7 ms·
0day Contest for End-of-Life Devices Announced
- deleted 2y ago[deleted]
- asabla 2y agoOoh, this looks like a lot of fun. Really hope they'll either have recordings and/or stream this event.
- computersuck 2y agoWhy would they do this? Knowing that any bugs found won't be patched since EOL, and will just be used for mass exploitation and harm?? Why is the cyber industry so desperately stupid for attention?
- stackghost 2y agoDunking on Internet of Shit^H^H^H^HThings vendors is always a win in my book.
- Aissen 2y agoTo protest stupidly short EOL deadlines.
- schlauerfox 2y agoJust went to get some BIOS files for the 5th gen Intel NUCs and they've purged them from the site. It's like when Microsoft purged the KB of everything not in current support. Burning of libraries, it's sickening.
- Hackbraten 2y agoI think this contest is a good thing. It might put pressure on customers to demand products with longer support lifecycles, which in turn forces vendors to offer longer support and/or make their software and APIs open source once support ends.
- wpm 2y ago>It might put pressure on customers to demand products with longer support lifecycles It won't. It'll allow vendors to put pressure on customers to buy new shit to replace their old shit that still works just fine that the vendor would rather not spend the resources patching.
- Hikikomori 2y agoEU might have something to say about it.
- throwaway48476 2y agoPossibly but a website that says 'vendor vulnerable' is bad PR and readers won't care if it's EOL or not.
- teeray 2y agoIt puts pressure on regulators to realize the shitty situation MBAs create when they EOL products that aren’t reaching revenue targets.
- 1970-01-01 2y agoWhy do you think the industry is morally obliged to have them remain untouched?
- asabla 2y agoI don't see it like that at all. Some 0-days can (somewhat) be mitigated by other hardware/software. I rather have as many "known" 0-days in the open. Then having it the other way. Even if it means I won't see any updates to affected devices or software
- 1oooqooq 2y agoI cannot say if your comment is sarcasm. Do you think devices are retired because they aren't sold? Why would you want that information to be known only by bad actors? Just imagine trying to convince someone who mounted a beautiful android 4.4 tablet to control their smart home (heh) 5 years ago that they will have to redo every thing because they bought into a proprietary protocol and the base os isn't receiving security updates. Or do you truly believe you are safe if you hide under your bedsheet?
- oliver_jack 2y ago[flagged]
- computersuck 2y agoIt's about the barrier to entry and amount of effort to exploit something. When public information comes out about a vulnerability that can't be patched in a reasonable amount of time (due to EOL or some other reason), the bad actors have the upper hand. Giving ransomware actors free bugs for mass exploitation when they are unlikely to be patched is just putting innocent users in harms way. It doesn't really make a dent in the shit vendors' profits, so the only other motives are 1) to show off your cool research or 2) protest ridiculous EOL deadlines (which sure, might make a difference).
- mulmen 2y agoYou’re assuming bad actors don’t already know about these zero days. You have to assume any possible vulnerability is already being exploited. Publishing zero days in EOL devices reduces the information asymmetry.
- computersuck 2y agoWhen there's no publicly known bug, someone needs to spend the time and effort to research it; when public POCs come out every skid cybercrime crew jumps on and starts exploiting it for financial gain.
- thomascountz 2y agoI'm thinking that bugs may not necessarily disappear when the device or application where they are discovered is EOL'd. This research could discover attack vectors and vulnerabilities that will need to be addressed in active implementations.
- freehorse 2y agoThe first best thing for vulnerabilities is fixing them, the second best is knowing they exist and what they specifically are (so one can either try to mitigate them or make an informed choice on replacing equipment).
- amenghra 2y agoAlso great for learning. Vendors learn from their mistakes, right?
- hedgehog 2y agoWithout splashy narrative and quantifiable risk the vendors won't change and the general public won't perceive the danger of unsupported devices. Public bounties are one way to change both so this seems like a reasonable project with net benefit.
- sandwichmonger 2y agoLet's say there's a group of people living a small, old house. They have the money to move to a bigger, newer one, but there's sentimental and other value to the one they're in. Yeah, they don't have the latest door chain and fancy security systems, but that just means they don't open the door to random people who come knocking and are more careful and wary of burglars. Now imagine a real estate company paying people to try and break into houses like theirs in order to scare the people into spending money and moving to a bigger and newer house they don't want to move to, claiming that the people don't know any better and need to be FUD'd for their own good. That sounds like an evil thing to me.
- hedgehog 2y agoA better analogy is a product safety bulletin, if your stove has a design flaw that can burn down your house the main difference is whether you or the manufacturer knows to do something about it. The bugs exist and people exploit them, it's mostly a question of whether the general public is aware. Breaking into houses requires a lot of labor to scale, exploiting software bugs doesn't so past some point more people knowing about them doesn't increase risk in the same way. After 25 years of this debate it's pretty clear what works.
- IshKebab 2y agoThese devices don't magically become secure just because white hats decide not to attack them. You're advocating security through sticking-your-head-in-the-sand.
- frankharv 2y agoI think we need a cyber swat team to assassinate anybody doing a port scan. You want to play with something you don't own or have permission to play with it. Assassinate target. You want to make money/fame off others. DIE. If somebody came to you house and started jiggling doorhandles what would you do? Why is cyber different? NO CONSEQUENCES.
- deleted 2y ago[deleted]
- PhilipRoman 2y agoFun idea, although nobody who is serious enough about hacking will use their home PC as source, more likely it will be some random grandpa's old router. Even putting that aside, we can't exactly send a SWAT team to China...
- 0xdeadbeefbabe 2y ago> Why is the cyber industry so desperately stupid for attention? Burglaries aren't getting enough attention.
- nashashmi 2y agoLook at what they are saying. They want to document all sorts of bugs in past products for future research purposes. And they want to draw attention to the product that it be replaced. I agree putting such burdens on companies with little IT resources isn’t healthy for the company, its customers or anyone else. This is hostile.
- jon-wood 2y agoIf you put a product out in the field which can potentially be remotely exploited it’s on you to either patch it when someone does find an exploit or possibly open source everything so others can. If you genuinely can’t support it I guess you could put a self-destruct mechanism in which remotely bricks the device instead, just don’t expect your customers to be happy about it.
- nashashmi 2y ago... or maybe build a foolproof product that cannot be hacked or attacked. Maybe products that don't get updated loose their access to the internet. And the only way you can get access is through some clamped down application.
- busterarm 2y agoWould be cool but "responsible disclosure" is a non-starter for me. Full disclosure is the only way to operate, IMO.
- sidewndr46 2y agoIf the device is explicitly past EOL what is the point anyways? Just to wait 60 days and hear they aren't going to do anything?
- winnona 2y agonot necessarily! If the 0day is bad enough the vendor may patch it or release further guidance - most recent case is Ivanti this week (https://cyberscoop.com/ivanti-vulnerability-cisa-kev/ https://cyberscoop.com/ivanti-vulnerability-cisa-kev/)
- slt2021 2y agolikely used by vendor as sales strategy to upgrade device: we will give you patch for this EOL 0day, but this will be the last one. Please buy new version and btw here is 20% discount code, you are welcome
- sidewndr46 2y agothey could offer to send you a $15 grubhub gift card for your trouble
- GTP 2y agoStill better than leaving devices unpatched. The end user still has the final word, can totally refuse to buy a new one if he/she doesn't think getting a new one is worth it.
- Techbrunch 2y agoDepending on the target and the severity of the vulnerability the vendor might consider fixing the vulnerability even if EOL. If the target is an IOT device the vulnerability will likely be mass exploited to create a botnet. The U.S. government recently ‘took control’ of a botnet run by Chinese government hackers made of 260,000 Internet of Things devices... (Source: https://techcrunch.com/2024/09/18/u-s-government-took-control-of-a-botnet-run-by-chinese-government-hackers-says-fbi-director/ https://techcrunch.com/2024/09/18/u-s-government-took-contro...)
- Retr0id 2y ago> 60-90 day disclosure windows with vendor This is not 0day. (but I think this is a fun initiative nonetheless)
- Retr0id 2y agoI'm also not sure what the point of vendor disclosure is, if the product really is EOL
- codetrotter 2y agoMaybe mainly to avoid legal trouble? Even if you “know” the answer from the vendor will be that it’s EOL, notifying them of your findings and giving them time to fix it shows that you have good intentions. That they then do choose to do nothing about it, well that’s not your fault. Additionally, it helps you avoid the situation where you thought the device was EOL because there hadn’t been any updates for a long time but then it turns out that they actually do still respond to, and fix, security issues. And it just happened that there hadn’t been updates for a long while because no one had reported anything for a while.
- stvltvs 2y agoThe vulnerabilities might still exist in current products even if discovered in an EOL product.
- Retr0id 2y agoThat's a very fair point.
- citrin_ru 2y agoDepending on vulnerability impact and difficulty fixing it, some vendors may choose to release a fix even after EOL. Generally EOL means that users should not rely on getting an update (but it still may be released as an exception).
- krisoft 2y ago
- londons_explore 2y ago> - You are not under any restrictions or sanctions from the US. Can we make this a condition of giving any prizes, rather than of entry to the competition? This restriction affects literally 200 + million people.
- throwaway48476 2y agoHow likely is it that a sanctioned individual shows up for an event in Washington DC?
- dghlsakjg 2y agoThis is likely a restriction that applies whether or not they put it in the terms and conditions.
- tonetegeatinst 2y agoWouldn't the legal definition of "restriction" also include the laws covering computers etc? A technicality but one could argue that if the law is the only barrier to exploiting something then the vulnerability needs to be fixed and proven, which a US citizen can not do.
- drbscl 2y agoIt's more likely to cover the organizers legally. I imagine no-one wants to be on the receiving end of "You are accused of actively encouraging Iranian / Russian / <insert other sanctioned state here> hackers to identify exploitable security vulnerabilities in appliances owned and operated by Americans; how do you plead?"
- efields 2y agoI read this thinking it was a contest for suicide booths.
- myself248 2y agoHack Kevorkian?
- moffkalast 2y agoYou have chosen: slow and horrible.
- jdironman 2y agoThe pod just reopens and lets you back out
- moffkalast 2y agoHaha lmao, perfect.
- meindnoch 2y agoEoL devices are a huge liability. We need laws that require vendors to equip smart devices with remote hardkill switches, so they can be permanently disabled by the vendor when they reach EoL. A disabled smart device is better than one that can be weaponized by threat actors.
- notfed 2y agoYikes -1 to that. Sounds like a vendors dream anyway, I don't know if that needs to be incentivized.
- nashashmi 2y agoThe terms of service of the device did not require replacement nor issue end of life date. What basis would the law have to enforce replacement?
- compootr 2y agoRight, but do you want these still usable devices to become e-waste? for those that can secure them properly (e,g air-gapping) why do we need to make old iot stuff non-functional bricks? something I'd be more ok with is to disable it, but in the device's settings, allow it to be re-enabled
- meindnoch 2y agoIf you truly air-gap the device, then the kill signal wouldn't reach it, so all is well.
- Cheetah26 2y agoMuch better legislation would be requiring that the firmware/software source be released at EOL, so that users can maintain the hardware they purchased for as long as they like.
- meindnoch 2y agoProbably we need both. Hardkill all devices, and let determined users resurrect their own devices with the open source firmware if needed. The point is that millions of vulnerable devices won't stay online by default.
- technofiend 2y agoThis just underscores the fact (IMHO) we need a "cash for clunkers" program for obsolete and unsupported devices. I mean I'd love to see more moonshot programs like DARPA's Tractor but in the meantime why not create incentives to get insecure equipment off the net?
- throwaway48476 2y agoA lot of the time the EOL hardware is exactly the same as the supported hardware. The software just needs to be supported for longer. For example the 2014 and 2015 mac book pro, same CPU, same motherboard, etc and yet the 2014 is EOL a year earlier.
- technofiend 2y agoI'm thinking of the millions of IOT devices like old internet firewall appliances that make up modern botnets. Those need to die ASAP.
- throwaway48476 2y agoThere are easier ways to play doom. https://youtu.be/aq6mtEciX2c https://youtu.be/aq6mtEciX2c
- bee_rider 2y agoReaching the the legal hammer out to be a last resort, but IMO, EOL-ing a device should require open sourcing it and handing over any info required for administration to the users. Or refund for full price. A device which can not be administered by the end user is administered (perhaps negligently) by the company who sold it.
- mnau 2y agoWhat would be the point of open sourcing it? Serious question. Custom DIY ROM might interesting to some geek out there, but it does nothing for security. There is no automatic update and some custom ROM is never going to get it anyway. Security through obscurity is a better option in this case.
- phendrenad2 2y agoA cynical person (not me, not I, I'm not a cynical person) might think that this is the opening salvo in a campaign to "save" the US tech sector by getting rid of old hardware. See the comments in this very thread calling for a "cash for clunkers for old devices" or a "remote kill-switch" to disable them (!) Right now you can go to eBay and buy a used PC for $200 that will do everything you need to do, including gaming. You can buy a 64GB iPhone X for $100, which will do everything a new phone will do (basically). Can you imagine the drain on the hardware sector in the US due to these old devices piling up? And the trend is only going to accelerate. If the powers that be aren't conspiring to "fix" this "issue", it's only a matter of time until they do.
- hnuser123456 2y agoAs soon as they feel like TPM isn't pushing enough HW upgrade purchases...
- heraldgeezer 2y agoYup Windows 10 EOL will be fun... Windows 10 is "still" on 47% of PCs with Steam installed. Windows 11 is at 49%. https://store.steampowered.com/hwsurvey https://store.steampowered.com/hwsurvey
- moffkalast 2y ago> Linux: 1.92% (-0.16%) > Arch Linux (64-bit): 0.16% (-0.01%) > Ubuntu 22.04.4 LTS (64-bit): 0.07% (-0.01%) > Linux Mint 21.3 (64-bit): 0.07% (-0.04%) > Ubuntu 24.04 LTS (64-bit): 0.07% (0.00%) > Linux Mint 22 (64-bit): 0.06% (+0.06%) > Ubuntu Core 22 (64-bit): 0.06% (0.00%) > Manjaro Linux (64-bit): 0.06% (0.00%) Year of Linux in gaming, everybody! :(
- sandwichmonger 2y agoIt'll be another Windows XP situation of a large percentage of people refusing to upgrade for 8 years past EOL, the only difference is that XP was a better operating system and doesn't have anything built in that could forcefully update you at M$' will.
- DidYaWipe 2y ago"oday" contest?
- DidYaWipe 2y agoUh-oh, Alan O'Day got offended and down-modded.
- deleted 2y ago[deleted]
- userbinator 2y agoThere are already communities around providing fixes and drivers for OSes going back to at least Windows 3.x(!), so I hope things like this will also come with fixes too. The complexity of essential system software has ballooned out of control, and it has always been my belief that "EOL" means eventual stability; known unknowns are better than unknown unknowns. They always tell you how many bugs they fixed in the new version, but they never tell you how many new ones they introduced.
- Rygian 2y agoIn my fictional country, in order to release a software product to the market, or a hardware appliance that runs software, the vendor must: - Subscribe to an end-of-life insurance package for security software patches. Vendor must contribute periodically. The amount contributed is proportional to the number of appliances sold, with a multiplication factor to account for how hard it is to upgrade the software. Vendor is still legally bound, by SLA, to release software patches and provide an upgrade path to customers for as long as devices remain operational (ie. no fixed EOL). The insurance is only there in case vendor goes bankrupt. - Or else release the software under an FSF-approved free software license, including all the needed toolchain to deploy software fixes on an appliance. Any third party is then legally empowered to provide patching services (caveat: the third party must agree to same SLA as vendor in point above). - Or else vendor must put in place a guaranteed-buyback scheme whereby consumers can get at least 75% of the ongoing retail price (or last known retail price) by bringing back a device. The funds must be put in escrow, to protect users if vendor goes bankrupt.
- euroderf 2y agoMusing... All these things might need some flavor of escrow-with-indie-verification. For example, does the published source actually compile other what's on the device? And some flavors of escrow (like your #3) need a bankroll or some sort of insurance. And anyways, given the inevitable enshittification of all the things, including "assurance", how is a grand scheme for preventing willful software obsolescence enforceable by anything less imposing than the gummint?
- Rygian 2y agoIn my fictional country, the gummint is BDFL-style. Regulation is broadly accepted as the lesser evil, when compared to letting the free market enshittify itself.
- euroderf 2y agoI have been assured by trusted third parties that your term of BDFL rule will be both wise and benevolent, plus also possibly unto death.
- deleted 2y ago[deleted]