15 ms·
Creating a ZigBee Chain Reaction
- bgentry 10y agoprevious discussion was here: https://news.ycombinator.com/item?id=12893793 https://news.ycombinator.com/item?id=12893793 Though the report does say it was recently updated, unsure what the diff was.
- notthetup 10y agoYea.. Is there a good way to find the diff? Only if research papers were published on git :P
- SkyMarshal 10y agoSecurity is expensive for vendors to implement, so they externalize the risks to their customers and society in general. To reverse this dynamic, "insecure by default" needs to be more expensive than "secure by default". It seems simplest for the Govt to avoid trying to mandate detailed security standards for continuously changing tech, and rather simply make the vendors legally liable for damages and let the market evolve effective standards and practices. However, constructing effective legislation/regulation for doing so is a non-trivial legal challenge. Simply proving when the vendor is liable vs a user could get tricky, as well as estimating damages and divying them up among multiple vendors if damages involved products from multiple vendors. Among other things. Anyone, especially lawyers, have insight on best way to fix this problem?
- jldugger 10y agoAll the software you use likely already came with a liability waiver / disclaimer: > IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
- kazagistar 10y agoAnd regulations can make all such waivers nonbinding in whatever cases are deemed important enough, like IoT devices for example.
- pythonaut_16 10y agoThe key point being > UNLESS REQUIRED BY APPLICABLE LAW Not to mention that liability waivers and disclaimers can never supersede the law anyway.
- rapsey 10y ago> It seems simplest for the Govt to avoid trying to mandate detailed security standards for continuously changing tech Govs can do a lot of broad legislation rules that is non-specific. The software industry requires a legislative bitch slap like the auto industry received. These rules would wreak havoc on the industry but if you ask me for the better. - Are you running unpatched software exposed to the internet for which CVE patches exist? Pay a fine every day until you do so. - Ban IoT devices that do not have automatic signed software updates over encrypted channels (which would probably ban all current IoT devices). - Ban all IoT devices without crypto capabilities. Must have a hardware RNG and a set of standard crypto algorithms. - Does an IoT maker have a CVE and has not patched all their devices in X amount of time? Daily fine. - Are you a vendor who has not patched a CVE for your software after X amount of time? Pay a fine every day until you do so.
- sillysaurus3 10y agoThis would have the wonderful effect of making the CVE yet another tool that can hold corporations hostage in exchange for money. Yes, security failures are pretty bad, but startups not happening thanks to excessive regulation is probably worse.
- PhasmaFelis 10y ago> Yes, security failures are pretty bad, but startups not happening thanks to excessive regulation is probably worse. How so? I mean, I'd rather avoid either, but if I had to pick one, I don't get what's so special about "startups" that they're more important than data security.
- dwaltrip 10y agoPeople starting new businesses is usually a good way for a society to become wealthier and to also raise the standard of living. In this particular case, I have no idea whether or not the safety risks/externalities are severe enough that added regulation is needed.
- zardo 10y agoThere's nothing stopping civil suits for damages resulting from poor security now. If your product does harm, you aren't absolved of liability because the internet was involved.
- chopin 10y agoThere all disclaimers all over the place for exactly this situation. You'll need to outlaw these.
- astrodust 10y agoIt's actually not that hard to find a framework for a solution. If you sell anything that connects to the power grid, you need to get it UL Listed. No exceptions. You cannot sell it if it doesn't check out in the lab. If you sell anything that emits radio frequencies either as part of its fundamental operation, or as incidental to it, you must get FCC certification. Why isn't there an agency like this, or a subdivision of one of those existing ones, that certifies things for being able to connect to the internet? Right now there's absolutely no way for an ordinary consumer to know if that product they're buying is rock solid or absolute trash. Enormous corporations like Samsung consistently crank out some of the most appallingly slip-shod code, and relatively tiny companies like those behind the Pebble have a considerably better track record. There's no external signs for the non-technical people to work with here. They'll need to hope and pray that their product isn't a total turkey.
- mtreis86 10y agoHow many people in the world have studied crypto? Radio and EE are both areas studied by a magnitude greater number of people at a serious level. Does crypto take a higher level of cognitive overhead to enter or do people only think it does? Is there a cryto structure similar to amateur radio?
- astrodust 10y agoIt doesn't have to be crypto. Right now a basic check done by a post-grad student could probably catch 90% of the most glaring problems. Your dishwasher has an HTTP port open? That's not good. Your webcam uses port-popping UDP to open up a VPN to some random server in China? Yeah, we're not certifying that. We're talking about basic port mapping and monitoring of the device in operation to make sure the network activity observed has some reasonable correlation to the actions performed on the device. Most consumers don't have the tools to do this, nor the patience to perform these tests, but these tools are cheap and easy to use by anyone with the inclination. You can do additional fuzz testing quite easily, plus inspect the data stream for plain-text data that should be encrypted. If as part of the certification you needed to submit a document describing what encryption methods you use and what system you have in place for dealing with compromised keys and such, great, but I don't see that as strictly necessary. Considerable improvements to the marketplace can be made with very simple tests. This is the equivalent of plugging in an electrical device, observing it catches on fire, and giving it a failing grade. No specific knowledge of electronics is required.
- rmc 10y agoMaking vendors liable has the problem when they spin up a new incorporated entity every year. The company who made it is now bust! Who is liable?
- chopin 10y agoThe owner. If you can't patch it, put it off the grid. If owners become liable they will care whether companies will be able to provide fixes in the future. A somewhat radical solution: if an IoT device has vulnerabilities you go free in bricking it (=making the device non-functional, nothing else). This will put strong incentives on secure devices.
- macspoofing 10y ago>Anyone, especially lawyers, have insight on best way to fix this problem? Why lawyers? This is a technical problem. Layers will come up with bad legal solutions that will already be outdated and probably too onerous when they are finally passed. I think the fix is obvious. IoT device should not have an open connection to the internet. You want to control the lights in your house with your phone, when you're at work? VPN to your home network and do it. Obviously people won't know how to configure a VPN, and you can't expect a Chinese IoT manufacturer to not have a a web-server listening on a standard port or issue weekly security updates for the lifetime of the product, but this could be automated by smart routers like Google Home/Wifi. Frankly, this is probably going to happen anyway. OS vendors have largely removed the OS as the most vulnerable component of a home network. All OSes are either locked down (Android/iOS) or have continuous security updates with sane out-of-the-box defaults. That leaves the router as a critical weak point. The cheapo $30 Staples router may work great for a household, but it isn't getting monthly security updates and is probably running on an unsupported kernel with a whole swath of zero-day vulnerabilities.
- lmm 10y agoHave you ever had to follow coding standards that are 10 years out of date? I have and it was worse than working retail. Technology moves too fast. (And for what it's worth a VPN is a non-solution to the wrong problem in this case). Legal is absolutely the right place for the problem. Put the liability in the right place and companies will figure out what works and what doesn't.
- macspoofing 10y ago>Have you ever had to follow coding standards that are 10 years out of date? I have. Our product is 10 years old. 10 years is nothing. And I'm not sure what your point is, any regulation is going to take years to develop, and years to be assimilated (if ever). >Put the liability in the right place and companies will figure out what works and what doesn't. Uh huh. You're proposing creating regulation to govern thousands (or hundreds of thousands) of products globally, and you think that's easier? The closest example of a regulatory solution to a real technical problem is the EU mandate of cookie notification ... which was disruptive for everyone and insanely stupid and pointless. >(And for what it's worth a VPN is a non-solution to the wrong problem in this case). It's a solution. The problem with IoT devices is that they are open for anyone to compromise and you cannot expect manufacturers to support them with security updates indefinitely. You put them on a private network with a controlled end-point and you're 95% there. Instead of needing people to vet every device they buy on Amazon (or creating a regulatory body to govern and control them), you just need to convince them to get a 'smart' router. You don't need every IoT manufacturer in the world to play ball. You don't even need every consumer to play ball either. Your phone will have an app that will talk to your home router/gateway and you can access your home service via a VPN you don't even know is there. Makes a ton of sense to me. Regulation would be a mess.
- deleted 10y ago[deleted]
- modeless 10y agoIoT is a bad vision for the future. 20 years from now I don't want a million devices in my home running software. Either they'll all constantly be pestering me with updates that break functionality I rely on, or they'll be out of date with bugs and security holes that last forever. My vision of a good future is one where I have exactly one smart device: a robot butler which will operate all my other devices. I don't need a smart lock if the butler unlocks the door for me. I don't need a security webcam if the butler monitors the house while I'm away. I don't need a smart thermostat if the butler sets it for me. Etc.
- colechristensen 10y agoMeh, I'm much more interested in a future where all my devices aren't "smart" but they all include an API contract regulated by an org akin to UL or FCC backed by legislation providing legal remedies to security and usability deficiencies. It's not about _if_ legal regulation will come to software but _when_, and the further in front of it hackers are, the better the future can be.
- kazagistar 10y agoIt's too cheap to just put a cpu into things not to do it. Your usb flash drive probably has an arm chip in it, bease it was cheaper then making specialized circuits for it.
- fjdlwlv 10y agoOver half your body weight is microbes that are not part of your human body. Some helpful, some harmful. That is our digital future.
- jrockway 10y agoWhile reading this, I went looking for the ZLL master key. What surprises me is that it got DMCA'd everywhere, including Hacker News: https://news.ycombinator.com/item?id=9249841 https://news.ycombinator.com/item?id=9249841 And there was really no outrage about it. Very strange.
- ktta 10y agoIt's amazing how 16 bytes of data can be under copyright. Not arguing, just pointing out how there can be a DMCA request for something so small, citing copyright laws. Reminds me of the AACS controversy when people starting printing keys of t-shirts, and illegal numbers were born.
- deleted 10y ago[deleted]
- Sanddancer 10y agoJohn Cage's 4'33" is silence that is under copyright, and has been the subject of legal controversy. http://edition.cnn.com/2002/SHOWBIZ/Music/09/23/uk.silence/ http://edition.cnn.com/2002/SHOWBIZ/Music/09/23/uk.silence/
- fjdlwlv 10y agoDiffernt issue. 4'33 is a recording of the audience, not silence. I studied it in a music class in school. Cage's estate's infringement claim on "silence" was not upheld by a court. The defendant on that suit put Cage's name on the album as a songwriter, of his own accord.
- Dylan16807 10y agoJust because someone sends a DMCA doesn't mean there is a valid copyright.
- ktta 10y agoOh yeah that was a miswording on my part. I wanted to say it can be claimed using copyright laws.
- rochellle 10y agoI don't know why, but I kind of want to see a truly gargantuan IoT debacle unfold at this point. Something beyond stupid, and completely preventable, and all the more horrendous, because at this point, it can only be funny. I want to see something like a TV commercial accidentally trigger a home automation system, which corrupts the operation of a class of light switches, which cascades onto smart microwave ovens, which transmit kill signals to self-driving cars which synchronize with flying cars at which point they all swarm the nearest hospitals and explode, demolishing trillions of dollars of health care, and imploding society because of failed credit default swaps on all of the health care insurance (even obamacare), which then causes automated trading platforms to sell, killing off everyone's 401K's, destroying the retirement plans of all survivors, such that the living envy the dead. Can we make that happen? IoT is retarded.
- virmundi 10y agoHyperbole, or just wanting to watch the world burn, aside, why is IoT, as an idea, retarded? It seems to me that having the underlying platform for secured communication to semi-smart technology is good. If my house could intelligently govern itself within a set of parameters I define that fit my life, I bet I could save a few bucks a month on power, not have as much food, and help the environment in my own little way. I do see the idea of IoT with no security and no long term commitment to the products as actually, technically retarding (we'd be worse than we are no for the reason you enumerated). Could you make an argument for your last statement as to why a good implementation of IoT is bad?
- deleted 10y ago[deleted]
- rochellle 10y agoHow many personal possessions can you think of that cannot operate unattended, but should? Given that my personal possessions are few to begin with, I have a short list to review. I honestly can't think of a single one, save my refrigerator, which I do not want buying food for me. To be honest, I don't even like owning a refrigerator. I didn't need one in college, and still don't need one. I don't use DVR, because I don't subscribe to cable TV. My arms aren't broken. I can get up and turn a light on. Self-driving cars are technically beyond the scope of IoT, even though the "T" in IoT is deliberately vague. But these are the things in my life, as it is, and not how it could be. The way my life works right now, I spend (at best) 10 hours away from my home, and maybe 8 hours asleep. So possibly 6 hours to reap the benefits of more clutter, automating... whatever. Even though arranging and aligning the automated systems that hypothetically support the maximization of my free time, consumes time in order to perfect. But wait! Planned obsolescence promises me that if I step onto the product treadmill, it will be harder to exit, ensuring that there will be cycles of realigning and integrating new IoT systems, into my own private ecosystem of personal automation! We know this, because look at how often we discard our mobile devices, and even our laptops and desktops. But nevermind that. Maybe I'd value my free time more, if I had more of it. Maybe if I wasn't lashed to a desk all day, working for someone else, living paycheck to paycheck, I'd have more freedom to expound upon all the nothing I can't imagine not doing at the moment, because I'm consistently busy on someone else's terms. I don't want robots buying shit for me. I don't need robots telling the world which room I just walked into. I'm sick of going to work all day, and sitting in someone else's chair. Fix that, before wasting my paycheck on lightbulbs that change themselves, but never go out anyway, because I'm not even at home 40 or 60 hours a week, and I'm asleep in the dark for another 50 besides.
- deleted 10y ago[deleted]
- Kenji 10y agoA lot of people are calling for government action against IoT. Think twice, people. You are undermining your own profession (and I don't just mean IoT, I mean software engineering in general). The laws the state will come up with will not be great, they never are, and they will stifle innovation. The internet is pretty darn stable, I don't think we need good old state to tell us how to write software, we will fix our problems ourselves as we have in the past.
- lolc 10y agoWhat do you think about IoT devices with powerful motors that are able to kill people? Or conversely, what do you think about current regulations regarding cars and aircraft?
- sametmax 10y agoSecurity should be embedded in the IoT frameworks and should be easy for it to become the standard practice. But most IoT stuff are hacked on, rarely using anything standard, and even when there is a framework involved, it seldom has security as a main feature. Even when it does, it's still a lot of work. Take crossbar.io, which is my go to tool to communicate within a IoT context (or anything soft real time really). To secure it you need to: - setup the TLS certificate. Default communication transport is over unencrypted websocket. - configure the provided authentication service (and write a backend for your system). - declare several realms to isolate the clients, and configure the permissions accordingly (default permissions are YOLO, to ease the "hello world", which I understand). Make sure you don't expose important RPC to the wrong clients or allow anybody to declare callbacks. - manually code the procedure to use their hot reload system to swap code updates. It's made for local updates, not remote ones. - be very careful when updating your clients. Crossbar routed RPC is transparent and it's tempting to replace a call from JS to Python to a call from JS to Postgres to remove a layer of indirection. But do you make proper permissions checks in your SQL ? Are you sure you don't expose too much ? So basically, you can make it secure. But only if you know what you're doing and don't have a deadline tomorrow.
- bsder 10y ago> Security should be embedded in the IoT frameworks and should be easy for it to become the standard practice. To be fair, almost all of the security libraries suck. The only thing which is SMALL and solid is DJB's TweetNaCl (http://tweetnacl.cr.yp.to/ http://tweetnacl.cr.yp.to/) If I'm running on a Nordic nRF51 series, for example, things like SSL/TLS are a HUGE chunk of my RAM, ROM, battery, and time budgets. This exploit is a good example. Even if you wanted to use something like a public/private key system, it's not clear that the the Atmel SoC could handle it. In addition, there are still gaps in security libraries that we need. We don't have a good PAKE (password authenticated key exchange) library, for example. HomeKit standardized on SRP with a 3072-bit key, and then discovered that it was too heavyweight and slow for devices working with a lithium coin cell battery. Even Microsoft with AllJoyn had to deprecate SRP and switch to a non-standardized elliptic curve key exchange to better match tiny hardware. The crypto folks are falling down on the job here. These things aren't standardized, and they don't seem to have been beaten on very hard. And they certainly haven't been tested on small hardware very much. Everybody can bitch about security, but until someone figures out the tools required for these small systems, it's going to remain the wild west.
- mirimir 10y agoWow. That's awesome. The first WiFi worm, I think. Think of the art that's possible with this. You could create city-scale images. Maybe larger, in high-density areas.
- Paul_S 10y agoI don't work in the IoT department but they use our chips and I can guarantee you that if you make security a legal requirement my company will not hire more engineers, they will hire more lawyers.
- mahyarm 10y agoZigBee / Z-Wave are just getting started in their WEP everything stage. Most of the installed base is unencrypted. It will take many more years until they are at WPA2 levels of robustness.