you care about thieves checking your lights from anywhere on the city? Well, this article (and discussion) is mostly about these devices being sources of DDOS attacks. > And what about your lights launching attacks against your other computers? I thought my comment was pretty explicitly clear that most people would not care at all, even if they knew.
pasbesoin 10y ago
Among others, the right to explore and fix these devices ourselves. That current abilities to do so, in the U.S. are arbitrated by the Library of Congress, seems entirely insufficient. Except that it perhaps gained us some temporary rights to do so that corporate lobbyists via Congress would otherwise already have taken away. This tech has become essential to society. Intellectual property "rights" need to find their limits at a point before they put this essential function at risk. If the original manufacturers can't get this right, and where the underlying chipset technologies are from what strikes me as an oligopoly -- regardless of the number of brands and models they get stuffed into -- then the public should have every right to research, verify, and fix the products, themselves. Ultimately and hopefully, this also works, financially. If you can't make it work properly, you lose control of your revenue stream, rather than using a government-granted monopoly (IP) and your income on lawyers and lobbyists to coerce people to suffer with your failure.
idlewords 10y ago
I've called for a mandatory physical "wifi off" switch for all Internet-connected devices that disconnects the antenna. Useful for the times when you want your light bulb to just be a light bulb, and not DDOS some journalist.
- pavel_lishin 10y ago
  Some IoT and IoT-like things are simply completely non-functional without some sort of network connection. A physical switch is great for light bulbs, but it turns my child's crib-cam into a decorative art piece. And when you would flip that switch, anyway? Wouldn't it make more sense to control this from your router? Something like changing the wifi password or network name would work even better (assuming you control the router.)
  - TeMPOraL 10y ago
    IoT should be Intranet of Things, not Internet of Things. I'd say it's simple as that. But the commercial interests are so opposed to engineering sanity that I have no idea how to tackle it. Maybe someone should start enforcing mandatory VPNs for households? I.e. I get you want to control your LED bulbs from your phone, but that doesn't imply they should be accessible from public Internet. Also I wonder if the whole thing isn't just a symptom of a problem that we can no longer expand connected technologies while expecting zero knowledge from end users. Maybe it's about time to require some minimum amount of computer knowledge from citizens of a technological civilization?
    - icebraining 10y ago
      Maybe someone should start enforcing mandatory VPNs for households? I.e. I get you want to control your LED bulbs from your phone, but that doesn't imply they should be accessible from public Internet. You don't even need a VPN, just have the device only accept connections from local IPs (and use TCP to avoid spoofed IPs).
      - pdkl95 10y ago
lazaroclapp 10y ago
Well, probably it will be a security nightmare for a while, until the sheer weight of vulnerabilities and incidents causes vendors to radically change their security practices, regulation or not. I think a good example of what I would expect to happen is by analogy to the PC internet of the 90's, where Windows 9X viruses and worms were just a fact of life when using computers, and every email inbox was 95% spam each time you opened it. Remember that what is now considered basic security practices (UAC, https, "Are you sure you want to run this exe?") were at the time considered hardcore security measures that only enterprise systems needed to care about. The difference is that now more of our daily lives depend on the internet being reliable, and, that some IoT device's failure mode might involve a cost in human lives. But the fact that the incidents are going to be worse will also probably put more pressure on companies to fix their security. Regrettably, I don't think this will actually happen until some startup's fancy new IoT gadget gets hacked in a way that causes it to kill a few hundred people and the resulting lawsuits end the company.
- kazagistar 10y ago
  The problem is the IoT devices don't harm their owners or the company that built them but rather other targets on the internet.
  - xanderstrike 10y ago
    Provided they continue to function as expected and aren't harming the network they're a part of. Both are big assumptions.
  - the8472 10y ago
    It's probably not a great idea, but how about legalizing hacking for self-defense? If you get DoSed then those devices, are fair game. That would shift incentives back to the owners to some extent, since they're basically acceptable targets as long as their devices are insecure.
    - justinlardinois 10y ago
      I'm not sure how that would help the problem. When you're talking about thousands or more devices, counterattacking them individually wouldn't be feasible. Also I imagine many botnet owners secure the devices they take over so that others can't steal them for their own botnet.
guelo 10y ago
The solution is going to have to come from the network side; getting the DoSing devices automatically blackholed by routers. I know there are many technical issues with implementing something like that at scale but it seems more tractable then trying to enforce security practices on $20 web cams.
- icebraining 10y ago
  Yeah, but routers are a shitshow in and of themselves, with plenty of vulnerabilities. It's like using a sieve to plug a leak.
abalone 10y ago
The original Internet was a "security disaster". The solution was not to certify every device that got connected to the Internet. Instead, we invented firewalls. Firewalls were designed to keep bad traffic from entering LANs. For the IoT era, perhaps what we need are firewalls that keep bad traffic from exiting LANs.
- riskable 10y ago
  > Firewalls Sigh. Firewalls worked great for Yahoo, Sony, and LinkedIn, right? Firewalls are just a layer. They don't even do that much! Not only that but the average consumer knows nothing of firewalls. Do we expect Joe Average to be able to login to his router and configure a firewall to allow his refrigerator access to its security update server? Or maybe we should expect Jane Average to configure her Firewall to perform MitM attacks on SSL so traffic going to/from her IoT coffee maker can be inspected?
  - abalone 10y ago
    You are seriously under-representing the impact of firewalls on the security of the Internet. Every consumer router has a built-in firewall. They don't need to know anything about it because the default configuration works for most consumers. That's what we should be aiming for as a solution for the IoT security problem. Something that just works for most cases without configuration... much less extensive labeling with commensurate demands of technical knowledge and attention on the part of every consumer. They are not perfect (nothing is), but a Internet without firewalls would be apocalyptically worse.
    - riskable 10y ago
      Most consumer routers have a built in firewall, yes but I've never seen one outside of my own house that's actually configured to block anything. Have you? No one configures them! No, NAT is most decidedly not a firewall.
- flukus 10y ago
  > perhaps what we need are firewalls that keep bad traffic from exiting LANs. You mean like just about every firewall in existence today?
pat_space 10y ago
Your username is very fitting
phs318u 10y ago
Maybe it's a sign of the times. Maybe it's a sign that I'm old and cynical. Maybe I'm just having a bad day. But what if the IZA is the kind of predictable, "9-11" scale event that "changes everything" - meaning lets the powers-that-be rewrite the rules of the game in a way that (further) empowers them and (further) disempowers the citizenry? How surprised would we be to hear governments uniting in response to an IZA that the answer is a new, centrally controlled and managed "internet" - because terrorists, the economy, and think of the children?
a_c 10y ago
As someone novice in network security, is there any public penetration testing tool that someone can recommend, Ideally open-sourced
- mynameislegion 10y ago
  Kali has a boatload of open source tools: http://kali.org/ http://kali.org/
mynameislegion 10y ago
* Open source: No * GPL violating: Yes * Tivoised: Yes * Backdoors: Yes
mynameislegion 10y ago
What mjg59 has been doing is utter genius. Buy something online, discover it is full of backdoors and violates the GPL, post utterly scathing review, buyers stop buying it. We need more people to do that.
anexprogrammer 10y ago
If we want non-tech friends and relatives to buy the right things, we need to boild down to traffic light label, or something like EU energy label for score out of 8 (that manufacturers dislike, and had to be recalibrated when >50 of appliances were A rated - guess it works well too). To me, we should have IoT devices on a different protocol not everything http(s). Nothing gets out unless you got an IoT passthrough router. An IoT hub that shows me what devices, connections, and manages what can connect to where and when. QoS and other neat features if needed. It'll never happen now of course, but would sure beat the current fustercluck.
developer2 10y ago
Good luck with that. Most Android devices stop receiving updates after one major version upgrade. It will never, ever happen for all these extra devices. Stop dreaming.
problems 10y ago
This will realistically not be a major problem. Most of these IoT devices operate only in a LAN or talk to a specific "cloud" service. Thus, there's no way for an attacker to get access to services on them on a large scale basis (well, without hacking the cloud service, but hopefully someone can actively maintain that). The cameras are only an issue because many people exposed them directly to the internet so they could access them remotely. You will not see many people expose speakers, lightbulbs, blind controllers, thermostats, fridges, TVs, etc to the internet, so it's not exactly a major threat for most devices. Not for now at least. If IPv6 becomes wide spread available to consumers, we're in for a whole new wave of attacks on these types of devices unless home routers are configured to block incoming traffic by default to devices behind them.
- riskable 10y ago
  Your assumptions about the safety of LANs are wrong. LANs are not "safe" from attackers and NAT is not a security tool. If an attacker compromises any device on your network you think they'll stop there? Hell no. They're going to pivot and compromise every other vulnerable device on the network and we're already seeing "crime kits" (aka customizable malware) with built-in exploits for things like networked printers and cameras. It won't be long before they have built-in exploits for light bulbs, refrigerators, and more. Also, what about IPv6? To date, consumer routers that support IPv6 are configured by default to hand out global IPv6 addresses (as they should!) to connected devices via DHCPv6. What this means is that your IoT light bulb is going to get a globally-accessible IPv6 address. You can setup the firewall to block inbound connections to your light bulbs, toasters, microwave, refrigerator, etc but who is actually going to do that? Firewalls are a huge pain in the ass to configure for zillions of little devices like that and in order for them to work properly you'll need to ensure that each device gets a reasonably static IPv6 address which means going deep into the configuration of your router. Also consider that even if you have near perfect security for your LAN we're all constantly moving in and out of our homes with connected devices that could be compromised elsewhere. Laptops, phones, tablets, etc leave our homes, connect to who-knows-what free WiFi network and then return; possibly in a compromised state. Never assume that because something is on a LAN it is "protected" by the mere fact that it doesn't have a direct connection to the Internet! If something else on that LAN has a connection to the Internet you must treat it as if it were exposed to the Internet because it is.
abysmallyideal 10y ago
NIST has too much influence from the NSA. There needs to be a better standards equivalent where the US doesn't wield so much influence in subverting security protocols. It may be a pipedream considering every Western country wants to be part of the five eyes program. edit: The most democratic and open platform in the world was made by developers from all across the world vs US made operating systems like Windows and Apple which were basically trojan horses. We need an equivalent for security protocols, and protocols in general. We can't let US stazi entrenched Silicon Valley and their faux "Startup Scene" destroy the internet as rapidly as they are today. http://www.nytimes.com/2016/06/08/technology/the-webs-creator-looks-to-reinvent-it.html?_r=0 http://www.nytimes.com/2016/06/08/technology/the-webs-creato...
- riskable 10y ago
  I agree with you. I was just using the NIST as an example because they've been in the news recently; they just released some new security standards that are actually quite good! Presumably we'd use an independent organization who's whole job is to come up with best practices for the security of IoT devices. Semi-related aside: Microsoft Active Directory violates the NIST's new password hashing guidelines because it doesn't use a random salt when storing password hashes.
- IncRnd 10y ago
  >> The most democratic and open platform in the world was made by developers from all across the world vs US made operating systems like Windows and Apple which were basically trojan horses. By platform do you mean the Internet? The Internet was initiated by the U.S. Defense Advanced Research Projects Agency.
LeifCarrotson 10y ago
How can it update itself regularly without an Internet connection to a third party? Also, "logs all connections" is tricky. Why should my fridge need a hard drive? How much space must be available, and how far back should it store logs?
- riskable 10y ago
  Will your IoT lamp stop working if the vendor goes out of business? That's what "Requires 3rd party service to function" means. It's not contradictory with, "Updates itself regularly". You've got me thinking about this though... If I were selling an IoT device today I would likely just outsource the majority of the self-update problem by using an open source Linux distribution as the basis of my product and merely configure it to perform automatic updates. The product's software could be updated via a separate software repository (e.g. like a PPA). That way it would get automatically updated at a regular interval along with the OS (assuming I put out regular updates). This would actually be an ideal setup for consumers too because if I went out of business or my software stopped getting updates the consumer could just replace the software performing the IoT functions or merely remove it and at least be left with a functional embedded computer to hack around with. Obviously most consumers wouldn't do that but it'd be nice to give them that option.
- riskable 10y ago
  Replying to "logs all connections" separately... Who said anything about logs necessitating the need for permanent storage? My router doesn't have a permanent log... It just keeps a buffer of the last N log entries in memory (e.g. `logread`). Alternatively, I can (and have) configured it to forward its logs to a central server on my home network. Syslog forwarding and collection has been around for a really long time. It may be tricky to meet the "encrypts all network traffic" certification and syslog forwarding at the same time though since encrypted syslog normally involves a PKI. The whole Certificate Authority concept doesn't play really well with IoT, actually.
codedokode 10y ago
If the traffic is encrypted how do you guarantee that the device doesn't spy on user and doesn't have backdoors preinstalled? And why would a device need full Internet access? Shouldn't it be only accessible in home network with maybe some (user selected) servers from Internet it is allowed to connect to? We could use some sort of VPN (from device to other owner's devices) so that even if it is connected to Internet directly it doesn't accept any packets coming not from its owner. VPN also provides encryption while allowing user to examine traffic in clear text. I think we need some type of easyly deployed, ubiquitous, simple, snandartised VPN type protocol so that the users can build protected networks over public insecure infrastructure. Today if you connect your device to Internet you connect it directly to NSA and chinese hackers. And if your device is disconnected from public network hackers cannot break into it even if they have exploits.

elthran 10y ago

All very well in theory, but I'm sure it will suffer the same fate as ordinary nutrition labels - the general populace just doesn't care/isn't motivated enough to care

tjr 10y ago
Bundle all of those points up into some sort of standard level of acceptance and let conforming products have a big shiny sticker saying so on the front of the package? As a bit of an analogy, while I may enjoy poring over computer system security details, I'm pretty novice at a lot of more real-world things. Yesterday I was buying a new dryer exhaust hose. I read some reviews online, and looked at boxes in the store. I managed to learn enough to realize I wanted an all-metal construction so it wouldn't catch on fire. But I really wanted some big shiny signal to let me know "HEY YES IF YOU HAVE NO IDEA WHAT YOU'RE DOING, BUY THIS ONE!"...

api 10y ago

Legislation would only be used as a vehicle to achieve monopoly control by large tech companies who would have their lobbyists write the law. The Internet would become a true oligopoly with other uses of the wire forbidden. The only answer is to fix the Internet to make DDOS harder and less effective. Implementing standards to block IP spoofing is a start since it would make source quench actually work. Another not mutually exclusive answer is decentralization. DDOS works because you can use it to take down all but the largest central servers or those that don't buy protection. But if apps are decentralized, an attacker can only play whack a mole with individual endpoints to far less effect. If decentralized protocols do mobility well victims could just switch connections or their ISPs could react by rotating IPs.

riskable 10y ago
> Legislation would only be used as a vehicle to achieve monopoly control by large tech companies... Food labeling requirements haven't lead to monopoly control over food. Why would IoT labeling be different? Don't get me wrong, I'm cynical too! The lobbyists that control our legislators with purse strings will most certainly do everything in their power to ensure any such labeling only makes things better for their corporate overlords! I just think, "what's good for corporate overlords" is actually good for everyone in this case. I would expect VC-funded businesses to reject any such, "Requires 3rd party service to function" label since they're all about locking customers in with "network effects". I would also expect established, old-school businesses like Microsoft to reject any label that would identify a product as "open source". ...but what corporate overlord is going to object to labeling like, "Regularly updates itself"? That's something that's cheap for them to do but can be expensive for upstart competitors. There's much to be gained and almost nothing to be lost with labeling IoT devices.
- api 10y ago
  Food is a commodity. It would be very very hard to accomplish the same kind of lock-in. Lock-in is easy with software because of its brittleness.

Moru 10y ago

There is always the risk of too many standards. People doesn't know even now what all the green labels mean on the food they buy. https://xkcd.com/927/ https://xkcd.com/927/

GFK_of_xmaspast 10y ago
> People doesn't know even now what all the green labels mean on the food they buy You don't need to know what they all mean, you only need to know what the ones you care about mean.

mxuribe 10y ago

While I'm not a security professional nor am I always a fan of adding bureaucracy or overhead if there is no clear benefit, I absolutely agree with you. Even if this information is not easily consumable at first to the layperson, it would be helpful to security professionals. It would also allow for easier comparison - at least from a security perspective. Let's face it, some IoT things like security systems get installed by installation companies, so I'm sure they would appreciate knowing more details about the various products, and which to recommend for their installations, etc. Furthermore, it would set a precedent, and who knows, maybe in the future the newer iterations (of these "labels/label info") could improve enough for the ease of reading/understanding by consumers. If I put my consumer/layperson hat on for a moment...Even if there is no government mandate to add this type of "label" to these IoT products, if I see 2 comparable products side-by-side on a shelf (or ecommerce website), but one has this "label/label info", and one lacks it, I would definitely purchase the one which HAS the label.

arviewer 10y ago

This as QR-code with an app that somehow helps you out. Just a thought

riskable 10y ago
My initial thought was to provide the penetration test/general security info URL as a QR Code =) SECURITY INFO <QR Code Here> https://some.thirdparty.org/info/ABC123456789 Something like that... Easy for anyone with a phone to scan or someone at home to enter by hand if need be.

3pt14159 10y ago

I've been trying too. On Reddit I just get downvoted - which I actually don't understand. I've also been warning governments about how bad things are and how bad things are going to be. I can see some movement, but it is too slow. We need more mandatory, automated penetration testing of all corporations by regulation. We also need cyber army reserves to help bring some of the knowledge that we have in the private sector to our governments without having to work in a shitty beige office downtown Ottawa. A bunch of Teslas hacked at the same time is a weapon of mass destruction. We need to recognize that we have weapons of mass destruction online and take countermeasures now so we don't wake up one day to the news that 20 million cars accelerated to 200km/h and crashed into gas plants and government buildings all around the country. We need to regulate industry so the "move fast and break things" doesn't actually move fast and break things.

pavel_lishin 10y ago
> A bunch of Teslas hacked at the same time is a weapon of mass destruction. Daemon[1] was a fun read, but I have no desire to see it become reality. [1] https://www.goodreads.com/book/show/6665847-daemon https://www.goodreads.com/book/show/6665847-daemon
- BatFastard 10y ago
  Fantastic book, great ideas.
  - warfangle 10y ago
    And terrible prose :(
wyldfire 10y ago
> We need more mandatory, automated penetration testing of all corporations by regulation. No thank you, there be dragons there. Before you know it that regulation leaks to all software development that includes calls to connect() or bind(). But an Underwriters Laboratory for pen testing? Yes, please. (Or even UL themselves!) I saw an article on HN within the last 12-18 months about a similar concept/security auditing.

zzzcpan 10y ago

The problem is going to solve itself, just like it solves itself already. Before volumetric DDOS became widespread, no ISPs cared enough to do anything about it, the risk simply didn't worth anything to put resources into dealing with it. Today it does and many deploy some measures to quickly react and at least null route targeting IPs to minimize impact on the rest of their customer. Some IXs and large networks even provide filtering capabilities for free to filter those attacks closer to the sources and avoid sending large volumes of traffic through their networks. So, don't worry about it.

bisby 10y ago
You say that like "ISPs" are some mythical non-human entity. SOMEONE has to make that decision, and the more educated on the topic of potential threats the person making the decision is, the better the reaction time and mitigation of issues will be. The post above was publicly broadcast in hopes that the person who makes the decision reads HN, not because it is expected that the common everyday Joe reader will do something about it.
- zzzcpan 10y ago
  ISPs are well aware about these kinds of problems, but don't make decisions based on potential threats. It has to become a real threat first.
  - TeMPOraL 10y ago
    Correction: it has to become a real threat to their bottom-line first. Before that, there's no business incentive to care.

pdkl95 10y ago

As Dan Geer warned[1], embedded devices must not be both unfixable and immortal. Either they have some sort of remove management interface and receive regular security updates, or they must have a limited lifespan. Creating embedded systems that won't be updated and live indefinitely is knowingly creating a hazard and nuisance to society. [1] http://geer.tinho.net/geer.blackhat.6viii14.txt http://geer.tinho.net/geer.blackhat.6viii14.txt

pavel_lishin 10y ago
> or they must have a limited lifespan This seems like it would give free range to sell shitty devices that are obsolete the moment they come out of packaging - or worse, that brick themselves on a timer for supposed security purposes (think HP ink cartridges.)
- pdkl95 10y ago
  I agree, but the unfixable+immortal combination isn't really an acceptable situation. The solution for most devices is to simply keep them off the internet. Being a host on the internet requires some level of care and maintenance so you don't become a hazard to others. I doubt most light-bulbs or thermostats are worth the ongoing expenses of maintaining security updates into the indefinite future. In theory, traditional goods that last more than a few years should be more successful on the market than self-destructing devices with dubious internet features.
- Already__Taken 10y ago
  This is fine, there is a market for that like anything else. The problem is where that is not a function the consumer is aware off at the time of purchase. Now perhaps some good recycling laws would combat abuses of such an effect.
fucking_tragedy 10y ago
Tying IoT devices to cloud services almost guarantees a limited lifespan.
- 10y ago

logicallee 10y ago

your first and fifth points are an oxymoron. Obviously nobody wants their dishwasher, washing machine, fridge, microwave, to put up messages, "is it okay to update now?" - can you imagine dozens of devices in people's homes doing that? so your first point, automatically updates, implies your fifth point, administered by vendor, should be "yes". (Not "no", as you've put it.) Further, I would like you to think more broadly about infrastructure. I think every person's home should have a local network called "shitty backdoored and malicious IoT crap". The question is how to administer that network, what its topology should be, how these devices should be able to receive information from the Internet, and in general what their capabilities should be and the way in which they should be firewalled off. Having these devices on users' home wifi via their home router (the status quo) is obviously wrong and insufficient. I'm afraid your checklist is also, therefore, wrong and insufficient. so, think harder at the architectural level, please. the existence of IoT stuff is obviously good. (as in, obviously there can be a benefit to devices being able to be connected - in the abstract, not based on today's very flawed infrastructural and architectural choices) the infrastructure we have for it today is obviously insufficient. I don't have a comprehensive solution in mind or anything but it is worth giving serious attention to by people who have spent years on the subject. today, they are failing. It's not that people are ignoring their advice: they just don't have any. They've thrown up their hands and given lists like yours, which are not a comprehensive solution and are not even internally consistent. They need to think outside the box and propose completely new infrastructure. there needs to be different infrastructure in place, not an SOP for the current infrastructure. we need better security baked into the topology and architecture of how the devices are connected.

pdkl95 10y ago
> Obviously nobody wants their microwave to put up a message, "is it okay to update now?" Then why are you putting it on the internet?! Either you create devices that are secure - which may include things that neither the manufacturer or the user want to do - or you shouldn't be putting it on the internet. > I think every person's home should have a local network called "shitty backdoored and malicious IoT crap". Relying on border security is a terrible idea. A firewall is not an excuse to ignore host security.

ComodoHacker 10y ago

>we may need legal remedies to solve the problem I doubt we can solve this problem legal way because all economic forces are against us. Making a product secure costs many times more than making a product itself. "Regular security updates" is a nightmare to vendors. Nobody actually does it, especially on consumer market. Vendors react to massively exploited vulnerabilities at best. Any long-term maintenance, including security, simply don't fit into current business models. And people want cheap products, they don't want secure products. Government contractors want super cheap products (with support but this doesn't change much). And education/propaganda won't change that until some big disaster happen.

mgbmtl 10y ago
I think there's an analogy to be made with the FCC (and non-US equivalents). IoT consumer devices are not general purpose devices. They are mass-produced and serve a specific purpose. They should be certified and accountable in a way. If not, they should get fined for being irresponsible.
- ubernostrum 10y ago
  If we can't force manufacturers and carriers to ship security updates to Android phones, there's zero chance of forcing it for light bulbs.
bloaf 10y ago
Get insurance companies interested. Force IoT vendors to buy insurance against potential damages caused by vulnerabilities in their devices.

mtgx 10y ago

The European Commission is trying to push for something like that, but I don't know if it's going to be anywhere as "strict" as what you suggest. It may be just something like C, B, A, A+, A++ ratings for security, which wouldn't be too bad, unless what's behind those ratings are really some inadequate rules. SSL Labs' HTTPS ratings work because the developer of the test is also constantly tweaking and optimizing for current "best practices", and the ratings are not too far off from what the sites should be rated at in terms of HTTPS security. http://www.euractiv.com/section/innovation-industry/news/commission-plans-cybersecurity-rules-for-internet-connected-machines/ http://www.euractiv.com/section/innovation-industry/news/com...

marcosdumay 10y ago

Well, as I keep repeating... Do not plug your "things" on the Internet unless there's a serious gain from it! This solves most of the problem. The rest will only get solved by free software, and if the government should mandate anything, it is that the software can be managed by the user, not a laundry list of warnings that will mean nothing in practice. (By the way, that "conforms to NIST security standards" is intended as a "yes" mean "bad" kind of warning, right?)

pavel_lishin 10y ago
> Do not plug your "things" on the Internet unless there's a serious gain from it! Why not? It's kind of a tragedy-of-the-commons situation. I gain a fancy lightbulb that can change colors when I play with my phone. Do I, personally, really care if that lightbulb is part of a botnet that's beating someone's website into submission? Statistically, it's unlikely to affect me, so it's all gain for no cost beyond paying for the bulb.
- elwell 10y ago
  But you would care if the lightbulb was caused to heat up and start a fire.
  - lmm 10y ago
    Sure, but manufacturers have adequate incentives to avoid that, because they will be held liable.
- marcosdumay 10y ago
  It's way more likely to affect you than that it making any relevant harm to anybody else. Do you care about thieves checking your lights from anywhere on the city? And what about your lights launching attacks against your other computers?
  - pavel_lishin 10y ago
    > Do you care about thieves checking your lights from anywhere on the city? Well, this article (and discussion) is mostly about these devices being sources of DDOS attacks. > And what about your lights launching attacks against your other computers? I thought my comment was pretty explicitly clear that most people would not care at all, even if they knew.

pasbesoin 10y ago

Among others, the right to explore and fix these devices ourselves. That current abilities to do so, in the U.S. are arbitrated by the Library of Congress, seems entirely insufficient. Except that it perhaps gained us some temporary rights to do so that corporate lobbyists via Congress would otherwise already have taken away. This tech has become essential to society. Intellectual property "rights" need to find their limits at a point before they put this essential function at risk. If the original manufacturers can't get this right, and where the underlying chipset technologies are from what strikes me as an oligopoly -- regardless of the number of brands and models they get stuffed into -- then the public should have every right to research, verify, and fix the products, themselves. Ultimately and hopefully, this also works, financially. If you can't make it work properly, you lose control of your revenue stream, rather than using a government-granted monopoly (IP) and your income on lawyers and lobbyists to coerce people to suffer with your failure.

idlewords 10y ago

I've called for a mandatory physical "wifi off" switch for all Internet-connected devices that disconnects the antenna. Useful for the times when you want your light bulb to just be a light bulb, and not DDOS some journalist.

pavel_lishin 10y ago
Some IoT and IoT-like things are simply completely non-functional without some sort of network connection. A physical switch is great for light bulbs, but it turns my child's crib-cam into a decorative art piece. And when you would flip that switch, anyway? Wouldn't it make more sense to control this from your router? Something like changing the wifi password or network name would work even better (assuming you control the router.)
- TeMPOraL 10y ago
  IoT should be Intranet of Things, not Internet of Things. I'd say it's simple as that. But the commercial interests are so opposed to engineering sanity that I have no idea how to tackle it. Maybe someone should start enforcing mandatory VPNs for households? I.e. I get you want to control your LED bulbs from your phone, but that doesn't imply they should be accessible from public Internet. Also I wonder if the whole thing isn't just a symptom of a problem that we can no longer expand connected technologies while expecting zero knowledge from end users. Maybe it's about time to require some minimum amount of computer knowledge from citizens of a technological civilization?
  - icebraining 10y ago
    Maybe someone should start enforcing mandatory VPNs for households? I.e. I get you want to control your LED bulbs from your phone, but that doesn't imply they should be accessible from public Internet. You don't even need a VPN, just have the device only accept connections from local IPs (and use TCP to avoid spoofed IPs).
    - pdkl95 10y ago

lazaroclapp 10y ago

Well, probably it will be a security nightmare for a while, until the sheer weight of vulnerabilities and incidents causes vendors to radically change their security practices, regulation or not. I think a good example of what I would expect to happen is by analogy to the PC internet of the 90's, where Windows 9X viruses and worms were just a fact of life when using computers, and every email inbox was 95% spam each time you opened it. Remember that what is now considered basic security practices (UAC, https, "Are you sure you want to run this exe?") were at the time considered hardcore security measures that only enterprise systems needed to care about. The difference is that now more of our daily lives depend on the internet being reliable, and, that some IoT device's failure mode might involve a cost in human lives. But the fact that the incidents are going to be worse will also probably put more pressure on companies to fix their security. Regrettably, I don't think this will actually happen until some startup's fancy new IoT gadget gets hacked in a way that causes it to kill a few hundred people and the resulting lawsuits end the company.

kazagistar 10y ago
The problem is the IoT devices don't harm their owners or the company that built them but rather other targets on the internet.
- xanderstrike 10y ago
  Provided they continue to function as expected and aren't harming the network they're a part of. Both are big assumptions.
- the8472 10y ago
  It's probably not a great idea, but how about legalizing hacking for self-defense? If you get DoSed then those devices, are fair game. That would shift incentives back to the owners to some extent, since they're basically acceptable targets as long as their devices are insecure.
  - justinlardinois 10y ago
    I'm not sure how that would help the problem. When you're talking about thousands or more devices, counterattacking them individually wouldn't be feasible. Also I imagine many botnet owners secure the devices they take over so that others can't steal them for their own botnet.

guelo 10y ago

The solution is going to have to come from the network side; getting the DoSing devices automatically blackholed by routers. I know there are many technical issues with implementing something like that at scale but it seems more tractable then trying to enforce security practices on $20 web cams.

icebraining 10y ago
Yeah, but routers are a shitshow in and of themselves, with plenty of vulnerabilities. It's like using a sieve to plug a leak.

abalone 10y ago

The original Internet was a "security disaster". The solution was not to certify every device that got connected to the Internet. Instead, we invented firewalls. Firewalls were designed to keep bad traffic from entering LANs. For the IoT era, perhaps what we need are firewalls that keep bad traffic from exiting LANs.

riskable 10y ago
> Firewalls Sigh. Firewalls worked great for Yahoo, Sony, and LinkedIn, right? Firewalls are just a layer. They don't even do that much! Not only that but the average consumer knows nothing of firewalls. Do we expect Joe Average to be able to login to his router and configure a firewall to allow his refrigerator access to its security update server? Or maybe we should expect Jane Average to configure her Firewall to perform MitM attacks on SSL so traffic going to/from her IoT coffee maker can be inspected?
- abalone 10y ago
  You are seriously under-representing the impact of firewalls on the security of the Internet. Every consumer router has a built-in firewall. They don't need to know anything about it because the default configuration works for most consumers. That's what we should be aiming for as a solution for the IoT security problem. Something that just works for most cases without configuration... much less extensive labeling with commensurate demands of technical knowledge and attention on the part of every consumer. They are not perfect (nothing is), but a Internet without firewalls would be apocalyptically worse.
  - riskable 10y ago
    Most consumer routers have a built in firewall, yes but I've never seen one outside of my own house that's actually configured to block anything. Have you? No one configures them! No, NAT is most decidedly not a firewall.
flukus 10y ago
> perhaps what we need are firewalls that keep bad traffic from exiting LANs. You mean like just about every firewall in existence today?

pat_space 10y ago

Your username is very fitting

phs318u 10y ago

Maybe it's a sign of the times. Maybe it's a sign that I'm old and cynical. Maybe I'm just having a bad day. But what if the IZA is the kind of predictable, "9-11" scale event that "changes everything" - meaning lets the powers-that-be rewrite the rules of the game in a way that (further) empowers them and (further) disempowers the citizenry? How surprised would we be to hear governments uniting in response to an IZA that the answer is a new, centrally controlled and managed "internet" - because terrorists, the economy, and think of the children?

a_c 10y ago

As someone novice in network security, is there any public penetration testing tool that someone can recommend, Ideally open-sourced

mynameislegion 10y ago
Kali has a boatload of open source tools: http://kali.org/ http://kali.org/

mynameislegion 10y ago

* Open source: No * GPL violating: Yes * Tivoised: Yes * Backdoors: Yes

mynameislegion 10y ago

What mjg59 has been doing is utter genius. Buy something online, discover it is full of backdoors and violates the GPL, post utterly scathing review, buyers stop buying it. We need more people to do that.

anexprogrammer 10y ago

If we want non-tech friends and relatives to buy the right things, we need to boild down to traffic light label, or something like EU energy label for score out of 8 (that manufacturers dislike, and had to be recalibrated when >50 of appliances were A rated - guess it works well too). To me, we should have IoT devices on a different protocol not everything http(s). Nothing gets out unless you got an IoT passthrough router. An IoT hub that shows me what devices, connections, and manages what can connect to where and when. QoS and other neat features if needed. It'll never happen now of course, but would sure beat the current fustercluck.

developer2 10y ago

Good luck with that. Most Android devices stop receiving updates after one major version upgrade. It will never, ever happen for all these extra devices. Stop dreaming.

problems 10y ago

This will realistically not be a major problem. Most of these IoT devices operate only in a LAN or talk to a specific "cloud" service. Thus, there's no way for an attacker to get access to services on them on a large scale basis (well, without hacking the cloud service, but hopefully someone can actively maintain that). The cameras are only an issue because many people exposed them directly to the internet so they could access them remotely. You will not see many people expose speakers, lightbulbs, blind controllers, thermostats, fridges, TVs, etc to the internet, so it's not exactly a major threat for most devices. Not for now at least. If IPv6 becomes wide spread available to consumers, we're in for a whole new wave of attacks on these types of devices unless home routers are configured to block incoming traffic by default to devices behind them.

riskable 10y ago
Your assumptions about the safety of LANs are wrong. LANs are not "safe" from attackers and NAT is not a security tool. If an attacker compromises any device on your network you think they'll stop there? Hell no. They're going to pivot and compromise every other vulnerable device on the network and we're already seeing "crime kits" (aka customizable malware) with built-in exploits for things like networked printers and cameras. It won't be long before they have built-in exploits for light bulbs, refrigerators, and more. Also, what about IPv6? To date, consumer routers that support IPv6 are configured by default to hand out global IPv6 addresses (as they should!) to connected devices via DHCPv6. What this means is that your IoT light bulb is going to get a globally-accessible IPv6 address. You can setup the firewall to block inbound connections to your light bulbs, toasters, microwave, refrigerator, etc but who is actually going to do that? Firewalls are a huge pain in the ass to configure for zillions of little devices like that and in order for them to work properly you'll need to ensure that each device gets a reasonably static IPv6 address which means going deep into the configuration of your router. Also consider that even if you have near perfect security for your LAN we're all constantly moving in and out of our homes with connected devices that could be compromised elsewhere. Laptops, phones, tablets, etc leave our homes, connect to who-knows-what free WiFi network and then return; possibly in a compromised state. Never assume that because something is on a LAN it is "protected" by the mere fact that it doesn't have a direct connection to the Internet! If something else on that LAN has a connection to the Internet you must treat it as if it were exposed to the Internet because it is.

abysmallyideal 10y ago

NIST has too much influence from the NSA. There needs to be a better standards equivalent where the US doesn't wield so much influence in subverting security protocols. It may be a pipedream considering every Western country wants to be part of the five eyes program. edit: The most democratic and open platform in the world was made by developers from all across the world vs US made operating systems like Windows and Apple which were basically trojan horses. We need an equivalent for security protocols, and protocols in general. We can't let US stazi entrenched Silicon Valley and their faux "Startup Scene" destroy the internet as rapidly as they are today. http://www.nytimes.com/2016/06/08/technology/the-webs-creator-looks-to-reinvent-it.html?_r=0 http://www.nytimes.com/2016/06/08/technology/the-webs-creato...

riskable 10y ago
I agree with you. I was just using the NIST as an example because they've been in the news recently; they just released some new security standards that are actually quite good! Presumably we'd use an independent organization who's whole job is to come up with best practices for the security of IoT devices. Semi-related aside: Microsoft Active Directory violates the NIST's new password hashing guidelines because it doesn't use a random salt when storing password hashes.
IncRnd 10y ago
>> The most democratic and open platform in the world was made by developers from all across the world vs US made operating systems like Windows and Apple which were basically trojan horses. By platform do you mean the Internet? The Internet was initiated by the U.S. Defense Advanced Research Projects Agency.

LeifCarrotson 10y ago

How can it update itself regularly without an Internet connection to a third party? Also, "logs all connections" is tricky. Why should my fridge need a hard drive? How much space must be available, and how far back should it store logs?

riskable 10y ago
Will your IoT lamp stop working if the vendor goes out of business? That's what "Requires 3rd party service to function" means. It's not contradictory with, "Updates itself regularly". You've got me thinking about this though... If I were selling an IoT device today I would likely just outsource the majority of the self-update problem by using an open source Linux distribution as the basis of my product and merely configure it to perform automatic updates. The product's software could be updated via a separate software repository (e.g. like a PPA). That way it would get automatically updated at a regular interval along with the OS (assuming I put out regular updates). This would actually be an ideal setup for consumers too because if I went out of business or my software stopped getting updates the consumer could just replace the software performing the IoT functions or merely remove it and at least be left with a functional embedded computer to hack around with. Obviously most consumers wouldn't do that but it'd be nice to give them that option.
riskable 10y ago
Replying to "logs all connections" separately... Who said anything about logs necessitating the need for permanent storage? My router doesn't have a permanent log... It just keeps a buffer of the last N log entries in memory (e.g. `logread`). Alternatively, I can (and have) configured it to forward its logs to a central server on my home network. Syslog forwarding and collection has been around for a really long time. It may be tricky to meet the "encrypts all network traffic" certification and syslog forwarding at the same time though since encrypted syslog normally involves a PKI. The whole Certificate Authority concept doesn't play really well with IoT, actually.

codedokode 10y ago

If the traffic is encrypted how do you guarantee that the device doesn't spy on user and doesn't have backdoors preinstalled? And why would a device need full Internet access? Shouldn't it be only accessible in home network with maybe some (user selected) servers from Internet it is allowed to connect to? We could use some sort of VPN (from device to other owner's devices) so that even if it is connected to Internet directly it doesn't accept any packets coming not from its owner. VPN also provides encryption while allowing user to examine traffic in clear text. I think we need some type of easyly deployed, ubiquitous, simple, snandartised VPN type protocol so that the users can build protected networks over public insecure infrastructure. Today if you connect your device to Internet you connect it directly to NSA and chinese hackers. And if your device is disconnected from public network hackers cannot break into it even if they have exploits.