3 ms·
There should be a carrot and a stick solution with a regulated baseline of security (such as "don't use hardcoded passwords, dummy!"). Carrot: labeling/rating
by mtgx 10y ago
There should be a carrot and a stick solution with a regulated baseline of security (such as "don't use hardcoded passwords, dummy!").
Carrot: labeling/rating system ("our IoT device is A+ security rated, best in class!")
Stick: Devices found part of a botnet and/or DDoS attack are taken offline permanently until cleaned, and/or recall mandated by the governments.
That ought to be enough to improve IoT devices security by about two orders of magnitude from what it is now.
The nice thing about such regulations is that now manufacturers don't have to race to the bottom on costs by not increasing their devices' security and updating them. Because they could win more sales through good rating systems or they could lose much more money through recalls, being shut off from the Internet, and therefore potentially losing customers permanently, and so on.
I'm a believer in "free markets with good baseline standards" for competition, fairness, consumer protection, etc.
I'm not entirely sure how support for updates should be handled, but I think it should be mandated that until at least 80% of your customers stopped using your product, then you are still liable for updating all of them.
So, for instance, if 30% of your customers still use your "smart fridge" 10 years later, then you should still send security updates to it (within 3 months of bug discovery). If after 12 years, only 19% of your customers still use it, then you can stop updating it.
Even then, I worry that 20% of IoT devices could mean potentially billions of devices 15 years from now. And they could still be used by botnets. But hopefully by then the Internet would also be a lot more resilient to DDoS attacks (perhaps by decentralizing it more) and a couple billion IoT devices embedded everywhere into our cities won't represent that much potential DDoS firepower.
EDIT: Whatever made you think this was "voluntary" of Hangzhou Xiongmai? The FBI and likely the DHS and the NSA were investigating this issue. They probably at the very least felt some pressure from them to do this recall. After all, the U.S. government has often been quite decisive on banning Chinese companies from selling in the U.S. because of "national security reasons", so it doesn't seem unlikely that this company feared the same could happen now, too. From that perspective a recall seems cheap.
- _joel 10y agoJust because a device is deemed to be 'secure' one day, doesn't mean there aren't hidden vulnerabilities and therefore in the future it will be deemed as 'insecure'. How would you manage that after the hardware has shipped and is on the shelves? It gives a false impression of security if you simplify it to a sticker on a box. Plus it's not exactly hard for a device to put a false label or counterfeit in some way. All hardware should follow basic security principles, it shouldn't be something you can grade on. If there's been an issue then the company should be rightly called out, which seems to have happened in this case.
- zeta0134 10y agoI think that one of the baseline requirements for an internet connected device to be considered fully secure is automatic patching by the manufacturer, with a signature verification system for the patches. If a vulnerability is found, this allows the manufacturer to patch it out of shipped devices before it can be exploited, reducing the attack surface considerably. This isn't perfect (especially if the signature mechanism itself can be exploited; hello attacker-patchable devices) but it's a start.
- nitrogen 10y agoOne problem is that manufacturer-controlled updates are at odds with consumer ownership of software and hardware. The demands of privacy advocates are almost diametrically opposed to the concept of automatic pushed updates. There have been plenty of examples where manufacturer updates have made devices worse in some way.
- probablybanned 10y agoI already see your comment turning gray for daring to suggest a role for regulation here. Sorry people, if your company releases a negligently insecure IoT device into the world in any sort of quantity, you are a polluter.
- bsilvereagle 10y agoTo play devil's advocate a bit - if Best Buy sold a Windows 7 laptop that didn't have auto-update turned on by default, and the system gets hacked 3-4 years later from lack of patching, did Best Buy release a negligently insecure IoT device? Did Microsoft release a negligently insecure IoT device by not forcing auto-updates by default? Should users truly own their IoT products and have the ability to turn off auto-updates? This is a very thorny problem.
- probablybanned 10y agoIt depends on the definition of negligence, of course. Sometimes you take all appropriate precautions and still get screwed -- OK. We have a situation where companies are releasing products that every competent professional would recognize as a security trainwreck, and it happens with complete regularity, because the incentives simply do not currently align to make corporate executives give a damn. Due to externalized costs that impact more or less the entire population, this is now a political issue. It's exactly as thorny as environmental regulation, or public safety regulation. Should users truly own their cars and have the ability to disable safety features? I think so, but it shouldn't just be a button on the dash. Should they be able to disable emissions features? I'm not trying to oversimplify here, but I also don't think we should allow the perfect to be the enemy of the good. If there were real incentives to produce secure products, we could expect to see much more investment in secure software, perhaps even verifiable formal methods, and hopefully more industry collaboration/standardization around open source platforms to mitigate risk. It's a tradeoff, but I so often see front-line engineers faced with situations where acting responsibly/ethically with respect to security puts them at odds with management, and that's a clear sign that we're not getting the balance right.
- deleted 10y ago[deleted]
- ben_jones 10y agoAlthough I agree with the general ethos of what you're saying, rating systems have done rather poorly in Capitalistic societies int he last ten years. The BBB and everything on Wall street come to mind.