3 ms·

No, they're not state-sponsored teams... they're children, they're far more pernicious than black hat teams, and there's a ton more of them. ;) The questions y

by Frondo 10y ago

No, they're not state-sponsored teams... they're children, they're far more pernicious than black hat teams, and there's a ton more of them. ;) The questions you're asking are good ones, and they're ones that we as a society need to start answering. 20 years ago, the idea of always-connected devices littering our homes would've seemed like sci-fi magic, but now it's actually coming commonplace. But this isn't the first time we've had this sort of thing happen. Like, how did electronics gadgets become safe enough that we never think twice about the fire hazard of plugging in a mystery wall wart? Or any kind of product. What we've come up with is, generally speaking, companies have to try to uphold a standard, they can be held liable, and can be put out of business for making unsafe products. Why it should be any different just because it's a "now with Internet!" product, I don't really know.

jeffdavis 10y ago
I think the difference is protecting something against mistakes vs malice. In other words, a better safety analogy might be the prompt when you do "rm -rf". I'm not opposed to introducing standards here; I am just saying that it's adofferent problem.
Klathmon 10y ago
But IMO this isn't a "safety" issue with the devices themselves that could hurt the users unintentionally, this is a 3rd party "weaponizing" the system for their own use. I'm struggling think of a good analogy, but it seems more like suing Ford because thieves can easily steal their cars for use in robberies. In essence, the device is being used by an unauthorized 3rd party to harm a 4th party. The device owner in some cases is never harmed or even inconvenienced, and neither is the manufacturer. It's a shitty situation, and I don't personally know where the line should be drawn, but IMO it should be drawn clearly.
- baq 10y ago
  i'd compare it to freon and freon using devices which had to be properly utilized or the ozone layer got hurt, only now substitute freon for 'product with ability to connect to the internet that doesn't get security updates anymore'. such devices should be disconnected from any non-air-gapped network or they're a considerable risk for their environment (the internet).
  - Klathmon 10y ago
    The "EPA" is actually a perfect "analogy". We need an IPA (perhaps a different name...). We need someone that will set "standards" for a minimum baseline of "security" to ensure the health of the internet, and dole out fines based on violations. However they need to be VERY careful. With something like freon it's a physical "thing" that can be regulated. We don't want to regulate "ideas" or even code, that to me seems like a very dangerous thing. But you are right, we need something that will protect the "health of the internet" like we protect the health of our environment.
    - protomyth 10y ago
      How do you add any regulation without regulating the code? code is our environment.
      - Klathmon 10y ago
        I meant more that I don't want it to be a crime to write a TCP stream handler without SSL. Or to need a license to write crypto code. To me it gets dangerously close to regulating ideas. I'd want to it more based in consequences. If your product or code is used in an attack, you get fined. No need to dictate the code or software solutions allowed.
- drvdevd 10y ago
  Yeah comparing this to toy safety is quite a leap. Actual internet connected toys? Sure. But what I see is a network gateway device in a slew of such devices in a still nascent industry which really hasn't figured out how to even create fully secure network protocols yet, much less hardware. This will have a chilling effect on innovation in the field more than it will improve security in the large.
jerf 10y ago
"Let's have certifications!" is a common answer, but the mechanics are non-trivial. Flip the question around from it's usual perspective... suppose you are a certification authority. Put your business hat on. What would it take for you to be willing to certify a non-trivial product as being secure? Bear in mind that the act of certification puts your skin in the game; if you certify things that subsequently have flaws in them, you will at the very least suffer a reputation hit, and it's not out of the question you'll get caught in the lawsuit and monetary damages crossfire. So... what would it take for you to be willing to sign off on an IP camera? Being honest with yourself, would you have certified something as secure if it used OpenSSL correctly (assuming such a unicorn could exist), before you knew about Heartbleed? If your answer is no, what would it take for you to be willing to certify something using SSL? (I assume "not using SSL" is an obvious certification black mark.) What I mean by "put your business hat on" is that I am not trying to make the point that this is impossible. I don't think it is. What I mean is, think business, think risk, think risk management, think about how your business is basically made out of black swan events, think about what it would take for you to put yourself out like that, and put some real numbers on the money and at least mentally come up with a sketch of what it would take. Speaking for myself, it doesn't take me long before I notice that my certification standards would simply annihilate the entire IoT industry as it now stands, on even basic stuff like "Since you're using C, are you using best-practices static analysis? Can you update your firmwares? How secure is your firmware update process?" Those three questions alone and I've probably tipped nearly the entire industry into a negative cost/benefits analysis. Does that solve the problem? Again, I mean that question more honestly than it probably sounds on the Internet; a case can be made that an industry that is currently basically only able to survive by extensive offloading of what become negative externalities really shouldn't exist, even in a bootstrap phase. Perhaps nuking the industry as it now stands is the best thing we could do in the next couple of years. Pour encourager les autres if for no other reason. Let the industry come up with some best practices, form some "sell shovels rather than dig for gold" companies around building more secure IoT platforms, come back at the problem after that. A real certification process that really solves this problem is probably unsustainably expensive for the industry as we now know it, xor the certification will be a useless rubber stamp that doesn't solve the problem.
- 10y ago

by Frondo 10y ago

jeffdavis 10y ago

I think the difference is protecting something against mistakes vs malice. In other words, a better safety analogy might be the prompt when you do "rm -rf". I'm not opposed to introducing standards here; I am just saying that it's adofferent problem.

Klathmon 10y ago

But IMO this isn't a "safety" issue with the devices themselves that could hurt the users unintentionally, this is a 3rd party "weaponizing" the system for their own use. I'm struggling think of a good analogy, but it seems more like suing Ford because thieves can easily steal their cars for use in robberies. In essence, the device is being used by an unauthorized 3rd party to harm a 4th party. The device owner in some cases is never harmed or even inconvenienced, and neither is the manufacturer. It's a shitty situation, and I don't personally know where the line should be drawn, but IMO it should be drawn clearly.

baq 10y ago
i'd compare it to freon and freon using devices which had to be properly utilized or the ozone layer got hurt, only now substitute freon for 'product with ability to connect to the internet that doesn't get security updates anymore'. such devices should be disconnected from any non-air-gapped network or they're a considerable risk for their environment (the internet).
- Klathmon 10y ago
  The "EPA" is actually a perfect "analogy". We need an IPA (perhaps a different name...). We need someone that will set "standards" for a minimum baseline of "security" to ensure the health of the internet, and dole out fines based on violations. However they need to be VERY careful. With something like freon it's a physical "thing" that can be regulated. We don't want to regulate "ideas" or even code, that to me seems like a very dangerous thing. But you are right, we need something that will protect the "health of the internet" like we protect the health of our environment.
  - protomyth 10y ago
    How do you add any regulation without regulating the code? code is our environment.
    - Klathmon 10y ago
      I meant more that I don't want it to be a crime to write a TCP stream handler without SSL. Or to need a license to write crypto code. To me it gets dangerously close to regulating ideas. I'd want to it more based in consequences. If your product or code is used in an attack, you get fined. No need to dictate the code or software solutions allowed.
drvdevd 10y ago
Yeah comparing this to toy safety is quite a leap. Actual internet connected toys? Sure. But what I see is a network gateway device in a slew of such devices in a still nascent industry which really hasn't figured out how to even create fully secure network protocols yet, much less hardware. This will have a chilling effect on innovation in the field more than it will improve security in the large.

jerf 10y ago

"Let's have certifications!" is a common answer, but the mechanics are non-trivial. Flip the question around from it's usual perspective... suppose you are a certification authority. Put your business hat on. What would it take for you to be willing to certify a non-trivial product as being secure? Bear in mind that the act of certification puts your skin in the game; if you certify things that subsequently have flaws in them, you will at the very least suffer a reputation hit, and it's not out of the question you'll get caught in the lawsuit and monetary damages crossfire. So... what would it take for you to be willing to sign off on an IP camera? Being honest with yourself, would you have certified something as secure if it used OpenSSL correctly (assuming such a unicorn could exist), before you knew about Heartbleed? If your answer is no, what would it take for you to be willing to certify something using SSL? (I assume "not using SSL" is an obvious certification black mark.) What I mean by "put your business hat on" is that I am not trying to make the point that this is impossible. I don't think it is. What I mean is, think business, think risk, think risk management, think about how your business is basically made out of black swan events, think about what it would take for you to put yourself out like that, and put some real numbers on the money and at least mentally come up with a sketch of what it would take. Speaking for myself, it doesn't take me long before I notice that my certification standards would simply annihilate the entire IoT industry as it now stands, on even basic stuff like "Since you're using C, are you using best-practices static analysis? Can you update your firmwares? How secure is your firmware update process?" Those three questions alone and I've probably tipped nearly the entire industry into a negative cost/benefits analysis. Does that solve the problem? Again, I mean that question more honestly than it probably sounds on the Internet; a case can be made that an industry that is currently basically only able to survive by extensive offloading of what become negative externalities really shouldn't exist, even in a bootstrap phase. Perhaps nuking the industry as it now stands is the best thing we could do in the next couple of years. Pour encourager les autres if for no other reason. Let the industry come up with some best practices, form some "sell shovels rather than dig for gold" companies around building more secure IoT platforms, come back at the problem after that. A real certification process that really solves this problem is probably unsustainably expensive for the industry as we now know it, xor the certification will be a useless rubber stamp that doesn't solve the problem.

10y ago