5 ms·
The trade war won't fix issues with OTA as a vulnerability. It is useful for the US to point it out to tip things in their favor so it gets a lot of coverage.
by Junk_Collector 7y ago
The trade war won't fix issues with OTA as a vulnerability. It is useful for the US to point it out to tip things in their favor so it gets a lot of coverage.
I also agree with you that the solution to OTA updates is tight control, but that isn't realistic either. They are talking about drones in the article. These are devices bought and run by companies that build infrastructure in the US but are not directly related to the government. They want OTA because it has legitimate benefits in worker time and cost savings and helps keep their "fleet" running with all the latest features.
Now, an example attack might be an OTA update for the drone controller to shunt mapping data back to home base in China to give them high quality military maps of infrastructure for attack planning. The attack might be unrealistic, but the spying threat isn't. Alternatively, if car autopilot takes off, imagine the economic damage an OTA attack could do that causes 30% of the traffic in the US to just stop. To prevent this sort of attack, you would have to review ALL code coming out of China since you can't directly hold them responsible after the fact when they are out of your sovereign jurisdiction. The kind of dedicated and educated workforce required to code check all firmware/software updates for such huge classes of consumer products is just not going to happen and it can only get worse.
Intel ME is an abomination, but it's also well known and gets a lot of coverage. It's just not in the mainstream news right this minute.
- simion314 7y ago>Intel ME is an abomination, but it's also well known and gets a lot of coverage. It's just not in the mainstream news right this minute. It was probably only a topic on technical forums. Technical question, can't you build a drone that does not need OTA updates from manufacturer ? You have it connect only to your trusted IPs. Also sending the high definition photos to China won't appear on anybody network traffic? You just need 1 person to detect it and you have the some kind of proof(though when a similar thing happened with Amazon Alexa it was blamed as a bug and not espionage).
- Junk_Collector 7y ago>Technical Question Of course you can, but even then you're still trusting the firmware that is being put out by the potentially hostile company even if you gate keep it. To check it would require a software team at least as large as the potentially hostile one for any serious attack. That's a big economic incentive to trust the manufacturer. >sending the high definition photos Or you could just send metadata, telemetry, and flight diagnostics that can be used to build up sensitive information under the guise of metrics. Remember that the NSA was mostly just using metadata too. >it was blamed as a bug and not espionage In these cases, the two look exactly the same in software, so proving one or the other is very difficult.
- simion314 7y agoSo from your points all Chinese products should be made illegal until China will not be a threat to US, this means until China collapses or kisses US butt.
- usrusr 7y ago> You have it connect only to your trusted IPs. Wi-Fi makes that pretty damn hard to verify. In theory, malicious firmware could even opportunistically link up with other malicious firmware acting as a bridge via some undocumented protocol that would only be detectable by looking at the raw spectrum.
- simion314 7y agoyeah, but we should think and implement security measures in all systems indifferent of politics and economics. Imagine some terrorists hacks Tesla server and sends a command for all cars to crash. We would need all important systems to be designed in the assumption that something bad will eventually happened(hackers, company goes out of business, stupidly(see Firefox addons issue) ) etc