3 ms·

The solution would be quite easy: Disallow devices (and software, too) from phoning home. Disallow remote firmware updates. I predict that such a law would als

The solution would be quite easy: Disallow devices (and software, too) from phoning home. Disallow remote firmware updates. I predict that such a law would also be very popular with the citizens because people hate it when an automated software update breaks their workflow. And remote car firmware changes could be quite dangerous, too. https://twitter.com/anjilslaire/status/1537622856724426752 https://twitter.com/anjilslaire/status/1537622856724426752 And some companies have been pretty notorious with their bait and switch, like the ad-free Samsung $10k TVs that got "updated" with popup advertisements a year later. And all that e-waste from IoT products that no longer work because the manufacturer decided to turn off their servers. https://twitter.com/doctorow/status/1516144514984923139 https://twitter.com/doctorow/status/1516144514984923139 BTW, I like reading https://twitter.com/internetofshit https://twitter.com/internetofshit just to feel lucky that I didn't buy any of it :)

Kuinox 4y ago
Until you get your firmware remotely updated by a malware exploiting security vulnerability.
deleted 4y ago
[deleted]
evilos 4y ago
But how could you ever really be sure that the device couldn't take an update assuming it must be connected to a network in order to fulfill its function? Hardware is so complex these days it's not really feasible to prove negatives.
- fxtentacle 4y ago
  My first idea would be a government bug bounty. If you catch any of your own device doing that, you report it to a government agency and they'll check in their database if your finding is new, and if it is, they will immediately pay you $10k and announce it publicly. And then afterwards, the government can fine the manufacturer $100k to recoup their costs. Also, most of the updates that people hate have been pretty blatant. Like when your TV starts showing ads when it was ad-free before, it is pretty obvious that something changed.
  - evilos 4y ago
    Seems you're more focused on the "my consumer device does new stuff I don't like" issue whereas I'm more focused on the "my nation's telecommunications backbone has a malicious FPGA hidden somewhere so it can man-in-the-middle critical communications" aspect.
    - fxtentacle 4y ago
      I'm pretty sure if you offer a high enough bounty, some of the people working to deploy your infrastructure will go searching for those FPGAs. Also, I expect enthusiast users and large companies to purchase similar devices as small telcos. Scorned network administrators are probably even better bounty hunters. But yes, I was focusing mostly on the end-user aspect because if you want to create such a law, you need your citizens to like the idea.
      - evilos 4y ago
        IMO proposing we "disallow remote updates" because we don't know what backdoors could be sneaked into devices is akin to proposing we outlaw fudging spreadsheets because we don't trust accountants. It's not really practical or enforceable. If a world power wants to hide something nasty in silicon or software, a bug bounty program isn't going to cut it. Maybe if the government had a genius-savant who could stare at silicon dies and find malicious circuits.
    - ryanmercer 4y ago
      >"my nation's telecommunications backbone has a malicious FPGA hidden somewhere so it can man-in-the-middle critical communications" Not just that, for about a decade now I've had a thought that you could just have a chip "self-destruct" when a signal goes out and bam a chip re-writes itself to be bricked. If you bake this into some common chip (or just include it in a firmware update), or something used in say backbone level network hardware, or something in millions of cellphones you could send out the instruction in some previously routine traffic to and from the mothership and then a clock starts counting down. You build in long enough of a delay to ensure you get most devices to receive the signal, say a week or even a month, and you suddenly cripple millions of devices and create mild to moderate chaos which gives gives you a leg up for an invasion or has a massive impact on the markets, or cripples internet access for a large area for weeks or months until hardware can be replaced.
AndyMcConachie 4y ago
> The solution would be quite easy: Disallow devices (and software, too) from phoning home. Disallow remote firmware updates. But then how will network operators outsource all of their infrastructure maintenance to vendors? That's the problem. We have this naive idea that companies running networks employ staff to manage their networks. In reality, it hasn't been like that in a while because there has been a tremendous push in the industry to outsource everything to third parties. So the person who owns the cell tower likely has no idea who is maintaining it, much less has that person on their payroll.
- fxtentacle 4y ago
  Precisely :) This should be a political discussion: Do we want US internet infrastructure to be remote-controlled from China, in exchange for cost savings? Or do we mandate US internet infrastructure providers to train their own US-based employees? Looking at Comcast's 36% gross profit margin, I don't think they would have any issues employing +100 network engineers to maintain their phone systems themselves ;) They just don't want to.
- 1over137 4y ago
  Really? That's depressing. I wonder if it partly explains how Rogers (in Canada) was down for so long the other week...
rob_c 4y ago
Welcome to a security nightmare the likes of which we've not seen before... No implementation is perfect and it just takes one determined clever person to break or weaken wpa2 a bit more and it would be chaos. Banning the devices all together because they're not worth a dam and are a security nightmare when not setup correctly though. Now there's an idea.

Kuinox 4y ago

Until you get your firmware remotely updated by a malware exploiting security vulnerability.

deleted 4y ago

[deleted]

evilos 4y ago

But how could you ever really be sure that the device couldn't take an update assuming it must be connected to a network in order to fulfill its function? Hardware is so complex these days it's not really feasible to prove negatives.

fxtentacle 4y ago
My first idea would be a government bug bounty. If you catch any of your own device doing that, you report it to a government agency and they'll check in their database if your finding is new, and if it is, they will immediately pay you $10k and announce it publicly. And then afterwards, the government can fine the manufacturer $100k to recoup their costs. Also, most of the updates that people hate have been pretty blatant. Like when your TV starts showing ads when it was ad-free before, it is pretty obvious that something changed.
- evilos 4y ago
  Seems you're more focused on the "my consumer device does new stuff I don't like" issue whereas I'm more focused on the "my nation's telecommunications backbone has a malicious FPGA hidden somewhere so it can man-in-the-middle critical communications" aspect.
  - fxtentacle 4y ago
    I'm pretty sure if you offer a high enough bounty, some of the people working to deploy your infrastructure will go searching for those FPGAs. Also, I expect enthusiast users and large companies to purchase similar devices as small telcos. Scorned network administrators are probably even better bounty hunters. But yes, I was focusing mostly on the end-user aspect because if you want to create such a law, you need your citizens to like the idea.
    - evilos 4y ago
      IMO proposing we "disallow remote updates" because we don't know what backdoors could be sneaked into devices is akin to proposing we outlaw fudging spreadsheets because we don't trust accountants. It's not really practical or enforceable. If a world power wants to hide something nasty in silicon or software, a bug bounty program isn't going to cut it. Maybe if the government had a genius-savant who could stare at silicon dies and find malicious circuits.
  - ryanmercer 4y ago
    >"my nation's telecommunications backbone has a malicious FPGA hidden somewhere so it can man-in-the-middle critical communications" Not just that, for about a decade now I've had a thought that you could just have a chip "self-destruct" when a signal goes out and bam a chip re-writes itself to be bricked. If you bake this into some common chip (or just include it in a firmware update), or something used in say backbone level network hardware, or something in millions of cellphones you could send out the instruction in some previously routine traffic to and from the mothership and then a clock starts counting down. You build in long enough of a delay to ensure you get most devices to receive the signal, say a week or even a month, and you suddenly cripple millions of devices and create mild to moderate chaos which gives gives you a leg up for an invasion or has a massive impact on the markets, or cripples internet access for a large area for weeks or months until hardware can be replaced.

AndyMcConachie 4y ago

> The solution would be quite easy: Disallow devices (and software, too) from phoning home. Disallow remote firmware updates. But then how will network operators outsource all of their infrastructure maintenance to vendors? That's the problem. We have this naive idea that companies running networks employ staff to manage their networks. In reality, it hasn't been like that in a while because there has been a tremendous push in the industry to outsource everything to third parties. So the person who owns the cell tower likely has no idea who is maintaining it, much less has that person on their payroll.

fxtentacle 4y ago
Precisely :) This should be a political discussion: Do we want US internet infrastructure to be remote-controlled from China, in exchange for cost savings? Or do we mandate US internet infrastructure providers to train their own US-based employees? Looking at Comcast's 36% gross profit margin, I don't think they would have any issues employing +100 network engineers to maintain their phone systems themselves ;) They just don't want to.
1over137 4y ago
Really? That's depressing. I wonder if it partly explains how Rogers (in Canada) was down for so long the other week...

rob_c 4y ago

Welcome to a security nightmare the likes of which we've not seen before... No implementation is perfect and it just takes one determined clever person to break or weaken wpa2 a bit more and it would be chaos. Banning the devices all together because they're not worth a dam and are a security nightmare when not setup correctly though. Now there's an idea.