3 ms·
It's a pity there are no long-term effects from the cases like those. We've had a serious security vulnerability introduced in the firmware release, and there
by theamk 6y ago
It's a pity there are no long-term effects from the cases like those.
We've had a serious security vulnerability introduced in the firmware release, and there were no negative consequences for Zyxel at all, other than some bad press (and it's probably a fairly small amount of the bad press). What I would like to see is a post-mortem with mitigations -- how did this happen, and how will they prevent similar occurrences in the future. Instead, most likely nothing will happen. And I will not be surprised if the "firmware update account" will be back in the next release, probably still insecure, but hidden better so that random researchers won't stumble on it.
I wish there were some sort of liability for the manufacturers for the cases like those. For example, if a person runs a red light by accident and get caught, they get a fine and an insurance premium increase. We need something like this for IOT suppliers as well.
- 8organicbits 6y ago> but hidden better so that random researchers won't stumble on it. > 2020-12-02: Zyxel requests more information about how the vulnerability was discovered Hmm
- doesnt_know 6y agoThis is probably a fairly hot take but I believe that researchers shoudn't normanize providing this level of detail unless they have been explicitly hired to do so. The industry is pretty messed up and it sometimes feels like researchers/pen testers/bug hunters are effectively subsidizing and protecting shitty security practises.
- albntomat0 6y ago> The industry is pretty messed up and it sometimes feels like researchers/pen testers/bug hunters are effectively subsidizing and protecting shitty security practises. In my opinion, this is a result of there being little/no consequences of being breached due to incompetence. Zyxel isn’t losing anything from this, and has no incentives to be better.