5 ms·

The article is taking a rather lack stance against manufacturers with words like "ability" and "interest": > The IoT is expanding faster than device makers’ in

The article is taking a rather lack stance against manufacturers with words like "ability" and "interest": > The IoT is expanding faster than device makers’ interest in cybersecurity This is just pure bullshit. It has nothing to do with 'expanding' or 'interest' or 'ability'. This type of security has nothing to do with the scale at which it has it deing deployed or growing. The fact of the matter is that manufacturers are too cheap to provide decent security. This is a profit problem. And dancing around the issue by the media is just weak-ass journalism. The solution is simple: The government holds them accountable for creating shoddy products. The companies creating these products pay for the damages done. It's really this simple. Unfortunately, the U.S seems to have this completely unhealthy obsession with keeping the government impotent and companies powerful at the expense of the people. And not just the american people, but the entire world. Baiscally the only hope we have at this point is the European Union.

jasonkostempski 10y ago
The solution is simpler and doesn't involve giving more power to idiots: don't buy shit.
- vkou 10y ago
  I didn't buy any Internet of Shit products. Unfortunately, my neighbour did, and now his toaster is used as part of a DDOS attack against a critical piece of internet infrastructure. How does your solution help?
  - jjawssd 10y ago
    This is an amazing problem. There is simply no solution because most people don't care!
    - TeMPOraL 10y ago
      There is a solution, and it's called "government" and "law". No, really. We've been dealing with people who don't care from the very dawn of civilization. There's a reason societies always end up creating governments and regulations, and it's precisely that reason.
  - subway 10y ago
    I dont think there is a legal solution. The pragmatic solution is to own, then secure or disable your neighbor's insecure toaster.
  - paulddraper 10y ago
    Distribute your critical piece of infrastructure, blacklist IP addresses, etc.
  - icebraining 10y ago
    Well, the owner of the Internet infrastructure could sue your neighbor. They'd learn to pay attention to that pretty quickly!
    - vkou 10y ago
      And they could sue the manufacturer, for selling them a device not fit for use? Exactly how much would each party sue the other for? The damage only takes place in aggregate, when hundreds of thousands of devices become part of a botnet. Or, how about instead of drowning in lawsuit chains over pennies, we establish some basic rules about how commercial devices connected to the internet are allowed to behave. That's how this problem is solved by every other industry that manufactures devices that are dangerous when used correctly. Software isn't a special snowflake.
      - icebraining 10y ago
        The proposal was mostly tongue-in-cheek. That said, I'm not sure the problem is solved in other industries - there's been plenty of unsafe electrical devices being sold to western markets, for example. It's just hard to police this stuff.
  - ams6110 10y ago
    Fine your neighbor, just as if he drove a shit unsafe car on the public roads and caused damage.
    - vkou 10y ago
      If the car was unsafe by design, the manufacturer would be fined.
- user5994461 10y ago
  That's a viable solution. Except that it relies on an implicit: The end user must be able to identify the shit devices. We could help that right away, by bricking all the vulnerable IoT devices. The media will then inform of what manufacturers and models were affected :D
- TeMPOraL 10y ago
  This solution depends on people following it voluntarily, which means it's a bad solution because people don't work like that at scale. Want to coordinate people? You need to change incentives - either encourage them to not buy shit, or discourage them from buying it. The way it's usually done is by fining people selling shit, fining people using shit to do damage, and fining people creating shit so that shit doesn't get created. Ergo, government solution. It should work for IoT just like it works for every appliance you use at home that could technically burn your house down, but somehow it doesn't.
zzzcpan 10y ago
There is no solution where the government is involved. The world is not that place yet, where some government can hold any company in any country accountable for something. Still, don't worry about it, global ISP market is huge and very competitive, it's in their best interest to solve the problem, once it becomes one. We've been there before with "big and scary" ddoses from five years ago.
CountSessine 10y ago
The solution is simple: The government holds them accountable for creating shoddy products. The companies creating these products pay for the damages done. It's really this simple. Which government? The US government, which is the representative body for the affected victims? The Chinese government, which is the representative body for the manufacturer? The different governments of the countries where the actual devices were in use and where the actual traffic came from? Right now it's considered a tour-de-force of international cooperation when police agencies from two different countries can cooperate enough to arrest scammers who were pretending to be IRS agents over the phone and were doing real damage to peoples' lives. (http://arstechnica.com/tech-policy/2016/10/cops-arrest-hundreds-of-people-allegedly-involved-in-irs-phone-scam/ http://arstechnica.com/tech-policy/2016/10/cops-arrest-hundr...) Unfortunately, the U.S seems to have this completely unhealthy obsession with keeping the government impotent and companies powerful at the expense of the people. And not just the american people, but the entire world. Americans understand that even well-intentioned laws and regulations can ultimately be used against citizens and consumers through regulatory-capture. These are all rules being set by democratic states, yes, but dilution-of-interest is a real thing and very few people vote for a president or prime minister based on their telecommunications policy. I would rather the government just butts-out unless peoples' lives are at risk.
- TeMPOraL 10y ago
  > Which government? The US government, which is the representative body for the affected victims? The Chinese government, which is the representative body for the manufacturer? The different governments of the countries where the actual devices were in use and where the actual traffic came from? Do it the same way you handle contaminated food, appliances that cause fire and sales of illegal goods. Fine/jail the locals selling dangerous crap, and leverage international law to move against the people who manufacture it. There need to be safety and security standards developed, just as they are for almost everything else you buy.
  - CountSessine 10y ago
    Do it the same way you handle contaminated food, appliances that cause fire and sales of illegal goods. Fine/jail the locals selling dangerous crap Were any of these being sold in the US? and leverage international law to move against the people who manufacture it. International law really doesn't work the way you think it does. International law, that most diaphanous of concepts and most nebulous of efforts, is just barely effective enough to prevent the sale of materials used in the manufacture of nuclear weapons. $30 IoT routers that can be used to attack silicon valley internet companies isn't on anyone's radar. And what does move against mean? Fines? Jail time? How long will it take to convince anyone to agree to that? Would anyone even agree on a dollar figure for damages? What was damaged here? Was any equipment broken? Was anyone killed? There need to be safety and security standards developed, just as they are for almost everything else you buy This makes sense, but I think it's a long road. Safety standards are imposed and enforced at a national, not an international level, except to harmonize regulations (not unify enforcement!) in some cases. And packets don't respect national boundaries. I don't think regulation is tractable in this case. I think all we've got is technical solutions or 'internet governance', much like how everyone knows not to allow open mail servers on their networks anymore.
drvdevd 10y ago
Well, I think we need less regulation and more accessibility of the technology deployed in this space (e.g. fewer black boxes, more OSS). Regulation, no matter how stringent, can't change the fact that all software breaks eventually. Over regulation of the IoT market will tilt the game in favor of larger players and then leave us vulnerable to their SPOFs. See the recent shadow brokers leaks for some fine examples. [Edit] perhaps I should add that if any regulation is deployed in this space, its that an IoT device manufacturer must release their source in a publicly accessible manner... end users must be able to patch beyond the support lifetime.. etc.
- zigzigzag 10y ago
  > end users must be able to patch beyond the support lifetime That's the kind of thing that gives regulation a bad name. One of the worst ways an IoT device can get hacked is if it's reflashed with malicious firmware that then can't be reflashed back. You've got a permanent backdoor that requires trashing the device and a lot of users won't throw away a device that still works (for them) even if they know it's infected with something that causes problems (for someone else). That's real money. A simple way to fix that is locked bootloaders that only runs signed code. Then even if the running image gets hacked, a reboot fixes it and at least the device can't be irreversibly hacked. A regulation like the one you propose would presumably make signature-locked firmware illegal, or at best, require the checks to be disabled after a certain date (which then requires secure clocks: more stuff to go wrong). It's the sort of thing that sounds good but can cause more problems than it solves, which is the typical problem of regulation.
  - drvdevd 10y ago
    Very much agreed and good points all around. My proposal wasn't nearly as technically nuanced as such a proposal should be. I suppose I should fall back to my main argument which is that no such proposal can be at this point. Hence regulation will just be a source of burden on everyone involved, except those with deep enough pockets to use those regulations to turn a profit.
rogerbinns 10y ago
> The fact of the matter is that manufacturers are too cheap to provide decent security. Out of curiosity, imagine I decided to do a Linux based IOT device today. What liberally licensed reasonably mature security and updater framework would I use? I can find numerous competing communication frameworks, but nothing around doing updates or the higher level platform. It looks like this has to be re-invented by each IOT vendor, which is going to be a lot of work. Heck even just trying to do SSL on a LAN is very difficult - https://news.ycombinator.com/item?id=11956088 https://news.ycombinator.com/item?id=11956088

jasonkostempski 10y ago

The solution is simpler and doesn't involve giving more power to idiots: don't buy shit.

vkou 10y ago
I didn't buy any Internet of Shit products. Unfortunately, my neighbour did, and now his toaster is used as part of a DDOS attack against a critical piece of internet infrastructure. How does your solution help?
- jjawssd 10y ago
  This is an amazing problem. There is simply no solution because most people don't care!
  - TeMPOraL 10y ago
    There is a solution, and it's called "government" and "law". No, really. We've been dealing with people who don't care from the very dawn of civilization. There's a reason societies always end up creating governments and regulations, and it's precisely that reason.
- subway 10y ago
  I dont think there is a legal solution. The pragmatic solution is to own, then secure or disable your neighbor's insecure toaster.
- paulddraper 10y ago
  Distribute your critical piece of infrastructure, blacklist IP addresses, etc.
- icebraining 10y ago
  Well, the owner of the Internet infrastructure could sue your neighbor. They'd learn to pay attention to that pretty quickly!
  - vkou 10y ago
    And they could sue the manufacturer, for selling them a device not fit for use? Exactly how much would each party sue the other for? The damage only takes place in aggregate, when hundreds of thousands of devices become part of a botnet. Or, how about instead of drowning in lawsuit chains over pennies, we establish some basic rules about how commercial devices connected to the internet are allowed to behave. That's how this problem is solved by every other industry that manufactures devices that are dangerous when used correctly. Software isn't a special snowflake.
    - icebraining 10y ago
      The proposal was mostly tongue-in-cheek. That said, I'm not sure the problem is solved in other industries - there's been plenty of unsafe electrical devices being sold to western markets, for example. It's just hard to police this stuff.
- ams6110 10y ago
  Fine your neighbor, just as if he drove a shit unsafe car on the public roads and caused damage.
  - vkou 10y ago
    If the car was unsafe by design, the manufacturer would be fined.
user5994461 10y ago
That's a viable solution. Except that it relies on an implicit: The end user must be able to identify the shit devices. We could help that right away, by bricking all the vulnerable IoT devices. The media will then inform of what manufacturers and models were affected :D
TeMPOraL 10y ago
This solution depends on people following it voluntarily, which means it's a bad solution because people don't work like that at scale. Want to coordinate people? You need to change incentives - either encourage them to not buy shit, or discourage them from buying it. The way it's usually done is by fining people selling shit, fining people using shit to do damage, and fining people creating shit so that shit doesn't get created. Ergo, government solution. It should work for IoT just like it works for every appliance you use at home that could technically burn your house down, but somehow it doesn't.

zzzcpan 10y ago

There is no solution where the government is involved. The world is not that place yet, where some government can hold any company in any country accountable for something. Still, don't worry about it, global ISP market is huge and very competitive, it's in their best interest to solve the problem, once it becomes one. We've been there before with "big and scary" ddoses from five years ago.

CountSessine 10y ago

The solution is simple: The government holds them accountable for creating shoddy products. The companies creating these products pay for the damages done. It's really this simple. Which government? The US government, which is the representative body for the affected victims? The Chinese government, which is the representative body for the manufacturer? The different governments of the countries where the actual devices were in use and where the actual traffic came from? Right now it's considered a tour-de-force of international cooperation when police agencies from two different countries can cooperate enough to arrest scammers who were pretending to be IRS agents over the phone and were doing real damage to peoples' lives. (http://arstechnica.com/tech-policy/2016/10/cops-arrest-hundreds-of-people-allegedly-involved-in-irs-phone-scam/ http://arstechnica.com/tech-policy/2016/10/cops-arrest-hundr...) Unfortunately, the U.S seems to have this completely unhealthy obsession with keeping the government impotent and companies powerful at the expense of the people. And not just the american people, but the entire world. Americans understand that even well-intentioned laws and regulations can ultimately be used against citizens and consumers through regulatory-capture. These are all rules being set by democratic states, yes, but dilution-of-interest is a real thing and very few people vote for a president or prime minister based on their telecommunications policy. I would rather the government just butts-out unless peoples' lives are at risk.

TeMPOraL 10y ago
> Which government? The US government, which is the representative body for the affected victims? The Chinese government, which is the representative body for the manufacturer? The different governments of the countries where the actual devices were in use and where the actual traffic came from? Do it the same way you handle contaminated food, appliances that cause fire and sales of illegal goods. Fine/jail the locals selling dangerous crap, and leverage international law to move against the people who manufacture it. There need to be safety and security standards developed, just as they are for almost everything else you buy.
- CountSessine 10y ago
  Do it the same way you handle contaminated food, appliances that cause fire and sales of illegal goods. Fine/jail the locals selling dangerous crap Were any of these being sold in the US? and leverage international law to move against the people who manufacture it. International law really doesn't work the way you think it does. International law, that most diaphanous of concepts and most nebulous of efforts, is just barely effective enough to prevent the sale of materials used in the manufacture of nuclear weapons. $30 IoT routers that can be used to attack silicon valley internet companies isn't on anyone's radar. And what does move against mean? Fines? Jail time? How long will it take to convince anyone to agree to that? Would anyone even agree on a dollar figure for damages? What was damaged here? Was any equipment broken? Was anyone killed? There need to be safety and security standards developed, just as they are for almost everything else you buy This makes sense, but I think it's a long road. Safety standards are imposed and enforced at a national, not an international level, except to harmonize regulations (not unify enforcement!) in some cases. And packets don't respect national boundaries. I don't think regulation is tractable in this case. I think all we've got is technical solutions or 'internet governance', much like how everyone knows not to allow open mail servers on their networks anymore.

drvdevd 10y ago

Well, I think we need less regulation and more accessibility of the technology deployed in this space (e.g. fewer black boxes, more OSS). Regulation, no matter how stringent, can't change the fact that all software breaks eventually. Over regulation of the IoT market will tilt the game in favor of larger players and then leave us vulnerable to their SPOFs. See the recent shadow brokers leaks for some fine examples. [Edit] perhaps I should add that if any regulation is deployed in this space, its that an IoT device manufacturer must release their source in a publicly accessible manner... end users must be able to patch beyond the support lifetime.. etc.

zigzigzag 10y ago
> end users must be able to patch beyond the support lifetime That's the kind of thing that gives regulation a bad name. One of the worst ways an IoT device can get hacked is if it's reflashed with malicious firmware that then can't be reflashed back. You've got a permanent backdoor that requires trashing the device and a lot of users won't throw away a device that still works (for them) even if they know it's infected with something that causes problems (for someone else). That's real money. A simple way to fix that is locked bootloaders that only runs signed code. Then even if the running image gets hacked, a reboot fixes it and at least the device can't be irreversibly hacked. A regulation like the one you propose would presumably make signature-locked firmware illegal, or at best, require the checks to be disabled after a certain date (which then requires secure clocks: more stuff to go wrong). It's the sort of thing that sounds good but can cause more problems than it solves, which is the typical problem of regulation.
- drvdevd 10y ago
  Very much agreed and good points all around. My proposal wasn't nearly as technically nuanced as such a proposal should be. I suppose I should fall back to my main argument which is that no such proposal can be at this point. Hence regulation will just be a source of burden on everyone involved, except those with deep enough pockets to use those regulations to turn a profit.

rogerbinns 10y ago

> The fact of the matter is that manufacturers are too cheap to provide decent security. Out of curiosity, imagine I decided to do a Linux based IOT device today. What liberally licensed reasonably mature security and updater framework would I use? I can find numerous competing communication frameworks, but nothing around doing updates or the higher level platform. It looks like this has to be re-invented by each IOT vendor, which is going to be a lot of work. Heck even just trying to do SSL on a LAN is very difficult - https://news.ycombinator.com/item?id=11956088 https://news.ycombinator.com/item?id=11956088