7 ms·

Forgive me if I overlooked it in the article, but if this recall is being conducted at Hangzhou Xiongmai's own initiative, it should be applauded. No doubt it'l

by piker 10y ago

Forgive me if I overlooked it in the article, but if this recall is being conducted at Hangzhou Xiongmai's own initiative, it should be applauded. No doubt it'll be expensive to fix these up, and it's not clear that the organization has any real liability for the security faults. People are suggesting that we should "name and shame", and I somewhat agree, but I think we should also applaud efforts of those who are taking the expensive steps of fixing the problem with no direct incentive to do so. Because the DDOS's costs are borne externally to the consumer, consumers can't really be counted on to mandate security fixes. On the other hand, establishing liability for a company adding to a preexisting botnet through security faults seems tenuous. One solution seems to be regulation (self or third-party), and it's exciting to see a manufacturer take this issue seriously and start us down the path of self-policing. [edit: for clarity]

drzaiusapelord 10y ago
>but if this recall is being conducted at Hangzhou Xiongmai's own initiative I imagine there were a lot of angry calls from Washington and Beijing over this. I don't think companies are magnanimous like this without external pressure. >but I think we should also applaud efforts of those who are taking the expensive steps of fixing the problem with no direct incentive to do so. Applaud what exactly? That all these companies ship devices that happily take IP addresses and go on the public internet or punch through firewalls with upnp and do not force a first-time password change and do not have an auto-updater installed? Even the cheapest Netgear comes with a sticker on the side for a semi-random password instead of shipping everything with 'admin/password.' Or using antiquated and non-encrypted transports like telnet. These 1990's habits need to die and it won't happen because of corporate good graces, because those haven't worked historically. If it happens, it'll happen via external pressure via governments and lawsuits. Market forces are rarely a fix all here.
- CountSessine 10y ago
  I imagine there were a lot of angry calls from Washington and Beijing over this. I don't think companies are magnanimous like this without external pressure. No one in Washington or Beijing with diplomatic credentials and contact with the other side even knows what DNS is or that there was an attack on Friday. A lot of Chinese companies are both privately owned and awash in money, and that gives them the latitude to behave in ways that aren't strictly about achieving maximum Pareto efficiency. These guys are doing the right thing. Please don't try to minimize that.
  - drzaiusapelord 10y ago
    >No one in Washington or Beijing with diplomatic credentials and contact with the other side even knows what DNS is or that there was an attack on Friday. They have advisors that sure as hell know exactly what is going on here. This is a very naive view of how government works. Diplomates don't need to know what code is to make policy. Chinese bureaucrats certainly know that pissing off their biggest trade and manufacturing partner isn't good for their economy. This was a very high-profile attack. Pretty much every intelligence agency in the world has notified their higher-ups on what likely happened and the hammer most definitely fell on this company. Chinese businesses aren't exactly known for their good corporate personas and generosity. See baby and dog poisonings and desperate reactions by the government like executing executives. On top of the everyday IP infringements and other cavalier attitudes towards international business norms.
    - CountSessine 10y ago
      They have advisors that sure as hell know exactly what is going on here. This is a very naive view of how government works. Diplomates don't need to know what code is to make policy. Are you speculating? Do you work in the diplomatic corps? I get the opposite impression given what I've read in wikileaks releases. This was a very high-profile attack. Pretty much every intelligence agency in the world has notified their higher-ups on what likely happened and the hammer most definitely fell on this company. Assuming for the moment that there is any communication made at all regarding this incident, do you really think the Chinese government is going to pressure some small Chinese business to lose a whole bunch of money unnecessarily because an American anarchist group attacked some American websites with said Chinese company's webcams? Nobody cares. Chinese businesses aren't exactly known for their good corporate personas and generosity. What an awful generalization.
      - smallnamespace 10y ago
        > Assuming for the moment that there is any communication made at all regarding this incident, do you really think the Chinese government is going to pressure some small Chinese business to lose a whole bunch of money unnecessarily because an American anarchist group attacked some American websites with said Chinese company's webcams? What about naked self-interest? Those webcams are vulnerable and can be used to attack any infrastructure, including China's own.
mtgx 10y ago
There should be a carrot and a stick solution with a regulated baseline of security (such as "don't use hardcoded passwords, dummy!"). Carrot: labeling/rating system ("our IoT device is A+ security rated, best in class!") Stick: Devices found part of a botnet and/or DDoS attack are taken offline permanently until cleaned, and/or recall mandated by the governments. That ought to be enough to improve IoT devices security by about two orders of magnitude from what it is now. The nice thing about such regulations is that now manufacturers don't have to race to the bottom on costs by not increasing their devices' security and updating them. Because they could win more sales through good rating systems or they could lose much more money through recalls, being shut off from the Internet, and therefore potentially losing customers permanently, and so on. I'm a believer in "free markets with good baseline standards" for competition, fairness, consumer protection, etc. I'm not entirely sure how support for updates should be handled, but I think it should be mandated that until at least 80% of your customers stopped using your product, then you are still liable for updating all of them. So, for instance, if 30% of your customers still use your "smart fridge" 10 years later, then you should still send security updates to it (within 3 months of bug discovery). If after 12 years, only 19% of your customers still use it, then you can stop updating it. Even then, I worry that 20% of IoT devices could mean potentially billions of devices 15 years from now. And they could still be used by botnets. But hopefully by then the Internet would also be a lot more resilient to DDoS attacks (perhaps by decentralizing it more) and a couple billion IoT devices embedded everywhere into our cities won't represent that much potential DDoS firepower. EDIT: Whatever made you think this was "voluntary" of Hangzhou Xiongmai? The FBI and likely the DHS and the NSA were investigating this issue. They probably at the very least felt some pressure from them to do this recall. After all, the U.S. government has often been quite decisive on banning Chinese companies from selling in the U.S. because of "national security reasons", so it doesn't seem unlikely that this company feared the same could happen now, too. From that perspective a recall seems cheap.
- _joel 10y ago
  Just because a device is deemed to be 'secure' one day, doesn't mean there aren't hidden vulnerabilities and therefore in the future it will be deemed as 'insecure'. How would you manage that after the hardware has shipped and is on the shelves? It gives a false impression of security if you simplify it to a sticker on a box. Plus it's not exactly hard for a device to put a false label or counterfeit in some way. All hardware should follow basic security principles, it shouldn't be something you can grade on. If there's been an issue then the company should be rightly called out, which seems to have happened in this case.
adrianratnapala 10y ago
I join you in applauding Hangzhou Xiongmai in doing the recall. Still, I think liability (for either users or manufacurers) is the right answer. If your device is participating in a DDOS, then it is a bad actor and you should pay for that. As for regulation, I am in favor of the right regulations (which I suspect will be rules about liability). The danger is that we end up with rules forcing particular engineering methods and security certifications. That will benefit the incumbent companies who already used the official methods, without necessarily improving the software. In fact it would create "standing targets" that will benefit attackers.
- joe_the_user 10y ago
  The definitely the right regulation but I think regulation is going to be needed. The simplest thing is forcing devices to generate unique random passwords when connected. After-the-fact liability can't stop a million small users from buying off-brand merchandise and can't stop off-brand merchandise makers from functioning - especially if quality manufacturers add a premium for the liability they face.
  - socmag 10y ago
    Zero regulation is required. That's the whole point of the Internet. It is the responsibility of the IETF and the infrastructure manufacturers. There is absolutely no way to control the actions of individual devices, nor should there be. The liability lies with the network itself. Period.
- goalieca 10y ago
  If we look at nist guidelines for cryptography then it's fairly stable but really well designed. The official fips and cc certification process takes a lot of time and money.
- deleted 10y ago
  [deleted]
- thomasahle 10y ago
  > If your device is participating in a DDOS, then it is a bad actor and you should pay for that. I wonder how that would play into the debate on gun manufacturers being responsible for people shot and car manufacturers for people run over. It's hard to find a good way to do make a law about this, that doesn't end up taking ownership away from the owners.
omegaworks 10y ago
> it's not clear that the organization has any real liability for the security faults. If everyone is allowed to point the finger at everyone else, nothing will get fixed. This organization profited from the sale of opaque, unserviceable devices with known flaws. Anyone with a basic understanding of the internet knows a default password is an accident waiting to happen. When will we consider this an unacceptable product defect and mandate that manufacturers be responsible for implementing fixes? That's the only way we'll see sustained investment in open, vetted architectures and push back against security corner cutting for business reasons.
- djsumdog 10y ago
  What about all the open source products out there with default passwords? Most distributions with ARM ports (Arch Linux Arm, Bananapian, etc.) have default passwords. At least Openwrt doesn't (it allows one-time telnet access to set a password, then disabled telnet and enables SSH), but should other oss devs be liable for this bad practice? You might be like, "Well hobbies have to install those images on their hardware." Well what if those projects sold hardware on the side to raise funds? Or a 3rd party sold hardware+software bundles? Who in the chain is liable?
  - angry-hacker 10y ago
    Also the default goto distro raspberry pi had at least few years ago. Who would then be responsible?
  - omegaworks 10y ago
    > "This organization profited from the sale of..." Usually not the case for OSS projects.
ComodoHacker 10y ago
I can applaud only to a smart PR move here. I can't imagine even one hundred people recognize vendor name on their cameras, let alone bother to return them overseas to China. (The article didn't mention where they were sold but I assume overseas). Devices of this vendor constitutes a tiny portion of the whole botnet. So this recall can't really change anything, but vendor's name hits the media.
lsc 10y ago
Is the manufacturer dealing directly with the customers? If so, I imagine that direct contact(assuming the things were re branded) is probably worth more in advertising than the recall will cost them. Hell, I am going to consider that company positively, next time I buy a device in that price range. As for liability, I don't know about fairness, but I think that the isp is really the only entity prepared to deal with this sort of thing on a timely basis. All service providers know the"fix your shit out we un plug you " drill. It flows in both directions, too. Generally speaking, the more you pay, the more warnings and hand holding you get. But the point is that the isp is the first responder here; nobody else is in a position to stop an attack in progress. Of course, if you make the isp legally liable, fairness aside, internet access will cost rather more.

by piker 10y ago

drzaiusapelord 10y ago

>but if this recall is being conducted at Hangzhou Xiongmai's own initiative I imagine there were a lot of angry calls from Washington and Beijing over this. I don't think companies are magnanimous like this without external pressure. >but I think we should also applaud efforts of those who are taking the expensive steps of fixing the problem with no direct incentive to do so. Applaud what exactly? That all these companies ship devices that happily take IP addresses and go on the public internet or punch through firewalls with upnp and do not force a first-time password change and do not have an auto-updater installed? Even the cheapest Netgear comes with a sticker on the side for a semi-random password instead of shipping everything with 'admin/password.' Or using antiquated and non-encrypted transports like telnet. These 1990's habits need to die and it won't happen because of corporate good graces, because those haven't worked historically. If it happens, it'll happen via external pressure via governments and lawsuits. Market forces are rarely a fix all here.

CountSessine 10y ago
I imagine there were a lot of angry calls from Washington and Beijing over this. I don't think companies are magnanimous like this without external pressure. No one in Washington or Beijing with diplomatic credentials and contact with the other side even knows what DNS is or that there was an attack on Friday. A lot of Chinese companies are both privately owned and awash in money, and that gives them the latitude to behave in ways that aren't strictly about achieving maximum Pareto efficiency. These guys are doing the right thing. Please don't try to minimize that.
- drzaiusapelord 10y ago
  >No one in Washington or Beijing with diplomatic credentials and contact with the other side even knows what DNS is or that there was an attack on Friday. They have advisors that sure as hell know exactly what is going on here. This is a very naive view of how government works. Diplomates don't need to know what code is to make policy. Chinese bureaucrats certainly know that pissing off their biggest trade and manufacturing partner isn't good for their economy. This was a very high-profile attack. Pretty much every intelligence agency in the world has notified their higher-ups on what likely happened and the hammer most definitely fell on this company. Chinese businesses aren't exactly known for their good corporate personas and generosity. See baby and dog poisonings and desperate reactions by the government like executing executives. On top of the everyday IP infringements and other cavalier attitudes towards international business norms.
  - CountSessine 10y ago
    They have advisors that sure as hell know exactly what is going on here. This is a very naive view of how government works. Diplomates don't need to know what code is to make policy. Are you speculating? Do you work in the diplomatic corps? I get the opposite impression given what I've read in wikileaks releases. This was a very high-profile attack. Pretty much every intelligence agency in the world has notified their higher-ups on what likely happened and the hammer most definitely fell on this company. Assuming for the moment that there is any communication made at all regarding this incident, do you really think the Chinese government is going to pressure some small Chinese business to lose a whole bunch of money unnecessarily because an American anarchist group attacked some American websites with said Chinese company's webcams? Nobody cares. Chinese businesses aren't exactly known for their good corporate personas and generosity. What an awful generalization.
    - smallnamespace 10y ago
      > Assuming for the moment that there is any communication made at all regarding this incident, do you really think the Chinese government is going to pressure some small Chinese business to lose a whole bunch of money unnecessarily because an American anarchist group attacked some American websites with said Chinese company's webcams? What about naked self-interest? Those webcams are vulnerable and can be used to attack any infrastructure, including China's own.

mtgx 10y ago

There should be a carrot and a stick solution with a regulated baseline of security (such as "don't use hardcoded passwords, dummy!"). Carrot: labeling/rating system ("our IoT device is A+ security rated, best in class!") Stick: Devices found part of a botnet and/or DDoS attack are taken offline permanently until cleaned, and/or recall mandated by the governments. That ought to be enough to improve IoT devices security by about two orders of magnitude from what it is now. The nice thing about such regulations is that now manufacturers don't have to race to the bottom on costs by not increasing their devices' security and updating them. Because they could win more sales through good rating systems or they could lose much more money through recalls, being shut off from the Internet, and therefore potentially losing customers permanently, and so on. I'm a believer in "free markets with good baseline standards" for competition, fairness, consumer protection, etc. I'm not entirely sure how support for updates should be handled, but I think it should be mandated that until at least 80% of your customers stopped using your product, then you are still liable for updating all of them. So, for instance, if 30% of your customers still use your "smart fridge" 10 years later, then you should still send security updates to it (within 3 months of bug discovery). If after 12 years, only 19% of your customers still use it, then you can stop updating it. Even then, I worry that 20% of IoT devices could mean potentially billions of devices 15 years from now. And they could still be used by botnets. But hopefully by then the Internet would also be a lot more resilient to DDoS attacks (perhaps by decentralizing it more) and a couple billion IoT devices embedded everywhere into our cities won't represent that much potential DDoS firepower. EDIT: Whatever made you think this was "voluntary" of Hangzhou Xiongmai? The FBI and likely the DHS and the NSA were investigating this issue. They probably at the very least felt some pressure from them to do this recall. After all, the U.S. government has often been quite decisive on banning Chinese companies from selling in the U.S. because of "national security reasons", so it doesn't seem unlikely that this company feared the same could happen now, too. From that perspective a recall seems cheap.

_joel 10y ago
Just because a device is deemed to be 'secure' one day, doesn't mean there aren't hidden vulnerabilities and therefore in the future it will be deemed as 'insecure'. How would you manage that after the hardware has shipped and is on the shelves? It gives a false impression of security if you simplify it to a sticker on a box. Plus it's not exactly hard for a device to put a false label or counterfeit in some way. All hardware should follow basic security principles, it shouldn't be something you can grade on. If there's been an issue then the company should be rightly called out, which seems to have happened in this case.

adrianratnapala 10y ago

I join you in applauding Hangzhou Xiongmai in doing the recall. Still, I think liability (for either users or manufacurers) is the right answer. If your device is participating in a DDOS, then it is a bad actor and you should pay for that. As for regulation, I am in favor of the right regulations (which I suspect will be rules about liability). The danger is that we end up with rules forcing particular engineering methods and security certifications. That will benefit the incumbent companies who already used the official methods, without necessarily improving the software. In fact it would create "standing targets" that will benefit attackers.

joe_the_user 10y ago
The definitely the right regulation but I think regulation is going to be needed. The simplest thing is forcing devices to generate unique random passwords when connected. After-the-fact liability can't stop a million small users from buying off-brand merchandise and can't stop off-brand merchandise makers from functioning - especially if quality manufacturers add a premium for the liability they face.
- socmag 10y ago
  Zero regulation is required. That's the whole point of the Internet. It is the responsibility of the IETF and the infrastructure manufacturers. There is absolutely no way to control the actions of individual devices, nor should there be. The liability lies with the network itself. Period.
goalieca 10y ago
If we look at nist guidelines for cryptography then it's fairly stable but really well designed. The official fips and cc certification process takes a lot of time and money.
deleted 10y ago
[deleted]
thomasahle 10y ago
> If your device is participating in a DDOS, then it is a bad actor and you should pay for that. I wonder how that would play into the debate on gun manufacturers being responsible for people shot and car manufacturers for people run over. It's hard to find a good way to do make a law about this, that doesn't end up taking ownership away from the owners.

omegaworks 10y ago

> it's not clear that the organization has any real liability for the security faults. If everyone is allowed to point the finger at everyone else, nothing will get fixed. This organization profited from the sale of opaque, unserviceable devices with known flaws. Anyone with a basic understanding of the internet knows a default password is an accident waiting to happen. When will we consider this an unacceptable product defect and mandate that manufacturers be responsible for implementing fixes? That's the only way we'll see sustained investment in open, vetted architectures and push back against security corner cutting for business reasons.

djsumdog 10y ago
What about all the open source products out there with default passwords? Most distributions with ARM ports (Arch Linux Arm, Bananapian, etc.) have default passwords. At least Openwrt doesn't (it allows one-time telnet access to set a password, then disabled telnet and enables SSH), but should other oss devs be liable for this bad practice? You might be like, "Well hobbies have to install those images on their hardware." Well what if those projects sold hardware on the side to raise funds? Or a 3rd party sold hardware+software bundles? Who in the chain is liable?
- angry-hacker 10y ago
  Also the default goto distro raspberry pi had at least few years ago. Who would then be responsible?
- omegaworks 10y ago
  > "This organization profited from the sale of..." Usually not the case for OSS projects.

ComodoHacker 10y ago

I can applaud only to a smart PR move here. I can't imagine even one hundred people recognize vendor name on their cameras, let alone bother to return them overseas to China. (The article didn't mention where they were sold but I assume overseas). Devices of this vendor constitutes a tiny portion of the whole botnet. So this recall can't really change anything, but vendor's name hits the media.

lsc 10y ago

Is the manufacturer dealing directly with the customers? If so, I imagine that direct contact(assuming the things were re branded) is probably worth more in advertising than the recall will cost them. Hell, I am going to consider that company positively, next time I buy a device in that price range. As for liability, I don't know about fairness, but I think that the isp is really the only entity prepared to deal with this sort of thing on a timely basis. All service providers know the"fix your shit out we un plug you " drill. It flows in both directions, too. Generally speaking, the more you pay, the more warnings and hand holding you get. But the point is that the isp is the first responder here; nobody else is in a position to stop an attack in progress. Of course, if you make the isp legally liable, fairness aside, internet access will cost rather more.