4 ms·

How about a law that requires computerized devices to be shipped with unique passwords. That would be a start. Second, any computerized device must pass FTC/F

by MR4D 10y ago

How about a law that requires computerized devices to be shipped with unique passwords. That would be a start. Second, any computerized device must pass FTC/FCC/UL (pick one) tests for computer security before going on sale. There's more that can be done, but let's go after the simple stuff first.

swalsh 10y ago
Not sure that solves the problem either, perhaps UK has more stringent laws, or perhaps the US does. But if it's not universal a sufficiently large market can still be exploited to attack another. The internet is global. We need global regulations.
- usefulcat 10y ago
  If the US or EU did that, it would still be a very good start simply due to the size of those markets.
- jws 10y ago
  The law just needs to apply in a large enough region. Here in the US we got high efficiency switching wall warts instead of the slightly cheaper ones that idled away $4/yr because the EU demanded them, so manufacturers had to upgrade. Similar with lead free solder.
- MR4D 10y ago
  Agreed. Given consensus will take forever, I'd like to see the US or EU, somebody at lest, take the lead. Over time this will probably get worked into trade agreements anyway. But if we wait 10 years, it'll be too late, and we'll have killed the internet or given into draconian measures to stop the problem - which is what none of us want. Frankly, I don't even care if a given government has great security review - as long as they put a process in place it's a start that can be improved upon.
onion2k 10y ago
If you want to go after the simple stuff then blocking significant outbound traffic at the ISP level from a home user account until they agree it's something they want to do is the most straightforward solution. No need to change much infrastructure, no need to test devices, and no need to have costly manufacturing processes. You could even let specific traffic through (Facebook live streaming, online gaming services, etc).
- clarry 10y ago
  An attack can be quite effective even if the traffic from a single home is insignificant. I don't need ISPs to mess with my connection any more than they do already.
  - onion2k 10y ago
    An attack can be quite effective even if the traffic from a single home is insignificant. In a recent attack there were 145607 devices sending >1.5Tbps[1]. That's a lot from individual connections. (From: https://twitter.com/olesovhcom/status/779297257199964160 https://twitter.com/olesovhcom/status/779297257199964160 )
    - clarry 10y ago
      About 1.4 megabytes on average is not that much. Even so, this one wasn't a particularly sophisticated attack. Even if we could weed out this particular type, many a DoS rely on amplification or asymmetrical computational cost with respect to the size of the request. So if we concluded that 1.4 MB/s of HTTP or DNS or plain TCP were a lot and managed to block these senders, it would be far from a universal solution against DDoS originating from domestic hosts. And there's reason to believe we'll see much larger botnets unless manufacturers of IoT devices start taking security seriously. So tomorrow 0.14 MB/s per home could be plenty. What cost would this blocking incur? How often would I have to call my ISP because they blocked perfectly legitimate traffic? Unfortunately maybe not that often, because after the first few calls I'd probably figure that they are too big to give a shit about my problems.
- 10y ago
bikamonki 10y ago
That'll work until the database of device credentials is breached from company X which provides call center support services for manufacturers A through Z and needs said credentials at hand.
- michaelt 10y ago
  Pretty much every home router sold in the UK is shipped with a unique default wifi network name and password printed on a sticker and stuck to the device. Manufacturers don't need to keep a credential database, as legitimate users can simply look at the label.
  - pbhjpbhj 10y ago
    Which gives the appearance of security, but do any of those routers have backdoors or superuser accounts with defaults or have access via remote management (TR-069?) that's not properly set-up? Should we shoot so low as just to get unique passwords?
- danielweber 10y ago
  That is a failure condition, but it is strictly better than what we commonly have now: universal default passwords.

by MR4D 10y ago

swalsh 10y ago

Not sure that solves the problem either, perhaps UK has more stringent laws, or perhaps the US does. But if it's not universal a sufficiently large market can still be exploited to attack another. The internet is global. We need global regulations.

usefulcat 10y ago
If the US or EU did that, it would still be a very good start simply due to the size of those markets.
jws 10y ago
The law just needs to apply in a large enough region. Here in the US we got high efficiency switching wall warts instead of the slightly cheaper ones that idled away $4/yr because the EU demanded them, so manufacturers had to upgrade. Similar with lead free solder.
MR4D 10y ago
Agreed. Given consensus will take forever, I'd like to see the US or EU, somebody at lest, take the lead. Over time this will probably get worked into trade agreements anyway. But if we wait 10 years, it'll be too late, and we'll have killed the internet or given into draconian measures to stop the problem - which is what none of us want. Frankly, I don't even care if a given government has great security review - as long as they put a process in place it's a start that can be improved upon.

onion2k 10y ago

If you want to go after the simple stuff then blocking significant outbound traffic at the ISP level from a home user account until they agree it's something they want to do is the most straightforward solution. No need to change much infrastructure, no need to test devices, and no need to have costly manufacturing processes. You could even let specific traffic through (Facebook live streaming, online gaming services, etc).

clarry 10y ago
An attack can be quite effective even if the traffic from a single home is insignificant. I don't need ISPs to mess with my connection any more than they do already.
- onion2k 10y ago
  An attack can be quite effective even if the traffic from a single home is insignificant. In a recent attack there were 145607 devices sending >1.5Tbps[1]. That's a lot from individual connections. (From: https://twitter.com/olesovhcom/status/779297257199964160 https://twitter.com/olesovhcom/status/779297257199964160 )
  - clarry 10y ago
    About 1.4 megabytes on average is not that much. Even so, this one wasn't a particularly sophisticated attack. Even if we could weed out this particular type, many a DoS rely on amplification or asymmetrical computational cost with respect to the size of the request. So if we concluded that 1.4 MB/s of HTTP or DNS or plain TCP were a lot and managed to block these senders, it would be far from a universal solution against DDoS originating from domestic hosts. And there's reason to believe we'll see much larger botnets unless manufacturers of IoT devices start taking security seriously. So tomorrow 0.14 MB/s per home could be plenty. What cost would this blocking incur? How often would I have to call my ISP because they blocked perfectly legitimate traffic? Unfortunately maybe not that often, because after the first few calls I'd probably figure that they are too big to give a shit about my problems.
10y ago

bikamonki 10y ago

That'll work until the database of device credentials is breached from company X which provides call center support services for manufacturers A through Z and needs said credentials at hand.

michaelt 10y ago
Pretty much every home router sold in the UK is shipped with a unique default wifi network name and password printed on a sticker and stuck to the device. Manufacturers don't need to keep a credential database, as legitimate users can simply look at the label.
- pbhjpbhj 10y ago
  Which gives the appearance of security, but do any of those routers have backdoors or superuser accounts with defaults or have access via remote management (TR-069?) that's not properly set-up? Should we shoot so low as just to get unique passwords?
danielweber 10y ago
That is a failure condition, but it is strictly better than what we commonly have now: universal default passwords.