5 ms·

So, why is IoT security like this? Is it just people who aren't used to deploying to a maliciously hostile environment suddenly having to deal with that? I've

So, why is IoT security like this? Is it just people who aren't used to deploying to a maliciously hostile environment suddenly having to deal with that? I've heard that hardware-side pay tends to be lower than software-side, so is it hardware companies not wanting to pay for experienced software people? Is it actually not any worse than typical software, but just more noticeable because meatspace?

spywaregorilla 5y ago
It's because people who aren't used to deploying to a maliciously hostile environment don't deal with it and deploy anyway
AlotOfReading 5y ago
In my experience it's a combination of a few things. First is time. Consumer electronics has very aggressive release schedules and development cost constraints. That means the software is usually the cheapest, quickest junk someone could throw together. There usually isn't the time or the money to create the kinds of process infrastructure that allows you to produce secure code. Worse, vendor support on much of this stuff is usually outdated garbage and the more deeply embedded, the worse it is. Also there are just some plain bad practices floating around. I once had a manager who refused to allow version control and would simply remote into my computer overnight to delete any files they didn't personally like. Think any careful, security-conscious work got done in that environment?
- elliekelly 5y ago
  I think part of it too is that they don’t have to care. Most customers don’t know enough to care and they don’t have any legal obligations with respect to security so why bother?
- gridspy 5y ago
  Wow. My commiserations! Ironically such paranoid control of file use must have left you wanting to "back up" your work onto alternate storage. Naturally said backups would go offsite with you each night.
  - AlotOfReading 5y ago
    I ended up just using a personal git server. I believe the company dissolved not long after I left, so those private repos may be all that's left of it.
ThrowawayR2 5y ago
> "So, why is IoT security like this?" Cheap consumer IoT devices cut corners on everything so the developers too just do the absolute minimum to make it work, security be damned. For industrial / commercial IoT devices, you have both low-level (e.g. device driver) devs who know squat about running a secure network making design decisions and customers with extremely low quality IT staff who also make poor design decisions with respect to security and also ignore firmware updates even when they contain security fixes. It's just a mess all around.
ikr678 5y ago
Hardware side anything will always have higher fixed costs (unit production, physical QA, more healt & safety &compliance testing) and lower margins compared to a 100% software company.
rsynnott 5y ago
In the early days of Android smartphones, there were a lot of very basic security holes: https://forum.xda-developers.com/t/root-security-root-exploit-on-exynos.2048511/ https://forum.xda-developers.com/t/root-security-root-exploi... I always attributed it to consumer electronics company developers who'd never previously had to touch the icky internet not realizing how dangerous it was; this was the sort of mistake that the likes of Microsoft were making in the late 90s. I expect the state of IoT security is similar; as it matures it'll improve.

spywaregorilla 5y ago

It's because people who aren't used to deploying to a maliciously hostile environment don't deal with it and deploy anyway

AlotOfReading 5y ago

In my experience it's a combination of a few things. First is time. Consumer electronics has very aggressive release schedules and development cost constraints. That means the software is usually the cheapest, quickest junk someone could throw together. There usually isn't the time or the money to create the kinds of process infrastructure that allows you to produce secure code. Worse, vendor support on much of this stuff is usually outdated garbage and the more deeply embedded, the worse it is. Also there are just some plain bad practices floating around. I once had a manager who refused to allow version control and would simply remote into my computer overnight to delete any files they didn't personally like. Think any careful, security-conscious work got done in that environment?

elliekelly 5y ago
I think part of it too is that they don’t have to care. Most customers don’t know enough to care and they don’t have any legal obligations with respect to security so why bother?
gridspy 5y ago
Wow. My commiserations! Ironically such paranoid control of file use must have left you wanting to "back up" your work onto alternate storage. Naturally said backups would go offsite with you each night.
- AlotOfReading 5y ago
  I ended up just using a personal git server. I believe the company dissolved not long after I left, so those private repos may be all that's left of it.

ThrowawayR2 5y ago

> "So, why is IoT security like this?" Cheap consumer IoT devices cut corners on everything so the developers too just do the absolute minimum to make it work, security be damned. For industrial / commercial IoT devices, you have both low-level (e.g. device driver) devs who know squat about running a secure network making design decisions and customers with extremely low quality IT staff who also make poor design decisions with respect to security and also ignore firmware updates even when they contain security fixes. It's just a mess all around.

ikr678 5y ago

Hardware side anything will always have higher fixed costs (unit production, physical QA, more healt & safety &compliance testing) and lower margins compared to a 100% software company.

rsynnott 5y ago

In the early days of Android smartphones, there were a lot of very basic security holes: https://forum.xda-developers.com/t/root-security-root-exploit-on-exynos.2048511/ https://forum.xda-developers.com/t/root-security-root-exploi... I always attributed it to consumer electronics company developers who'd never previously had to touch the icky internet not realizing how dangerous it was; this was the sort of mistake that the likes of Microsoft were making in the late 90s. I expect the state of IoT security is similar; as it matures it'll improve.