3 ms·

Or, mandatory 3rd party liability insurance for anyone operating an internet connection. Insurance premium discounts for running only security-audited devices.

by jl6 5y ago

gizdan 5y ago
Users shouldn't be punished by the negligence of manufacturers. Sure the majority of HN will know to ensure they run secure products or something, but you can't expected nana to know that. She just wants to talk to some device to help her a little.
- jl6 5y ago
  A good way to teach people to run secure products is to charge them more for running insecure products. The general public can’t distinguish between secure and insecure products, but they can read a list of products that are covered by the $0.99/month insurance plan, and anything not on that list you need the $1.99/month plan. DDoS victims can then make a claim against the insurance companies (who own the liability arising from each IP address; ISPs can de-NAT), a court can evaluate the evidence if necessary, and the insurance providers pay out. N.B. It’s actually experts who would be penalized most by this scheme, because if you do something like run a customized FreeBSD box, it’s unlikely to appear on the audited-device list.
  - Nextgrid 5y ago
    > N.B. It’s actually experts who would be penalized most by this scheme, because if you do something like run a customized FreeBSD box, it’s unlikely to appear on the audited-device list. The "audit" can be as simple as the insurance company running automated pentests trying published exploits and passwords. That would still achieve the desired goal (the majority of botnets spread via well-known vulnerabilities and/or bruteforced credentials, custom equipment where manual effort is needed on the attacker's part are a minority) while allowing enthusiasts to run custom hardware.
  - briffle 5y ago
    How can a home user protect themselves from this, when most manufactures only release a very, shockingly small number of firmware updates, and don't notify users of the updates?
    - jl6 5y ago
      The current state of affairs arises because insecurity is an externality that is not considered by consumers. As soon as security has a monetary value, consumers will start to demand it and manufacturers will start to meet that demand.
bink 5y ago
IMHO this would be an easier problem to address with a voluntary body that coordinates among ISPs or (cringe) a govt. agency. I worked for a popular service that regularly received DDoS attacks from botnets. We had logs with the IPs of tens of thousands of vulnerable devices. If you scanned them you could see the vast majority were compromised routers, VPNs, or IoT devices. Most of them had open proxies installed and were easy to identify as compromised. For the larger ones we could reach out and get them shut down (usually). But we didn't have time to contact thousands of ISPs. I would've been happy to forward those logs, even with verification of compromise, to an independent body that could follow up and get them shut down. Even if a small fraction of ISPs didn't comply it would still remove the majority of compromised devices. Most of the companies we contacted were more than happy to get rid of problematic hosts and acted quickly. They just didn't have the expertise to monitor for such things themselves. It would all have to be voluntary, of course, but it could be done. This is the type of thing that I think CERT was originally intended for, but for whatever reason doesn't seem to handle.
- gingerlime 5y ago
  Something like https://www.spamhaus.org/xbl/ https://www.spamhaus.org/xbl/ ? I wonder if there are other RBLs worth subscribing to and blocking. As an end user with a compromised device, it might be frustrating though... but then they probably should know and do something about it.

Or, mandatory 3rd party liability insurance for anyone operating an internet connection. Insurance premium discounts for running only security-audited devices.

by jl6 5y ago

Or, mandatory 3rd party liability insurance for anyone operating an internet connection. Insurance premium discounts for running only security-audited devices.

gizdan 5y ago

Users shouldn't be punished by the negligence of manufacturers. Sure the majority of HN will know to ensure they run secure products or something, but you can't expected nana to know that. She just wants to talk to some device to help her a little.

jl6 5y ago
A good way to teach people to run secure products is to charge them more for running insecure products. The general public can’t distinguish between secure and insecure products, but they can read a list of products that are covered by the $0.99/month insurance plan, and anything not on that list you need the $1.99/month plan. DDoS victims can then make a claim against the insurance companies (who own the liability arising from each IP address; ISPs can de-NAT), a court can evaluate the evidence if necessary, and the insurance providers pay out. N.B. It’s actually experts who would be penalized most by this scheme, because if you do something like run a customized FreeBSD box, it’s unlikely to appear on the audited-device list.
- Nextgrid 5y ago
  > N.B. It’s actually experts who would be penalized most by this scheme, because if you do something like run a customized FreeBSD box, it’s unlikely to appear on the audited-device list. The "audit" can be as simple as the insurance company running automated pentests trying published exploits and passwords. That would still achieve the desired goal (the majority of botnets spread via well-known vulnerabilities and/or bruteforced credentials, custom equipment where manual effort is needed on the attacker's part are a minority) while allowing enthusiasts to run custom hardware.
- briffle 5y ago
  How can a home user protect themselves from this, when most manufactures only release a very, shockingly small number of firmware updates, and don't notify users of the updates?
  - jl6 5y ago
    The current state of affairs arises because insecurity is an externality that is not considered by consumers. As soon as security has a monetary value, consumers will start to demand it and manufacturers will start to meet that demand.

bink 5y ago

IMHO this would be an easier problem to address with a voluntary body that coordinates among ISPs or (cringe) a govt. agency. I worked for a popular service that regularly received DDoS attacks from botnets. We had logs with the IPs of tens of thousands of vulnerable devices. If you scanned them you could see the vast majority were compromised routers, VPNs, or IoT devices. Most of them had open proxies installed and were easy to identify as compromised. For the larger ones we could reach out and get them shut down (usually). But we didn't have time to contact thousands of ISPs. I would've been happy to forward those logs, even with verification of compromise, to an independent body that could follow up and get them shut down. Even if a small fraction of ISPs didn't comply it would still remove the majority of compromised devices. Most of the companies we contacted were more than happy to get rid of problematic hosts and acted quickly. They just didn't have the expertise to monitor for such things themselves. It would all have to be voluntary, of course, but it could be done. This is the type of thing that I think CERT was originally intended for, but for whatever reason doesn't seem to handle.

gingerlime 5y ago
Something like https://www.spamhaus.org/xbl/ https://www.spamhaus.org/xbl/ ? I wonder if there are other RBLs worth subscribing to and blocking. As an end user with a compromised device, it might be frustrating though... but then they probably should know and do something about it.