8 ms·

Mudge mentioned on his Twitter account (https://twitter.com/dotMudge/status/941373739681189888 https://twitter.com/dotMudge/status/941373739681189888) that a pr

Mudge mentioned on his Twitter account (https://twitter.com/dotMudge/status/941373739681189888 https://twitter.com/dotMudge/status/941373739681189888) that a project like this had been requested in the DoD but was held back by politics. Victor Gevers is cited by Bleeping computer (https://www.bleepingcomputer.com/news/security/brickerbot-author-claims-he-bricked-two-million-devices/ https://www.bleepingcomputer.com/news/security/brickerbot-au...) as saying there are better ways of solving the problem than forcibly disabling/bricking devices. I'm curious what those are, though, since IoT manufacturers (speaking broadly) don't seem motivated right now to take even basic security precautions with their devices. I know some groups use sinkholes to redirect compromised devices, but while that can be useful for research it doesn't seem like it has the same motivational impact for change.

yborg 9y ago
There's no incentive for manufacturers to do anything. This actually just increases sales, as dead devices are replaced (probably by the same device/firmware). Insecurity converts the equipment to a consumable that generates an annuity.
- DougN7 9y ago
  This is the key problem. The manufacturer might even consider the poor security as a feature (for them)
  - bigiain 9y ago
    There's a couple of other problems there too - the "manufacturer" is often some unknown and unfindable usually Chinese contract electronics assembly firm, who had little to do with the design or software. The company who contracted them to do it often no longer exists a few years down the track. The place it gets sold can easily be somewhere like Ebay, AliExpress, or Kickstarter - where the vendor really isn't going to care once your payment has cleared. (Source: I was the platform security guy for an IoT startup in 2013/14, for a company who no longer exists and who's only product run is still out there somewhere no longer getting security updates...)
- jpalomaki 9y ago
  If the new device would stop working soon enough after purchase, customers would be more likely to return it to store. I see the normal manufacturers/sellers responsibility as the only good answer to the problem. I don't like solutions involving fines or large liabilities, because these can create wrong incentives to people/companies. Doing security properly for these devices is not very expensive compared to scale they are being sold. Therefore I think simple things like increased return/warranty repair rates should provide enough incentive to focus on security.
  - joe_the_user 9y ago
    I don't like solutions involving fines or large liabilities, because these can create wrong incentives to people/companies. Making manufacturers liable for incidental damage their devices do sends the message that they should avoid such damages as far as possible. That seems like a good message to me. If device $20 device X does $20,000 damage to the hospital down the road, the fact that the consumer can return the device seems woefully insufficient.
    - pdkl95 9y ago
      Making manufacturers liable for the damage their products do is do allows the insurance industry to set minimum standards. (i.e. you would have to get some kind of certification similar to UL/CE to get insurance)
    - mindslight 9y ago
      > device $20 device X does $20,000 damage to the hospital down the road If it were able to do that, then presumably that $20 device had eg a good amount of explosive in it, and therefore would be in no condition to return it to the store. Unless you're alluding to that $20 device being used as a communications proxy, under a mistaken idea that the Internet has some concept of node trust. In reality, the hospitals $20k "damage" would be due to its own developers' negligence and demands for compensation should be placed squarely at the door of its suppliers and integrators.
      - 9y ago
wmf 9y ago
If ISPs cut off customers with compromised devices it would create serious motivation. Also serious collateral damage and backlash.
- Yokohiii 9y ago
  Where I live, ISPs do distribute those devices.
- 1ris 9y ago
  I once got a angry email from my ISP that i have ports open i shouldn't have. If they would be used for DDoS amplification they'd cut my connection. And if I couldn't fix it or had no clue what any of these terms meant I should pay somebody to fix it for me. (No referrals)
FLUX-YOU 9y ago
So the DoD wanted to brick devices instead of just declaring companies making these devices a threat to national security, banning their products from sale, and setting a good precedent? :| Would the intel community really need a botnet like this to operate?
- wybiral 9y ago
  The thing is that the largest consumers of these devices aren't within the US. Many of them are from Chinese companies and are being sold throughout Southeast Asia and South America.
- deleted 9y ago
  [deleted]
- johncolanduoni 9y ago
  I don’t think the DoD getting to unilaterally decide what devices can be sold in the US is a good precedent at all. I expect devices with troublesome features like support for end-to-end encryption would be the first to go, and insecure devices would probably stay as long as the vulnerabilities were known to them.
subcosmos 9y ago
There are ways of disrupting them without completely bricking them. I submitted this last year. Took a long time to publish! https://ics-cert.us-cert.gov/advisories/ICSA-17-341-01 https://ics-cert.us-cert.gov/advisories/ICSA-17-341-01
btown 9y ago
Presumably a state-level actor could not only figure out how to disable these devices, but actually create patches for the vulnerabilities and force-distribute those patches. They would have access to test hardware and could even demand confidential documentation from the manufacturers to facilitate this.
- sillysaurus3 9y ago
  This risks bricking the devices.
- ComodoHacker 9y ago
  ...and include whatever they want into those patches. And they'll want.
- AgentME 9y ago
  Though that does remove a lot of the incentive for the IoT company to change anything.
HIPisTheAnswer 9y ago
The better way is to transition to identity networks. The sybil attack is a function of the low cost of identities. In the current stack, IP addresses play a dual role of locators and identifiers. This is bad engineering and leads to the current situation. The Host Identity Protocol (HIP) has been in use by boeing and the US army for years now. The revised version (HIPv2) hasn't seen an open-source implementation yet. If someone with enough time and skill wants to change the world, a good implementation of HIPv2 will have a very positive impact. https://tools.ietf.org/html/rfc7401 https://tools.ietf.org/html/rfc7401

yborg 9y ago

There's no incentive for manufacturers to do anything. This actually just increases sales, as dead devices are replaced (probably by the same device/firmware). Insecurity converts the equipment to a consumable that generates an annuity.

DougN7 9y ago
This is the key problem. The manufacturer might even consider the poor security as a feature (for them)
- bigiain 9y ago
  There's a couple of other problems there too - the "manufacturer" is often some unknown and unfindable usually Chinese contract electronics assembly firm, who had little to do with the design or software. The company who contracted them to do it often no longer exists a few years down the track. The place it gets sold can easily be somewhere like Ebay, AliExpress, or Kickstarter - where the vendor really isn't going to care once your payment has cleared. (Source: I was the platform security guy for an IoT startup in 2013/14, for a company who no longer exists and who's only product run is still out there somewhere no longer getting security updates...)
jpalomaki 9y ago
If the new device would stop working soon enough after purchase, customers would be more likely to return it to store. I see the normal manufacturers/sellers responsibility as the only good answer to the problem. I don't like solutions involving fines or large liabilities, because these can create wrong incentives to people/companies. Doing security properly for these devices is not very expensive compared to scale they are being sold. Therefore I think simple things like increased return/warranty repair rates should provide enough incentive to focus on security.
- joe_the_user 9y ago
  I don't like solutions involving fines or large liabilities, because these can create wrong incentives to people/companies. Making manufacturers liable for incidental damage their devices do sends the message that they should avoid such damages as far as possible. That seems like a good message to me. If device $20 device X does $20,000 damage to the hospital down the road, the fact that the consumer can return the device seems woefully insufficient.
  - pdkl95 9y ago
    Making manufacturers liable for the damage their products do is do allows the insurance industry to set minimum standards. (i.e. you would have to get some kind of certification similar to UL/CE to get insurance)
  - mindslight 9y ago
    > device $20 device X does $20,000 damage to the hospital down the road If it were able to do that, then presumably that $20 device had eg a good amount of explosive in it, and therefore would be in no condition to return it to the store. Unless you're alluding to that $20 device being used as a communications proxy, under a mistaken idea that the Internet has some concept of node trust. In reality, the hospitals $20k "damage" would be due to its own developers' negligence and demands for compensation should be placed squarely at the door of its suppliers and integrators.
    - 9y ago

wmf 9y ago

If ISPs cut off customers with compromised devices it would create serious motivation. Also serious collateral damage and backlash.

Yokohiii 9y ago
Where I live, ISPs do distribute those devices.
1ris 9y ago
I once got a angry email from my ISP that i have ports open i shouldn't have. If they would be used for DDoS amplification they'd cut my connection. And if I couldn't fix it or had no clue what any of these terms meant I should pay somebody to fix it for me. (No referrals)

FLUX-YOU 9y ago

So the DoD wanted to brick devices instead of just declaring companies making these devices a threat to national security, banning their products from sale, and setting a good precedent? :| Would the intel community really need a botnet like this to operate?

wybiral 9y ago
The thing is that the largest consumers of these devices aren't within the US. Many of them are from Chinese companies and are being sold throughout Southeast Asia and South America.
deleted 9y ago
[deleted]
johncolanduoni 9y ago
I don’t think the DoD getting to unilaterally decide what devices can be sold in the US is a good precedent at all. I expect devices with troublesome features like support for end-to-end encryption would be the first to go, and insecure devices would probably stay as long as the vulnerabilities were known to them.

subcosmos 9y ago

There are ways of disrupting them without completely bricking them. I submitted this last year. Took a long time to publish! https://ics-cert.us-cert.gov/advisories/ICSA-17-341-01 https://ics-cert.us-cert.gov/advisories/ICSA-17-341-01

btown 9y ago

Presumably a state-level actor could not only figure out how to disable these devices, but actually create patches for the vulnerabilities and force-distribute those patches. They would have access to test hardware and could even demand confidential documentation from the manufacturers to facilitate this.

sillysaurus3 9y ago
This risks bricking the devices.
ComodoHacker 9y ago
...and include whatever they want into those patches. And they'll want.
AgentME 9y ago
Though that does remove a lot of the incentive for the IoT company to change anything.

HIPisTheAnswer 9y ago

The better way is to transition to identity networks. The sybil attack is a function of the low cost of identities. In the current stack, IP addresses play a dual role of locators and identifiers. This is bad engineering and leads to the current situation. The Host Identity Protocol (HIP) has been in use by boeing and the US army for years now. The revised version (HIPv2) hasn't seen an open-source implementation yet. If someone with enough time and skill wants to change the world, a good implementation of HIPv2 will have a very positive impact. https://tools.ietf.org/html/rfc7401 https://tools.ietf.org/html/rfc7401