5 ms·

I think soon or later we will need some kind of public institution that will do this sort of scans; all those unsecured IoT printers, vacuum cleaners, fridges,

I think soon or later we will need some kind of public institution that will do this sort of scans; all those unsecured IoT printers, vacuum cleaners, fridges, abandoned servers, Synology servers, etc. would become a real threat at some point and the costs of dealing with issues caused by them like identity theft, false accusations because on someone's server there is child porn uploaded by a cracker, bot nets will be more costly than having some institution running routine scans and sending warnings.

canadev 8y ago
it's like getting your kids vaccinated
lazyjones 8y ago
We don't need public institutions. It's the responsibility of ISPs to prevent security problems, spam zombie servers/appliances etc. in their networks, so they should perform these scans and warn first, then disconnect customers with problematic devices.
- lifeisstillgood 8y ago
  Charge per device access? And those devices need certificates of worthiness similar to cars MOT certificates (UK example) An interesting idea. What is the minimum viable "superhighway-fitness" of a device?
- evrydayhustling 8y ago
  I like the distributed spirit of this, but it only works where there is another layer holding the ISPs accountable - whether it's other ISPs or a government body. Right now their incentives are only to satisfy customers' perceived needs, which leaves nobody incentivized to prevent endpoint-to-endpoint harm.
- groby_b 8y ago
  But the ISPs are not held responsible. They can externalize costs to society, and so they do so - because that is what capitalism mandates. Without an institution that puts those costs back where they belong, nothing will change, because it is cheaper not to change. I'd recommend reading up on the Cuyahoga River, the Clean Water Act, and the formation of the EPA - it's pretty much the same problem. Industry creating problems by abdicating its responsibility, necessitating a legal solution. And enforcing that requires a public institution.
FrankDixon 8y ago
In germany the federal bureau of security in IT actually does that. They send the admins an email: https://www.bsi.bund.de/EN/Topics/IT-Crisis-Management/CERT-Bund/CERT-Reports/reports_node.html https://www.bsi.bund.de/EN/Topics/IT-Crisis-Management/CERT-...
- ktpsns 8y ago
  Actually I once got a mail by them, forwarded via several intermediate admins in a university network. It was an information about a public reachable DNS server on my server. Nowadays, this can be abused for DNS replay attacks or so. What a pity. Things where so easy 20 years ago.
mikecb 8y ago
Japan is doing this: https://www.zdnet.com/article/japanese-government-plans-to-hack-into-citizens-iot-devices/ https://www.zdnet.com/article/japanese-government-plans-to-h... In the US, DHS does this for the federal government, as well as some state and private organizations: https://www.us-cert.gov/resources/ncats https://www.us-cert.gov/resources/ncats
Forge36 8y ago
What's the best way to self scan? I recently bought a wifi camera and digging through the settings I couldn't find a way to block external access. Ultimately I had to block is access via my router, however consumer models are terrible about blocking access to the internet.
- bboreham 8y ago
  Most consumer routers will by default block a connection _from_ the Internet. They use a private address range and apply NAT to outgoing connections, so explicit configuration is needed to do something with an incoming connection.
  - duncaen 8y ago
    And that is why they implement UPnP to punch holes through it to avoid users having to manually configure routers.
  - corndoge 8y ago
    Say it with me NAT Is Not A Firewall
    - hmhhcycbtsc557 8y ago
      I believe you, but I have little expertise. Could you explain or give examples why?
      - IcePic 8y ago
        Some people would state "this box is not on the internet" while it actually is only behind nat. As soon as you have two such boxes being able to communicate, for instance "two laptops playing online together" you realize they ARE on the internet. With home-routers allowing UPNP and such things, its even more open than that. So the general idea that things will be safe from being behind nat is more or less wrong, unless you have 100% control over all possible traffic generated from the inner host(s), at which point you could have had it without firewall more or less. Will your robo-hover never phone home, never look for tuesday patches, java updates, OTA firmwares or talk to some license server or whatever? Then nat is ok, but if any of this can happen in some situation, then it is "on the internet" even if it started out behind nat. It moves a machine along the scale from unreachable closer to unprotected-and-exposed-to-everything even if it's not all the way there.
Raphael 8y ago
If only the NSA dragnet threw us a bone.

canadev 8y ago

it's like getting your kids vaccinated

lazyjones 8y ago

We don't need public institutions. It's the responsibility of ISPs to prevent security problems, spam zombie servers/appliances etc. in their networks, so they should perform these scans and warn first, then disconnect customers with problematic devices.

lifeisstillgood 8y ago
Charge per device access? And those devices need certificates of worthiness similar to cars MOT certificates (UK example) An interesting idea. What is the minimum viable "superhighway-fitness" of a device?
evrydayhustling 8y ago
I like the distributed spirit of this, but it only works where there is another layer holding the ISPs accountable - whether it's other ISPs or a government body. Right now their incentives are only to satisfy customers' perceived needs, which leaves nobody incentivized to prevent endpoint-to-endpoint harm.
groby_b 8y ago
But the ISPs are not held responsible. They can externalize costs to society, and so they do so - because that is what capitalism mandates. Without an institution that puts those costs back where they belong, nothing will change, because it is cheaper not to change. I'd recommend reading up on the Cuyahoga River, the Clean Water Act, and the formation of the EPA - it's pretty much the same problem. Industry creating problems by abdicating its responsibility, necessitating a legal solution. And enforcing that requires a public institution.

FrankDixon 8y ago

In germany the federal bureau of security in IT actually does that. They send the admins an email: https://www.bsi.bund.de/EN/Topics/IT-Crisis-Management/CERT-Bund/CERT-Reports/reports_node.html https://www.bsi.bund.de/EN/Topics/IT-Crisis-Management/CERT-...

ktpsns 8y ago
Actually I once got a mail by them, forwarded via several intermediate admins in a university network. It was an information about a public reachable DNS server on my server. Nowadays, this can be abused for DNS replay attacks or so. What a pity. Things where so easy 20 years ago.

mikecb 8y ago

Japan is doing this: https://www.zdnet.com/article/japanese-government-plans-to-hack-into-citizens-iot-devices/ https://www.zdnet.com/article/japanese-government-plans-to-h... In the US, DHS does this for the federal government, as well as some state and private organizations: https://www.us-cert.gov/resources/ncats https://www.us-cert.gov/resources/ncats

Forge36 8y ago

What's the best way to self scan? I recently bought a wifi camera and digging through the settings I couldn't find a way to block external access. Ultimately I had to block is access via my router, however consumer models are terrible about blocking access to the internet.

bboreham 8y ago
Most consumer routers will by default block a connection _from_ the Internet. They use a private address range and apply NAT to outgoing connections, so explicit configuration is needed to do something with an incoming connection.
- duncaen 8y ago
  And that is why they implement UPnP to punch holes through it to avoid users having to manually configure routers.
- corndoge 8y ago
  Say it with me NAT Is Not A Firewall
  - hmhhcycbtsc557 8y ago
    I believe you, but I have little expertise. Could you explain or give examples why?
    - IcePic 8y ago
      Some people would state "this box is not on the internet" while it actually is only behind nat. As soon as you have two such boxes being able to communicate, for instance "two laptops playing online together" you realize they ARE on the internet. With home-routers allowing UPNP and such things, its even more open than that. So the general idea that things will be safe from being behind nat is more or less wrong, unless you have 100% control over all possible traffic generated from the inner host(s), at which point you could have had it without firewall more or less. Will your robo-hover never phone home, never look for tuesday patches, java updates, OTA firmwares or talk to some license server or whatever? Then nat is ok, but if any of this can happen in some situation, then it is "on the internet" even if it started out behind nat. It moves a machine along the scale from unreachable closer to unprotected-and-exposed-to-everything even if it's not all the way there.

Raphael 8y ago

If only the NSA dragnet threw us a bone.