4 ms·

On the other hand, it's exposing just how sloppy devices are with their wireless signals + code handlers. IIRC this is in Canada, but in US (and probably Canad

On the other hand, it's exposing just how sloppy devices are with their wireless signals + code handlers. IIRC this is in Canada, but in US (and probably Canada too), FCC has rules against creating harmful interference. Fine + punish the people creating the interference, rather than the tools that people can use to learn, debug + protect these devices that are vulnerable.

Kuinox 3y ago
Security is needed because somes doesn't want to play by the rules. If nobody try to breaking in, why bother putting a lock on your door ?
dymk 3y ago
That's like saying any infrastructure is sloppily done because it's vulnerable to DDoS attacks. DDoS attacks are already illegal, but people still perform attacks. That's not the site operator's fault, and it's victim blaming.
- kstrauser 3y ago
  Except here "DDoS" means "one person with a $200 radio". I don't expect my devices to stand up to prolonged attacks against state actors. I do hope they can survive someone sending them invalid packets.
  - dymk 3y ago
    Oh they'll survive invalid packets. It's the sheer amount of packets that are the problem, and wireless signals are just inherently hard to protect against malicious jamming.
    - kstrauser 3y ago
      That's not true. Again, forget jamming for a little bit. You can build a jammer with any random spark gap transmitter. The novel attacks are one where a Flipper Zero can send an iPhone 1,000 "hey, I'm an Apple TV, wanna hang out?" messages in a row and the phone acts on each of them. Even if you space those messages out so that they only take a tiny percent of available throughput, the phone's response to the messages will still make it unusable. Because such a flood is now easy to trigger, phones now implement rate limiting that effectively mitigates the attacks. After all, you're not legitimately going to see 1,000 Apple TVs trying to connect at once, so there's no need to give each one of them personal attention.
dmonitor 3y ago
There is nothing this can do that a normal microcontroller can’t do. banning this device does nothing to harm penetration testing. it just mitigates the ease with which these exploits can be widely abused.
- Root_Denied 3y ago
  That's kind of the point though - the more widespread you see it being used the more likely it is that the tool itself will get more attention and the targets of the tool will get more attention. The point of a bill like this is to show the population that politicians are doing something, and trying to avoid nation/global news covering the topic. For another example of similar politician behavior just look at how LA is handling the graffiti towers. They're driven by concern about being on the national stage and the corruption of the whole system being put on display, not about the graffiti.
anigbrowl 3y ago
Fine + punish the people creating the interference This isn't a realistic solution because the difficulty of identifying people abusing these devices is high. The usual US approach is to jack penalties up way high to offset the low probability of capture, which inevitably leads to disproportionate sentences and an even greater erosion of respect for the legal system.

Kuinox 3y ago

Security is needed because somes doesn't want to play by the rules. If nobody try to breaking in, why bother putting a lock on your door ?

dymk 3y ago

That's like saying any infrastructure is sloppily done because it's vulnerable to DDoS attacks. DDoS attacks are already illegal, but people still perform attacks. That's not the site operator's fault, and it's victim blaming.

kstrauser 3y ago
Except here "DDoS" means "one person with a $200 radio". I don't expect my devices to stand up to prolonged attacks against state actors. I do hope they can survive someone sending them invalid packets.
- dymk 3y ago
  Oh they'll survive invalid packets. It's the sheer amount of packets that are the problem, and wireless signals are just inherently hard to protect against malicious jamming.
  - kstrauser 3y ago
    That's not true. Again, forget jamming for a little bit. You can build a jammer with any random spark gap transmitter. The novel attacks are one where a Flipper Zero can send an iPhone 1,000 "hey, I'm an Apple TV, wanna hang out?" messages in a row and the phone acts on each of them. Even if you space those messages out so that they only take a tiny percent of available throughput, the phone's response to the messages will still make it unusable. Because such a flood is now easy to trigger, phones now implement rate limiting that effectively mitigates the attacks. After all, you're not legitimately going to see 1,000 Apple TVs trying to connect at once, so there's no need to give each one of them personal attention.

dmonitor 3y ago

There is nothing this can do that a normal microcontroller can’t do. banning this device does nothing to harm penetration testing. it just mitigates the ease with which these exploits can be widely abused.

Root_Denied 3y ago
That's kind of the point though - the more widespread you see it being used the more likely it is that the tool itself will get more attention and the targets of the tool will get more attention. The point of a bill like this is to show the population that politicians are doing something, and trying to avoid nation/global news covering the topic. For another example of similar politician behavior just look at how LA is handling the graffiti towers. They're driven by concern about being on the national stage and the corruption of the whole system being put on display, not about the graffiti.

anigbrowl 3y ago

Fine + punish the people creating the interference This isn't a realistic solution because the difficulty of identifying people abusing these devices is high. The usual US approach is to jack penalties up way high to offset the low probability of capture, which inevitably leads to disproportionate sentences and an even greater erosion of respect for the legal system.