4 ms·

Might as well call the PC a broken platform since you can install your own OS. Imo a platform is broken if the user can't control it.

vorpalhex 7y ago
This would be more akin to jailbreaking your nintendo switch and installing linux. An IOT platform that's intended to be secure can be tricked into revealing it's key. Most consumers aren't going to write custom firmware for their lightbulbs. Of course, I think this exploit is impractical for a lot of cases given how the ESP32 is typically used, but, ymmv.
- jdnenej 7y ago
  I didn't have to write Linux to benefit from an open platform. I didn't write openwrt either but benefit hugely from it.
- jdc 7y ago
  The point of locking out game consoles owners is to protect the software vendors. What's the point with IoT?
  - monocasa 7y ago
    To protect against clones that just install your software.
derefr 7y ago
One user's self is another user's attacker. This attack isn't one-time; if I can break into the hardware and change the keys such that I now control it, then someone else with temporary physical access can then break into my hardware and change the keys again, suborning "my" IoT device into e.g. a subtle wiretap. A computer anyone—not just the owner—can root given physical access, is like a lock that anyone—not just the owner—can non-tamper-evidently pick open. It really is broken.
- jdnenej 7y ago
  Almost all computing devices are broken when given physical access. And if they aren't it's just because someone hasn't worked it out yet or is broken secretly by governments.
  - marcoperaza 7y ago
    This is kind of a myth. There is such thing as tamperproof hardware components and they can protect against plenty of threats. Security isn’t all or nothing, it’s about understanding what the different threats are and adequately protecting against them. Not everyone is trying to protect against attackers with millions of dollars at their disposal. There is plenty of value to deterring 99% of attackers with physical access. The idea of security as all or nothing, and that physical access thus defeats all security measures, are security tropes that need to die. You can see how obviously wrong they are when you consider that just about every security system depends on proper behavior by trusted human beings, who are never 100% reliable.
    - Wowfunhappy 7y ago
      I don't disagree with other parts of your post, but I still think protecting against the scenario where an attacker has physical access to your computer is basically pointless. Especially if it comes with a very significant loss of freedom. If a malicious person has entered your home or workplace, access to your computer should be low on the list of worries.
      - baroffoos 7y ago
        Android handles this decently well it allows you to install whatever you want to the device but to unlock the device for custom firmware the device is first wiped so user data is perfectly safe.
      - derefr 7y ago
        Not every system is inside a home or workplace. ATMs. Parking meters. Building security/intercom systems. Digital billboards and transit information signage. These are the IoT devices that need to be hardened against physical access.
Rebelgecko 7y ago
> Might as well call the PC a broken platform since you can install your own OS. More like calling a PC broken if you can install your own OS even after you've enabled Secure Boot and a TPM (in which case, the security features are objectively broken)

vorpalhex 7y ago

This would be more akin to jailbreaking your nintendo switch and installing linux. An IOT platform that's intended to be secure can be tricked into revealing it's key. Most consumers aren't going to write custom firmware for their lightbulbs. Of course, I think this exploit is impractical for a lot of cases given how the ESP32 is typically used, but, ymmv.

jdnenej 7y ago
I didn't have to write Linux to benefit from an open platform. I didn't write openwrt either but benefit hugely from it.
jdc 7y ago
The point of locking out game consoles owners is to protect the software vendors. What's the point with IoT?
- monocasa 7y ago
  To protect against clones that just install your software.

derefr 7y ago

One user's self is another user's attacker. This attack isn't one-time; if I can break into the hardware and change the keys such that I now control it, then someone else with temporary physical access can then break into my hardware and change the keys again, suborning "my" IoT device into e.g. a subtle wiretap. A computer anyone—not just the owner—can root given physical access, is like a lock that anyone—not just the owner—can non-tamper-evidently pick open. It really is broken.

jdnenej 7y ago
Almost all computing devices are broken when given physical access. And if they aren't it's just because someone hasn't worked it out yet or is broken secretly by governments.
- marcoperaza 7y ago
  This is kind of a myth. There is such thing as tamperproof hardware components and they can protect against plenty of threats. Security isn’t all or nothing, it’s about understanding what the different threats are and adequately protecting against them. Not everyone is trying to protect against attackers with millions of dollars at their disposal. There is plenty of value to deterring 99% of attackers with physical access. The idea of security as all or nothing, and that physical access thus defeats all security measures, are security tropes that need to die. You can see how obviously wrong they are when you consider that just about every security system depends on proper behavior by trusted human beings, who are never 100% reliable.
  - Wowfunhappy 7y ago
    I don't disagree with other parts of your post, but I still think protecting against the scenario where an attacker has physical access to your computer is basically pointless. Especially if it comes with a very significant loss of freedom. If a malicious person has entered your home or workplace, access to your computer should be low on the list of worries.
    - baroffoos 7y ago
      Android handles this decently well it allows you to install whatever you want to the device but to unlock the device for custom firmware the device is first wiped so user data is perfectly safe.
    - derefr 7y ago
      Not every system is inside a home or workplace. ATMs. Parking meters. Building security/intercom systems. Digital billboards and transit information signage. These are the IoT devices that need to be hardened against physical access.

Rebelgecko 7y ago

> Might as well call the PC a broken platform since you can install your own OS. More like calling a PC broken if you can install your own OS even after you've enabled Secure Boot and a TPM (in which case, the security features are objectively broken)