5 ms·
Yes. It is completely unreasonable to expect that manufacturers of cheap electronics will implement security solutions on their own for their 20$ home routers,
by kbart 10y ago
Yes. It is completely unreasonable to expect that manufacturers of cheap electronics will implement security solutions on their own for their 20$ home routers, IP cameras etc. Even huge, international companies' failing security doesn't surprise anyone and newly discovered vulnerabilities are common news. Sure, you can ban importing all connected devices that are not certified by some strict security standard, but that would probably rise prices more than users, accustomed to cheap electronics, would want to pay. And how bans on commodity goods work we know pretty well from "war on drugs"..
The only realistic solution I can think of is creation of the open communication and security protocols with easily available standard libraries. A good example is HTTPS, which is far from perfect now, but is common today thanks to TLS and OpenSSL. We need something like Linux kernel - free, widespread, well understood, easy to port and use. Few big companies could make it work, but the problem is that there's not much money in creating open protocols and FOSS libraries. Maybe some IoT orientated Linux kernel branch with minimal set of functionality, safer of out-of-box configuration and basic security solutions preinstalled?
- walterbell 10y agoOpenEmbedded/Yocto is one such Linux "distro", https://www.yoctoproject.org/ecosystem/iot https://www.yoctoproject.org/ecosystem/iot There is also the open-source Zephyr RTOS for IoT, of Intel WindRiver lineage, under Linux Foundation governance, https://www.zephyrproject.org https://www.zephyrproject.org Edit: See http://mender.io http://mender.io for OTA updates (open-source client and server). If IoT device vendors separate their application code from the base operating system, e.g. via containers or virtualization, it may be possible for a vendor-authorized subscription service (like Mender) to deliver OTA updates for security-critical components.
- kbart 10y agoI have used OpenEmbedded/Yocto, but it pretty much falls under "roll your own solution" category. I know there are many projects and papers written that try to address IoT security, but there's no clear leaders yet. Making hardware projects might span to few years, you can't simply grab something from GitHub, base your project on it and risk it going out of existence in few months.