6 ms·

Not at all the case with IoT. See Bruce Schneier's recent article on the matter, where he makes the case that government regulation is the only feasible remedy

Not at all the case with IoT. See Bruce Schneier's recent article on the matter, where he makes the case that government regulation is the only feasible remedy at this point, as "The market can't fix this because neither the buyer nor the seller cares." [1]. [1] https://www.schneier.com/blog/archives/2016/10/security_econom_1.html https://www.schneier.com/blog/archives/2016/10/security_econ...

WalterBright 10y ago
I meant the servers being attacked. The owners of them definitely care. As for the IoT, the appliances could have their firmware in ROM instead of flash. Then, the malmare would not survive a reboot. Many customers are large scale enough (Microsoft, Google, governments, etc.) that they can demand it of vendors and vendors will deliver. Really, how often do you desire to update the firmware on your hard drive, your USB stick, etc.? (Another way to do it is to have the write-enable line controlled by a physical switch or jumper.) The only thing I can figure is everyone has forgotten what ROM is.
- psybin 10y ago
  If there's a ROM with non-editable software it will just get instantly compromised as soon as it comes back up. For your standard "internet of things" device there is no room, physically or in the bill of materials, for things like connectors for people to physically deliver updates.
  - WalterBright 10y ago
    This is not a difficult problem to solve. The ROM cannot be overwritten - hence it can be designed so that malware cannot run. Also, jumpers are cheap. Just set the jumper to enable writes, and download the update. Are you happy with it being unknowable which of your appliances are compromised or not? Would you pay $1 more for a disk drive with firmware in ROM? I would. If you were running a banking system, would you pay extra for code in ROM that cannot be compromised?
    - TeMPOraL 10y ago
      You would. But you're not the market - 99.99% of other people, who don't even know what a "jumper" is, are the market. So your preferences don't matter. Yes, even in most technology products. As for IoT devices, I can't imagine average Joe or Jane prying off their smart whatever, destroying the pretty plastic casing it's hidden in, and manually setting jumpers to flash firmware.
      - WalterBright 10y ago
        Isn't it ironic that the means of updating firmware to prevent installation of malware is the vector for installing malware? I don't think the current scheme is working very well. Even worse, there is no way to tell if your appliance has been compromised or not. There are a lot of companies that care whether their machines are infected or not.
- puddintane 10y ago
  What happens when you can't update the IoT device then, reboot may remove the attacker but the IP will be the same (and even if it changes, probably wouldn't be long before the next address is scanned and put back into being a zombie) and they would be right back in if you can't update and patch the flaw that let them in. I think in all honesty the regulation sounds best, requiring the router makers to disable features such as UPNP would prevent massive attacks like these.
  - madeofpalk 10y ago
    The Mirai botnet didn't write it's software into permanent storage on the hacked devices - it would be erased upon reboot. But then the device would be 'hacked' again within minutes of it coming back online.
    - petre 10y ago
      Then just modify the Mirai source to disable internet access and isolate the devices instead? It's already public.
necessity 10y ago
>Not at all the case with IoT Why? The rest of your comment doesn't address that. >See Bruce Schneier's recent article on the matter, where he makes the case that government regulation is the only feasible remedy at this point He also doesn't explain why. He literally writes: >>In fact, the software used to attack Krebs was simple and amateurish. What this attack demonstrates is that the economics of the IoT mean that it will remain insecure unless government steps in to fix the problem. This is a market failure that can't get fixed on its own. Why does it demonstrate that? "Neither the seller nor the buyer care" can also be applied to traditional botnets using computers - if the botnet is clever enough to not make any noise. He "justifies" the "sellers don't care" part with: >>they're now selling newer and better models, and the original buyers only cared about price and features. ... again the same for smartphones or laptops. And furthermore, what regulation he proposes to solve this? I mean, he presents the issue as being: >>The security of our computers and phones also comes from the fact that we replace them regularly. We buy new laptops every few years. We get new phones even more frequently. This isn't true for all of the embedded IoT systems. They last for years, even decades. We might buy a new DVR every five or ten years. We replace our refrigerator every 25 years. We replace our thermostat approximately never. Would he suggest that the companies selling these devices be obliged to push security patches? The same companies that he wrote could not even afford testing?: >>Companies like Microsoft, Apple, and Google spend a lot of time testing their code before it's released, and quickly patch vulnerabilities when they're discovered. Those companies can support such teams because those companies make a huge amount of money, either directly or indirectly, from their software -- and, in part, compete on its security. This isn't true of embedded systems like digital video recorders or home routers. ... I have read "government is the only solution" at least 6 times in that short article, without exaggeration. Looks a lot like fearmongering and propaganda to me.
- xenadu02 10y ago
  >> In fact, the software used to attack Krebs was simple and amateurish. What this attack demonstrates is that the economics of the IoT mean that it will remain insecure unless government steps in to fix the problem. This is a market failure that can't get fixed on its own. > Why does it demonstrate that? "Neither the seller nor the buyer care" can also be applied to traditional botnets using computers - if the botnet is clever enough to not make any noise. He "justifies" the "sellers don't care" part with: Not really. When a desktop PC is compromised sometimes it is noticed because eventually malware comes along that bricks the system, installs ransomware, or otherwise discloses itself. But the sad truth is that a lot of compromised desktop PCs aren't noticed which is why there are millions used in botnets right now. Microsoft decided to take it seriously and pushed automatic updates, adopted secure coding standards, etc. It took a decade to make a good dent in the problem and it still isn't completely resolved. >>they're now selling newer and better models, and the original buyers only cared about price and features. >... again the same for smartphones or laptops. And furthermore, what regulation he proposes to solve this? I mean, he presents the issue as being: >>The security of our computers and phones also comes from the fact that we replace them regularly. We buy new laptops every few years. We get new phones even more frequently. This isn't true for all of the embedded IoT systems. They last for years, even decades. We might buy a new DVR every five or ten years. We replace our refrigerator every 25 years. We replace our thermostat approximately never. >Would he suggest that the companies selling these devices be obliged to push security patches? The same companies that he wrote could not even afford testing?: If all manufacturers have to meet certain standards then no one can undercut anyone else by skipping out. You can save some money by not including various safety features but then you can't sell those devices to over half the world so what's the point? If it is all voluntary you have busy consumers who don't have the requisite background knowledge (nor the time) to learn the details of software security, nor audit the code for secure coding standards and that's assuming the code was even available. If you want to make the claim that every human being should be an expert at evaluating such claims that's a massive inefficiency. Really that's the primary problem with libertarian ideas in general: it introduces massive inefficiencies in the market. Not everyone can be an expert in chemistry, software, mechanical design, food safety, et al simultaneously. (Not to mention needing perfect and instantaneous information). Claiming that lawsuits will fix everything after-the-fact ignores the real human cost, the lost potential of the ruined lives, and doesn't work unless you completely eliminate the corporate veil and make everyone personally liable. Otherwise every company will just be incorporated with various shells to ensure you can't actually recover anything. That goes on today - get sued? File bankruptcy and re-incorporate under a new name. You don't even need to move the factory because the seller was just leasing it from your shell incorporated in the Bahamas. >>Companies like Microsoft, Apple, and Google spend a lot of time testing their code before it's released, and quickly patch vulnerabilities when they're discovered. Those companies can support such teams because those companies make a huge amount of money, either directly or indirectly, from their software -- and, in part, compete on its security. This isn't true of embedded systems like digital video recorders or home routers. ... >I have read "government is the only solution" at least 6 times in that short article, without exaggeration. Looks a lot like fearmongering and propaganda to me. Did you just not get on the internet this Friday or what? It isn't fear mongering, we're living in a world right now where there are millions of cheaply made IoT devices with hard-coded telnet ports wide-open. They can't ever be fixed because they weren't made with any ability to update the firmware. Their owners don't even know they are infected. What mechanism are you proposing to magically make the manufacturers or consumers a) give a shit and b) gain the capability to evaluate products on a security basis? This is a classic tragedy of the commons situation. Each individual makes a rational decision for themselves (saving money) but it results in a massively bad outcome for the whole world.
deleted 10y ago
[deleted]

WalterBright 10y ago

I meant the servers being attacked. The owners of them definitely care. As for the IoT, the appliances could have their firmware in ROM instead of flash. Then, the malmare would not survive a reboot. Many customers are large scale enough (Microsoft, Google, governments, etc.) that they can demand it of vendors and vendors will deliver. Really, how often do you desire to update the firmware on your hard drive, your USB stick, etc.? (Another way to do it is to have the write-enable line controlled by a physical switch or jumper.) The only thing I can figure is everyone has forgotten what ROM is.

psybin 10y ago
If there's a ROM with non-editable software it will just get instantly compromised as soon as it comes back up. For your standard "internet of things" device there is no room, physically or in the bill of materials, for things like connectors for people to physically deliver updates.
- WalterBright 10y ago
  This is not a difficult problem to solve. The ROM cannot be overwritten - hence it can be designed so that malware cannot run. Also, jumpers are cheap. Just set the jumper to enable writes, and download the update. Are you happy with it being unknowable which of your appliances are compromised or not? Would you pay $1 more for a disk drive with firmware in ROM? I would. If you were running a banking system, would you pay extra for code in ROM that cannot be compromised?
  - TeMPOraL 10y ago
    You would. But you're not the market - 99.99% of other people, who don't even know what a "jumper" is, are the market. So your preferences don't matter. Yes, even in most technology products. As for IoT devices, I can't imagine average Joe or Jane prying off their smart whatever, destroying the pretty plastic casing it's hidden in, and manually setting jumpers to flash firmware.
    - WalterBright 10y ago
      Isn't it ironic that the means of updating firmware to prevent installation of malware is the vector for installing malware? I don't think the current scheme is working very well. Even worse, there is no way to tell if your appliance has been compromised or not. There are a lot of companies that care whether their machines are infected or not.
puddintane 10y ago
What happens when you can't update the IoT device then, reboot may remove the attacker but the IP will be the same (and even if it changes, probably wouldn't be long before the next address is scanned and put back into being a zombie) and they would be right back in if you can't update and patch the flaw that let them in. I think in all honesty the regulation sounds best, requiring the router makers to disable features such as UPNP would prevent massive attacks like these.
- madeofpalk 10y ago
  The Mirai botnet didn't write it's software into permanent storage on the hacked devices - it would be erased upon reboot. But then the device would be 'hacked' again within minutes of it coming back online.
  - petre 10y ago
    Then just modify the Mirai source to disable internet access and isolate the devices instead? It's already public.

necessity 10y ago

>Not at all the case with IoT Why? The rest of your comment doesn't address that. >See Bruce Schneier's recent article on the matter, where he makes the case that government regulation is the only feasible remedy at this point He also doesn't explain why. He literally writes: >>In fact, the software used to attack Krebs was simple and amateurish. What this attack demonstrates is that the economics of the IoT mean that it will remain insecure unless government steps in to fix the problem. This is a market failure that can't get fixed on its own. Why does it demonstrate that? "Neither the seller nor the buyer care" can also be applied to traditional botnets using computers - if the botnet is clever enough to not make any noise. He "justifies" the "sellers don't care" part with: >>they're now selling newer and better models, and the original buyers only cared about price and features. ... again the same for smartphones or laptops. And furthermore, what regulation he proposes to solve this? I mean, he presents the issue as being: >>The security of our computers and phones also comes from the fact that we replace them regularly. We buy new laptops every few years. We get new phones even more frequently. This isn't true for all of the embedded IoT systems. They last for years, even decades. We might buy a new DVR every five or ten years. We replace our refrigerator every 25 years. We replace our thermostat approximately never. Would he suggest that the companies selling these devices be obliged to push security patches? The same companies that he wrote could not even afford testing?: >>Companies like Microsoft, Apple, and Google spend a lot of time testing their code before it's released, and quickly patch vulnerabilities when they're discovered. Those companies can support such teams because those companies make a huge amount of money, either directly or indirectly, from their software -- and, in part, compete on its security. This isn't true of embedded systems like digital video recorders or home routers. ... I have read "government is the only solution" at least 6 times in that short article, without exaggeration. Looks a lot like fearmongering and propaganda to me.

xenadu02 10y ago
>> In fact, the software used to attack Krebs was simple and amateurish. What this attack demonstrates is that the economics of the IoT mean that it will remain insecure unless government steps in to fix the problem. This is a market failure that can't get fixed on its own. > Why does it demonstrate that? "Neither the seller nor the buyer care" can also be applied to traditional botnets using computers - if the botnet is clever enough to not make any noise. He "justifies" the "sellers don't care" part with: Not really. When a desktop PC is compromised sometimes it is noticed because eventually malware comes along that bricks the system, installs ransomware, or otherwise discloses itself. But the sad truth is that a lot of compromised desktop PCs aren't noticed which is why there are millions used in botnets right now. Microsoft decided to take it seriously and pushed automatic updates, adopted secure coding standards, etc. It took a decade to make a good dent in the problem and it still isn't completely resolved. >>they're now selling newer and better models, and the original buyers only cared about price and features. >... again the same for smartphones or laptops. And furthermore, what regulation he proposes to solve this? I mean, he presents the issue as being: >>The security of our computers and phones also comes from the fact that we replace them regularly. We buy new laptops every few years. We get new phones even more frequently. This isn't true for all of the embedded IoT systems. They last for years, even decades. We might buy a new DVR every five or ten years. We replace our refrigerator every 25 years. We replace our thermostat approximately never. >Would he suggest that the companies selling these devices be obliged to push security patches? The same companies that he wrote could not even afford testing?: If all manufacturers have to meet certain standards then no one can undercut anyone else by skipping out. You can save some money by not including various safety features but then you can't sell those devices to over half the world so what's the point? If it is all voluntary you have busy consumers who don't have the requisite background knowledge (nor the time) to learn the details of software security, nor audit the code for secure coding standards and that's assuming the code was even available. If you want to make the claim that every human being should be an expert at evaluating such claims that's a massive inefficiency. Really that's the primary problem with libertarian ideas in general: it introduces massive inefficiencies in the market. Not everyone can be an expert in chemistry, software, mechanical design, food safety, et al simultaneously. (Not to mention needing perfect and instantaneous information). Claiming that lawsuits will fix everything after-the-fact ignores the real human cost, the lost potential of the ruined lives, and doesn't work unless you completely eliminate the corporate veil and make everyone personally liable. Otherwise every company will just be incorporated with various shells to ensure you can't actually recover anything. That goes on today - get sued? File bankruptcy and re-incorporate under a new name. You don't even need to move the factory because the seller was just leasing it from your shell incorporated in the Bahamas. >>Companies like Microsoft, Apple, and Google spend a lot of time testing their code before it's released, and quickly patch vulnerabilities when they're discovered. Those companies can support such teams because those companies make a huge amount of money, either directly or indirectly, from their software -- and, in part, compete on its security. This isn't true of embedded systems like digital video recorders or home routers. ... >I have read "government is the only solution" at least 6 times in that short article, without exaggeration. Looks a lot like fearmongering and propaganda to me. Did you just not get on the internet this Friday or what? It isn't fear mongering, we're living in a world right now where there are millions of cheaply made IoT devices with hard-coded telnet ports wide-open. They can't ever be fixed because they weren't made with any ability to update the firmware. Their owners don't even know they are infected. What mechanism are you proposing to magically make the manufacturers or consumers a) give a shit and b) gain the capability to evaluate products on a security basis? This is a classic tragedy of the commons situation. Each individual makes a rational decision for themselves (saving money) but it results in a massively bad outcome for the whole world.

deleted 10y ago

[deleted]