4 ms·
How do you, as a user, determine whether your oven is in "safe mode" that the manufacturer has toggled, or in "safe mode" that makes the UI look the same as the
by klausa 3y ago
How do you, as a user, determine whether your oven is in "safe mode" that the manufacturer has toggled, or in "safe mode" that makes the UI look the same as the real one, but is actually a malicious code that waits until 3AM to start the cleaning mode?
I agree that these scenarios are (relatively) far fetched _now_; but if we expect the future to include connecting appliances like that to the internet, then solving problems like those is table-stakes stuff.
I understand that enforced software updates are annoying; but for high-stakes environments like this they strike me as a lesser of the two evils.
- hot_gril 3y agoIf the attacker has total control, then all bets are off no matter what mechanisms you put in first. Adding a safe mode would at least allow manufacturer to stop any non-total exploit without relying on the more complicated update mechanism. Also, the appliance would more likely work in a kinda normal way in the meantime.
- klausa 3y ago>If the attacker has total control, then all bets are off no matter what mechanisms you put in first. Great, so we now agree that it's important to keep the system patched and up to date.
- fragmede 3y agoThat depends on updates never introducing new vulnerabilities.
- deleted 3y ago[deleted]
- hot_gril 3y agoI didn't say otherwise. Only that a forced update mechanism is insufficient for stakes as high as burning down the house. Maybe the patch fails to download/install, or they take too long to develop the patch in the first place, or the patch doesn't work for all models on the first try. There needs to be a simple kill switch if we're talking about threats like this. Besides that, the safe mode oven should still be able to cook food manually.
- Attrecomet 3y agoJust as smart people agree that the manufacturer knows nothing about the situation at the appliance, and a forced update mechanism a la the first iteration of Windows forced updated ("update's here, restarting, too bad you're currently doing important stuff that won't be saved") is a stupid idea and outside of private use often a non-starter. That kind of condescension is generally only something you can do to private tech users. Though I guess making the experience frustrating could keep more people from needlessly connecting everything to the network because it sound futuristic...
- chmod775 3y ago> If the attacker has total control, then all bets are off no matter what mechanisms you put in first. You could have a second SoC on the device running off ROM, whose only purpose is handling this safe mode and controlling internet access of the main device. Keep it simple and make it essentially just a fuse that can be blown (turning off internet access) by a signed message from the manufacturer. Keep the hardware capability of this SoC to just that, so even if you have a vulnerability on that thing itself, an attacker can't really do anything with it. Keep the code running on that SoC simple and preferably make it a FSM that is proven to be free of vulnerabilities. Also make sure the main device can't interfere with it in any way. Once the fuse is blown, the user needs to press a physical button on the device to re-enable internet access. Preferably ship the devices with this internet access disabled by default. Even better yet, don't build an internet connected oven... but that ship has sailed in many areas.
- hot_gril 3y agoIdeally yeah, the bar for critical appliances would be high enough for this. If not, disabling IP at the OS level would still be pretty good.