6 ms·

I'm sorry, I don't understand. Who's going to update the firmware in your light bulbs using a patched open source version of the manufacturer's code? Edit: >

I'm sorry, I don't understand. Who's going to update the firmware in your light bulbs using a patched open source version of the manufacturer's code? Edit: > it's not generally that hard to flash devices that support it, so a report that says "X,Y and Z have exploits, here are some options" could go a long way. Making devices support some minimum standard of local upgradability would help immeasurably. You're right, it's not hard. But can you imagine regular users doing that? Anti-viruses, Microsoft, Apple, Google and all major browsers had to automate and force updates on users to keep devices secure. I have a hard time believing that any significant portion of users will flash updated firmware onto IoT devices to fix security vulnerabilities. Heck, when was the last time you checked for firmware updates for your home router? I do this stuff for a living and I don't think I've updated my (current) router's firmware more than once in the last few years.

kbenson 9y ago
> You're right, it's not hard. But can you imagine regular users doing that? Anti-viruses, Microsoft, Apple, Google and all major browsers had to automate and force updates on users to keep devices secure. If you've already got a database of router versions, it's not hard to include how to submit a new firmware version in that database, whether it be a POST URL, any params and the expected payload(s) or a TFTP upload. At that point, the same device that generated the report could give you a management page that listed some options and semi-automated the process. Want to update fridge with out of date/exploitable firmware with community fridge firmware X? Click here. Want to update with community firmware Y? Click here. Want to update to newer/latest proprietary firmware? Click here. I do agree it's not a solution to the problem. But it might help. It would also allow your techie friend to run an app on their phone or laptop when they come over and let you know, or handle it for you with a minimum of fuss. This problem won't ever get better until someone starts being held accountable for exploitable network attached devices. I think part of the reason that doesn't happen is because it's not feasible with current norms of behavior to expect producers nor consumers to do so with any level of confidence. Providing tools for this may take us one step closer. Personally I think a blend of regulations will be required. If devices sold are required to be updatable in one of a few ways, and workable firmware open sourced if obsoleted (or clearly marked or all labeling as may be entirely unsupported after 20XX), then it becomes feasible to require users to have some level of accountability over what they put on their local networks. I think it's the same as cars and the public road system. Cars have to adhere to certain standards to be street legal, and car makers must adhere to certain standard to sell their cars as street legal. > Heck, when was the last time you checked for firmware updates for your home router? Every 6-12 months, generally when I'm checking why performance is bad at the moment. But I'm not getting a report, so I only check when it's on my mind.

kbenson 9y ago

> You're right, it's not hard. But can you imagine regular users doing that? Anti-viruses, Microsoft, Apple, Google and all major browsers had to automate and force updates on users to keep devices secure. If you've already got a database of router versions, it's not hard to include how to submit a new firmware version in that database, whether it be a POST URL, any params and the expected payload(s) or a TFTP upload. At that point, the same device that generated the report could give you a management page that listed some options and semi-automated the process. Want to update fridge with out of date/exploitable firmware with community fridge firmware X? Click here. Want to update with community firmware Y? Click here. Want to update to newer/latest proprietary firmware? Click here. I do agree it's not a solution to the problem. But it might help. It would also allow your techie friend to run an app on their phone or laptop when they come over and let you know, or handle it for you with a minimum of fuss. This problem won't ever get better until someone starts being held accountable for exploitable network attached devices. I think part of the reason that doesn't happen is because it's not feasible with current norms of behavior to expect producers nor consumers to do so with any level of confidence. Providing tools for this may take us one step closer. Personally I think a blend of regulations will be required. If devices sold are required to be updatable in one of a few ways, and workable firmware open sourced if obsoleted (or clearly marked or all labeling as may be entirely unsupported after 20XX), then it becomes feasible to require users to have some level of accountability over what they put on their local networks. I think it's the same as cars and the public road system. Cars have to adhere to certain standards to be street legal, and car makers must adhere to certain standard to sell their cars as street legal. > Heck, when was the last time you checked for firmware updates for your home router? Every 6-12 months, generally when I'm checking why performance is bad at the moment. But I'm not getting a report, so I only check when it's on my mind.