4 ms·

It seems like they're just saying: - China makes most of the drones - A lot of them aren't very secure Which isn't surprising to me considering the state of

It seems like they're just saying: - China makes most of the drones - A lot of them aren't very secure Which isn't surprising to me considering the state of things like DVR cameras (also mostly made by China, also plagued with security issues) and similar tech. The real problem is that consumers want cheap but quality and security aren't cheap. The cost of security isn't obvious and consumers don't really know how to evaluate it. But, when things like drones and cameras start communicating over the 5G backbone then we should maybe be concerned about who controls both of them.

gregmac 7y ago
> start communicating over the 5G backbone 5G operates at OSI layer 1 (and maybe has some impact on layer 2). I've never heard of any aspect of it changing higher layers, which is where the concerns about control come in. Is there something I'm missing? If not, 5G has nothing to do with application-level control (eg: controlling a drone's movements, intercepting a camera feed, etc). We'll still use TCP/IP, HTTPS, and everything else we use today. It may or may not be a concern right now (due to inadequate security at the higher OSI layers), but 5G -- or any other type of network topology -- does not change this. Please don't spread this type of psuedo-technical nonsense by making statements like this, especially with anything "5G" which is a current media fascination for some reason (starting to get bored with "IoT" maybe?).
- wybiral 7y ago
  That's not what I was suggesting at all. If you control the cell infrastructure you absolutely can put cellular capabilities into products that aren't explicitly advertised. That would be a bigger risk for surveillance tech. Your complaint ignores my original statement about controlling both components (cellular and device). There is no need to tamper with someone else's TLS-secured communications or anything, you can just plant cellular capabilities into the devices.
  - gregmac 7y ago
    I didn't pick up that's what you meant by "both of them" so sorry for my misunderstanding. However I still don't think 5G is an important factor here. If you control both ends at a higher layer of the stack (eg, it's your own software connecting to your own servers) you can do whatever you'd like. If you have OTA software updates, you can do whatever you like at any point in the future. If this channel is properly secured with TLS no one can intercept or fake it, and if you want, you can design the devices so it won't work without this connectivity present (see: most cloud-based "smart home" devices on the market today). > If you control the cell infrastructure you absolutely can put cellular capabilities into products that aren't explicitly advertised. That would be a bigger risk for surveillance tech. So many devices already have internet connectivity built-in, and if money is not a concern you can already incorporate a GSM modem and pay for a link to the existing cellular networks -- it's not like AT&T (or whoever) is going to care what you are doing with the connection, so long as you're paying for it. You can also use other short-range radio links. I'll grant you that 5G introduces the possibility to have this link without AT&T's knowledge -- at least assuming they don't have the ability to also detect the traffic coming out the tower's uplink. The big downside of this attack vector, aside from the immense cost and complexity of building this into 5G carrier equipment and all these devices, is if detected and blocked at the uplink all that effort is suddenly for nothing. Basically, the 5G-specific attack vector is expensive and brittle, and thus pretty unlikely. The attack vector at application level is easy and cheap (no hardware-related costs), gets you almost all the same capabilities, and in many cases can be done today on existing in-field products with OTA software updates.
libertine 7y ago
> The real problem is that consumers want cheap but quality and security aren't cheap. I think it's well accepted that there's high quality standards in China (there's the whole range of quality) - for drones DJI has been a reference for example. But tech security is such an intangible thing that most of the population doesn't understand it. And in all honesty it seems that there's no protocol, or standard procedure, or evaluation of tech goods that come to the market and must pass security testing. For example, with GDPR, at least a framework came out for data protection and protocols were set in place. The adoption was and still is chaotic for a lot of organizations, and it has plenty of flaws - but it is indeed something that's working towards a goal. So far, in terms of security, it's like there's nothing in place.

gregmac 7y ago

> start communicating over the 5G backbone 5G operates at OSI layer 1 (and maybe has some impact on layer 2). I've never heard of any aspect of it changing higher layers, which is where the concerns about control come in. Is there something I'm missing? If not, 5G has nothing to do with application-level control (eg: controlling a drone's movements, intercepting a camera feed, etc). We'll still use TCP/IP, HTTPS, and everything else we use today. It may or may not be a concern right now (due to inadequate security at the higher OSI layers), but 5G -- or any other type of network topology -- does not change this. Please don't spread this type of psuedo-technical nonsense by making statements like this, especially with anything "5G" which is a current media fascination for some reason (starting to get bored with "IoT" maybe?).

wybiral 7y ago
That's not what I was suggesting at all. If you control the cell infrastructure you absolutely can put cellular capabilities into products that aren't explicitly advertised. That would be a bigger risk for surveillance tech. Your complaint ignores my original statement about controlling both components (cellular and device). There is no need to tamper with someone else's TLS-secured communications or anything, you can just plant cellular capabilities into the devices.
- gregmac 7y ago
  I didn't pick up that's what you meant by "both of them" so sorry for my misunderstanding. However I still don't think 5G is an important factor here. If you control both ends at a higher layer of the stack (eg, it's your own software connecting to your own servers) you can do whatever you'd like. If you have OTA software updates, you can do whatever you like at any point in the future. If this channel is properly secured with TLS no one can intercept or fake it, and if you want, you can design the devices so it won't work without this connectivity present (see: most cloud-based "smart home" devices on the market today). > If you control the cell infrastructure you absolutely can put cellular capabilities into products that aren't explicitly advertised. That would be a bigger risk for surveillance tech. So many devices already have internet connectivity built-in, and if money is not a concern you can already incorporate a GSM modem and pay for a link to the existing cellular networks -- it's not like AT&T (or whoever) is going to care what you are doing with the connection, so long as you're paying for it. You can also use other short-range radio links. I'll grant you that 5G introduces the possibility to have this link without AT&T's knowledge -- at least assuming they don't have the ability to also detect the traffic coming out the tower's uplink. The big downside of this attack vector, aside from the immense cost and complexity of building this into 5G carrier equipment and all these devices, is if detected and blocked at the uplink all that effort is suddenly for nothing. Basically, the 5G-specific attack vector is expensive and brittle, and thus pretty unlikely. The attack vector at application level is easy and cheap (no hardware-related costs), gets you almost all the same capabilities, and in many cases can be done today on existing in-field products with OTA software updates.

libertine 7y ago

> The real problem is that consumers want cheap but quality and security aren't cheap. I think it's well accepted that there's high quality standards in China (there's the whole range of quality) - for drones DJI has been a reference for example. But tech security is such an intangible thing that most of the population doesn't understand it. And in all honesty it seems that there's no protocol, or standard procedure, or evaluation of tech goods that come to the market and must pass security testing. For example, with GDPR, at least a framework came out for data protection and protocols were set in place. The adoption was and still is chaotic for a lot of organizations, and it has plenty of flaws - but it is indeed something that's working towards a goal. So far, in terms of security, it's like there's nothing in place.