5 ms·
Underwriter's Laboratories should start including basic security hardening in their tests.
by phonon 10y ago
Underwriter's Laboratories should start including basic security hardening in their tests.
- pjc50 10y agoVulnerabilities can be surprisingly hard to find: http://mjg59.dreamwidth.org/45098.html http://mjg59.dreamwidth.org/45098.html (Matthew is an absolute expert at breaking into cheap IoT devices)
- criddell 10y agoThey should be hard to find. Basic UL testing could establish that the most common problems are at least tested for.
- hash-set 10y agoI the small electronics market, price is everything. Thus any compliance that raises costs is likely to be routed around, especially by Chinese companies. Do most products coming from China even get UL listed?
- blueatlas 10y agoBut with this particular vulnerability, e.g. weak passwords and no way to reset it, I would think that UL could in fact test for this and fail the device. I like the idea of UL testing for at least basic security vulnerabilities.
- SolarNet 10y agoI think you mean testing for basic security best practices. Testing for vulnerabilities is the hard part, but having good practices is easier to test (e.g. is it a vulnerability or a feature it can't reset?).
- phonon 10y agoI wouldn't make the perfect the enemy of the good. It could start off with just a checklist of common vulnerability types and go from there. The root cause of these issues is that no one cared about them at all. Just the idea that a certifying agency you are going through anyway will be checking would help enormously.
- zaroth 10y agoI mean just a couple days ago on the front page we read about a Paypal multifactor bypass by.... Wait for it... Deleting the token field from the post request. Vulnerabilities are often trivial in hindsight and lost in a massive forest up until the moment they are serendipitously discovered. I'm not saying a proper audit shouldn't have found this and flagged it. But yes, agree strongly, vulnerabilities can be surprisingly hard to find.
- davidkhess 10y agoI completely agree with his sentiment. While it certainly won't catch all vulnerabilities, it should at least catch the more obvious and easily exploitable ones. And it concentrates the skills required in an entity that has a business model that can sustain it. I see it as analogous to FCC certification of RF related equipment.
- kefka 10y agoThe logical answer to this, which is what we're seeing in the US, is to tie every device to the corporate backend servers. This does a few things. 1. Secures endpoints down 2. Chains users to company 3. Makes cloners hard to copy product, given server based logic Hell, Google and Microsoft can't even bother to keep up products or their DRM up for any length of time. But again, users are willing to rent chained devices like the Nest.
- hash-set 10y agoThat's not going to work--we just had the discovery of a major vulnerability in Linux that has been around for years but got patched last week! It is what it is.
- audeyisaacs 10y agoRegulating IoT is going to be impossible when tiny little devices can be shipped undeclared. Even if it could be policed effectively it would destroy the economics of some of these cheaper devices. Instead, how about ISP supplied modems/routers have sensible defaults(and have the admin password reset)? Much more cost effective.