4 ms·
In the fall of 2016 I had a lengthy email exchange with an industrial automation vendor who didn't understand this issue. I even mailed them a short Python proo
by anilakar 6y ago
In the fall of 2016 I had a lengthy email exchange with an industrial automation vendor who didn't understand this issue. I even mailed them a short Python proof-of-concept snippet that slept a few milliseconds between the write() calls and in response got back my code "fixed" with the sleep removed.
In between the emails I googled a bit and found the changelogs for the RTOS they were using. Turned out that it was a bug in the upstream HTTP server. This also meant that the platform they were using had all the security holes from those five-plus years. The bug was later silently fixed when they acquired a newer release from upstream.
Currently I'm having a similar issue with the very same vendor. This time they don't understand why client-side authentication means no authentication at all and why passwords must not be stored in plain text in the database that can be remotely backed up from the device.
- throwaway_pdp09 6y agoHow do you not kill these people? How do you put up with it? How do vendors like this survive?
- maartenh 6y agoJust like in nature, they survive because they are good enough, and don't experience enough competition to be eliminated by selection.
- jolmg 6y agoDepending on what kind of vendor we're talking about, it might be that such aspects aren't even part of what makes them competitive. The average user is not going to know about these types of issues, and so they're not even going to consider such issues when evaluating the vendor.
- the8472 6y agofull disclosure could put some selective pressure on them.
- heavenlyblue 6y agoI would assume the “free market” here is that these companies will over-extend themselves so much that they will no longer be able to hide the bugs from the malicious parties and their devices will start getting hacked en masse. I would assume, however, that there is no law forcing minimal security so you can class A them, can you?
- ink_13 6y agoJust about every industrial automation vendor is like this in my experience. They never upgrade because they don't want to break anything.
- bsder 6y agoIn inverse order: Because nobody gives a shit about quality unless it hits their paycheck. "Onnnngggg. They pay me hourly. Onnnngggg." They cut lots of checks.
- irrational 6y agoWhy don't you tell us the vendor's name? It seems like the responsible thing to do.
- anilakar 6y agoEven after the bug gets fixed, it'll probably take years for all the embedded devices in the public internet to get patched, so no.
- laughinghan 6y agoBut in the meantime, won't the vendor keep adding more broken devices to the public internet, making the problem worse? The longer it takes for this problem to become public, won't the more harm be caused when it does become public?
- loopz 6y agoWe're just waiting for the free market to kick in.
- outworlder 6y ago> This time they don't understand why client-side authentication means no authentication at all I've seen this... with an intern! I can't imagine dealing with a whole team like that.