15 ms·

Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? At the very least there should

Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? At the very least there should be some kind of policy or standard that allows someone on the inside of the network to know if the password or software has been changed. If the FBI can tell from the outside, then how in the world are people still in the dark about this?

ddtaylor 8y ago
> Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? Sometimes the router companies are cover ops like TCP 32764
jlgaddis 8y ago
Because, just like GPL'd software, they all come with a "no warranty, expressed or implied" disclaimer attached?
- Nomentatus 8y ago
  Not that in common law, some warranties cannot be evaded, such as the goods being fit for use.
ryanlol 8y ago
>Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? Because there is no law that says so?
- charonn0 8y ago
  This would/could fall under negligence and/or strict liability torts.
personjerry 8y ago
No tool manufacturer is responsible for the outcomes of their tools (except the particular function they intended as a warantee)
- pyre 8y ago
  Most of these devices are insecure not because the attackers are hyper-sophisticated, but because the software is rushed and a second-thought to the hardware. There is no one (in power) at these companies that cares about crafting quality software. They just care about crafting the bare minimum to make their devices work. I wager that "security" is something fairly far from their mind when they craft this software, which I consider especially negligent for any company that is dealing in networked devices.
  - rock_hard 8y ago
    It would probably be best to let the market regulate by itself but the issue here might be that it’s not visible to users that their router is infected.
    - jeremyjh 8y ago
      That is right. This malware is an externality. Externalities typically need to be mitigated through regulation.
  - kelnos 8y ago
    It's even worse: most of these companies don't even write the software for the low end consumer hardware. They just license it from a third party, usually in Asia, and pay them to turn features on or off and skin the UI for their branding. It's no surprise that routers from competing manufacturers are vulnerable, since it's all the same under the hood. The companies that sell the finished product have zero insight into how secure the software is.
    - beojan 8y ago
      But there's open source software for this. Why don't they just use that?
lightedman 8y ago
"Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked?" The sheer impossibility to guarantee 100% secure and functional software due to the actual way doped silicon works. That's why there is no actual software warranty in existence.
rgbrenner 8y ago
If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs? The consequences of that would be substantial. Imagine if Apache or PHP were liable for their bugs used on websites across the internet. The projects would shutdown immediately.. no one could fund the potential liability.
- staticassertion 8y ago
  > Do you really want liability for software bugs? Yeah, definitely. Especially for infrastructure. I realize the implications of this are significant. I don't think the solution is "all bugs cost every company money for every product", but there's definitely more or less risk involved in some software and we are well past the point of negligence from router manufacturers - the vulnerabilities we see from them are absolutely absurd.
  - anf 8y ago
    Is there no laws w.r.t. negligence that can be used to punish negligent actors? If a door manufacturer is negligent in their construction of the door and someone gets robbed as a result, in violation of how they expected their door to work, is there nothing currently in the law that could help them?
    - deleted 8y ago
      [deleted]
    - chasil 8y ago
      I propose that hardware manufacturers be forced to divulge admin methods and encryption keys to their products 6 months after their software updates end. At least users can apply workarounds in that condition. As it stands, there are no options for the owner of the device.
      - staticassertion 8y ago
        This just shifts the burden to the users, I don't see this as a meaningful solution. I think that there would probably need to be classifications of software. Things like: 1) Is this infrastructure (routers, scada) 2) What level of user data is exposed to this software ? (unencrypted user data, credit card info, etc - we already do this to some extent) 3) What level of exposure exists? (NAT'd, routable, etc) And then start imposing restrictions on software in those cases. But this is very off-the-cuff, obviously it's far more complex than this. But someone needs to be responsible.
solomatov 8y ago
I am 100% sure that they have a terms that they aren't responsible for anything in their TOS/EULA.
losteric 8y ago
I don't think they should be fined, but they should be required to fix security vulnerabilities. Default passwords are a vulnerability, and defective by design is not an excuse... My Netgear router came with a secure unique password printed on a card, an internal-only admin panel, and UPnP disabled by default. It's not hard.
- giancarlostoro 8y ago
  Yeah admin panels should never hit the internet unless you truly know wth you're doing in which case you can figure out what to do to put it online anyway.
dcow 8y ago
Because the market doesn't demand it. If you truly care, speak with your money and buy a WiFi system from a vendor that provides software/security updates and patches. There are a few out there doing this, but it's not cheap.
awinder 8y ago
Considering the nation state initiating this shit is barely being punished, it seems absolutely premature to even start down this avenue.
- kfrzcode 8y ago
  Do we have hard attribution to a particular nation-state? I know it's being implied that "Fancy Bear did it" but that seems like something anyone who didn't look closer would just buy regardless of truth.
WalterBright 8y ago
> why router manufacturers aren't financially responsible for the exploits Because then they'd all exit the router business. Nobody wants to expose themselves to unlimited liability.
noonespecial 8y ago
A very very good example of where a well meaning "perfect or none" law would immediately result in "none" instead of the hoped-for "perfect".
justinhj 8y ago
Why aren’t door manufacturers held responsible when a home is burgled? The locks can be picked, the door is weak enough to kick it open? The fact is you can’t make an unpickable lock or an inpentrable door. You also can’t make a sophisticated device like a router, with many features, unhackable
hessenwolf 8y ago
It makes no sense from a capital perspective. The software provider would need to hold risk capital (money in the back pocket) like a bank or insurance company, but in proportion to the revenues of the companies they sell the software to, not the software company itself.
cup-of-tea 8y ago
Because we don't hold software engineering to the same standard as other types of engineering. Most the world has been led to believe that computers are unpredictable machines with feelings that break randomly.

ddtaylor 8y ago

> Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? Sometimes the router companies are cover ops like TCP 32764

jlgaddis 8y ago

Because, just like GPL'd software, they all come with a "no warranty, expressed or implied" disclaimer attached?

Nomentatus 8y ago
Not that in common law, some warranties cannot be evaded, such as the goods being fit for use.

ryanlol 8y ago

>Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? Because there is no law that says so?

charonn0 8y ago
This would/could fall under negligence and/or strict liability torts.

personjerry 8y ago

No tool manufacturer is responsible for the outcomes of their tools (except the particular function they intended as a warantee)

pyre 8y ago
Most of these devices are insecure not because the attackers are hyper-sophisticated, but because the software is rushed and a second-thought to the hardware. There is no one (in power) at these companies that cares about crafting quality software. They just care about crafting the bare minimum to make their devices work. I wager that "security" is something fairly far from their mind when they craft this software, which I consider especially negligent for any company that is dealing in networked devices.
- rock_hard 8y ago
  It would probably be best to let the market regulate by itself but the issue here might be that it’s not visible to users that their router is infected.
  - jeremyjh 8y ago
    That is right. This malware is an externality. Externalities typically need to be mitigated through regulation.
- kelnos 8y ago
  It's even worse: most of these companies don't even write the software for the low end consumer hardware. They just license it from a third party, usually in Asia, and pay them to turn features on or off and skin the UI for their branding. It's no surprise that routers from competing manufacturers are vulnerable, since it's all the same under the hood. The companies that sell the finished product have zero insight into how secure the software is.
  - beojan 8y ago
    But there's open source software for this. Why don't they just use that?

lightedman 8y ago

"Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked?" The sheer impossibility to guarantee 100% secure and functional software due to the actual way doped silicon works. That's why there is no actual software warranty in existence.

rgbrenner 8y ago

If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs? The consequences of that would be substantial. Imagine if Apache or PHP were liable for their bugs used on websites across the internet. The projects would shutdown immediately.. no one could fund the potential liability.

staticassertion 8y ago
> Do you really want liability for software bugs? Yeah, definitely. Especially for infrastructure. I realize the implications of this are significant. I don't think the solution is "all bugs cost every company money for every product", but there's definitely more or less risk involved in some software and we are well past the point of negligence from router manufacturers - the vulnerabilities we see from them are absolutely absurd.
- anf 8y ago
  Is there no laws w.r.t. negligence that can be used to punish negligent actors? If a door manufacturer is negligent in their construction of the door and someone gets robbed as a result, in violation of how they expected their door to work, is there nothing currently in the law that could help them?
  - deleted 8y ago
    [deleted]
  - chasil 8y ago
    I propose that hardware manufacturers be forced to divulge admin methods and encryption keys to their products 6 months after their software updates end. At least users can apply workarounds in that condition. As it stands, there are no options for the owner of the device.
    - staticassertion 8y ago
      This just shifts the burden to the users, I don't see this as a meaningful solution. I think that there would probably need to be classifications of software. Things like: 1) Is this infrastructure (routers, scada) 2) What level of user data is exposed to this software ? (unencrypted user data, credit card info, etc - we already do this to some extent) 3) What level of exposure exists? (NAT'd, routable, etc) And then start imposing restrictions on software in those cases. But this is very off-the-cuff, obviously it's far more complex than this. But someone needs to be responsible.

solomatov 8y ago

I am 100% sure that they have a terms that they aren't responsible for anything in their TOS/EULA.

losteric 8y ago

I don't think they should be fined, but they should be required to fix security vulnerabilities. Default passwords are a vulnerability, and defective by design is not an excuse... My Netgear router came with a secure unique password printed on a card, an internal-only admin panel, and UPnP disabled by default. It's not hard.

giancarlostoro 8y ago
Yeah admin panels should never hit the internet unless you truly know wth you're doing in which case you can figure out what to do to put it online anyway.

dcow 8y ago

Because the market doesn't demand it. If you truly care, speak with your money and buy a WiFi system from a vendor that provides software/security updates and patches. There are a few out there doing this, but it's not cheap.

awinder 8y ago

Considering the nation state initiating this shit is barely being punished, it seems absolutely premature to even start down this avenue.

kfrzcode 8y ago
Do we have hard attribution to a particular nation-state? I know it's being implied that "Fancy Bear did it" but that seems like something anyone who didn't look closer would just buy regardless of truth.

WalterBright 8y ago

> why router manufacturers aren't financially responsible for the exploits Because then they'd all exit the router business. Nobody wants to expose themselves to unlimited liability.

noonespecial 8y ago

A very very good example of where a well meaning "perfect or none" law would immediately result in "none" instead of the hoped-for "perfect".

justinhj 8y ago

Why aren’t door manufacturers held responsible when a home is burgled? The locks can be picked, the door is weak enough to kick it open? The fact is you can’t make an unpickable lock or an inpentrable door. You also can’t make a sophisticated device like a router, with many features, unhackable

hessenwolf 8y ago

It makes no sense from a capital perspective. The software provider would need to hold risk capital (money in the back pocket) like a bank or insurance company, but in proportion to the revenues of the companies they sell the software to, not the software company itself.

cup-of-tea 8y ago

Because we don't hold software engineering to the same standard as other types of engineering. Most the world has been led to believe that computers are unpredictable machines with feelings that break randomly.