21 ms·

White House unveils Cyber Trust Mark program for consumer devices

157 points by WaitWaitWha 2y ago

surfpel 2y ago
Only Gov approved spyware included!
rkagerer 2y ago
The real problem is very few vendors are inclined to spend the time and money to make their products truly stable & secure. Instead we churn out a firehouse of crap code for a sewage dump of cheap IoT products. I'm not sure how much a government-conceived seal will raise the bar of consumer expectations. I'd still put my faith in other indicators like a company's track record, third party audits, robustness of open source library choices where applicable, my own analysis of their stack and engineering choices based on signs I can observe about their product / interface / etc (there are usually several present), my own testing and so forth. I'd argue the generally accepted pace of consumer product development these days is reckless, and not sustainable if you want truly robust results. I would have been glad to see this step in the right direction if I weren't convinced all it will likely amount to in practice is security theatre. Here's hoping my skepticism is unwarranted.
zcrossing 2y ago
[dead]
0xbadcafebee 2y ago
This is a bit scary. Knowing how software is developed, I know there's no government program that could actually ensure a device is secure. It's one thing to measure an electronic device's EMI or pump it full of power and see if it catches fire. But black box testing of software is itself a black art, as software security is a lot more complex than [typical] electronic design. The scary bit is that this label is going to be found to be ineffective, and then consumers may lose trust in government-issued safety stamps.
- cookiengineer 2y ago
  In Germany we had something like this from the TUEV Süd, where they certified online shops and online banking websites for their security. Suffice it to say, but the keywords are a google dork for finding easy to hack pentesting victims. Now the BSI (German institute for cybersecurity, similar to CISA) also started to push out certifications for the BSI Grundschutz, which is an absolute meaningless certificate and literally tests the absolute bare minimum things. The problem here is that there is no market, this cyber security crisis cannot be solved economically, because customers want a certificate without having to do further work. So they'll get it at whatever auditor that accepts their money. This is how it's done, even for ISO 27001 and SOC2 certifications. Nobody gives a damn if a single working student has 20+ role descriptions laying on their table. Findings are always ignored and never corrected. Cyber security policies and their effects over time need to be measurable first before there can be certification processes. Additionally there needs to be legislation that cannot be interpreted. Things like "reasonably modern" cannot be used as a law text because it doesn't mean anything, and instead standardized practices have to be made mandatory requirements. Preferably by a committee that is not self controlling, maybe even something like the EFF, FSF, OWASP or Linux foundation.
- est 2y ago
  > I know there's no government program that could actually ensure a device is secure Well, there's SELinux, TOR
  - LinuxBender 2y ago
    I would be more specific than that. SELinux can be running and intentionally poorly written policies can allow absolutely anything to happen. The risk being, [X] Checkbox SELinux is technically running.
mikewarot 2y ago
This is equivalent to requiring an Underwriters Laboratory (UL) approval on every electrical appliance before settling on requirements for fuses or circuit breakers. No matter how good everyone in this trust mark program is, you're only one confused deputy[1] away from disaster. [1] https://en.wikipedia.org/wiki/Confused_deputy_problem https://en.wikipedia.org/wiki/Confused_deputy_problem
fulafel 2y ago
Many countries have been doing this already (usually based on this ETSI spec: https://www.etsi.org/deliver/etsi_en/303600_303699/303645/03.01.03_60/en_303645v030103p.pdf https://www.etsi.org/deliver/etsi_en/303600_303699/303645/03...)
ngneer 2y ago
Who are these UL Solutions? They seem to have come out of nowhere and hit the jackpot, inserting themselves as arbiters for security. Smells a bit like how Common Criteria proffered independent certification labs, which were no panacea either.
- amaterasu 2y ago
  Underwriters Laboratories, UL. Look at the back of pretty much any mains powered device and you'll see their mark. They were founded 130 years ago, and test and warrant devices (typically high voltage) to be safe. Security is a new thing for them, but they're well suited to provide the services.
  - cesarb 2y ago
    > Underwriters Laboratories, UL. Look at the back of pretty much any mains powered device and you'll see their mark. I just looked at the closest mains powered device I have here (a fancy humidifier/fan), and only saw an Inmetro mark, there's no UL mark at all. (My point is: plenty of people are not from the USA. I happen to have already heard that the UL is sort of the USA equivalent of our Inmetro, though like many things in the USA it's a private entity instead of a government entity, but the parent poster probably hadn't heard of that.)
  - ngneer 2y ago
    Thanks for that context, quite interesting and very much appreciated. I ought to have looked them up proper, but their name is unrecognizable in the security scene. I am not sure I understand why UL are "well suited" to provide these services. Is it that they have a compatible business model? I do not see how 130 years of solid experience in one domain means (much of) anything for an entirely different domain. Sounds like they have a nice round 0 years of experience in security. To make a crude analogy, this is like telling CERN to go start building spaceships. I mean, CERN has a proven track record for building complex things, right?
trod1234 2y ago
This is doomed to failure. Cybersecurity best practices are a point in time snapshot, the label will be dependent on at purchase time, how will that help people who have purchased second hand, or had products where items on shelves suddenly had a vulnerability discovered? You really think they are going to go through the cost of sending those back? All software bugs can potentially be security bugs. This follows classic shock doctrine.
magic_smoke_ee 2y ago
NIST is involved (Dual_EC_DRBG). Verdict: nope. This is something that an independent, international cybersecurity nonprofit should be in-charge of, not a standards org that shills for what we think may have been the NSA (BULLRUN).
delfinom 2y ago
This is basically going to become a monopoly program. Stores and governments will start mandating it for sales like energy star. Then because UK is the administrator, the costs to certify will skyrocket. Basically this is going to ensure the only devices you can buy are those made by a select few megacorps.
mattmaroon 2y ago
It's as if the federal government doesn't realize nobody trusts it. Whether due to ineptitude or dishonesty, the only thing we can be sure about this is that we can't be sure about it. We need a blue ribbon commission on transparency, honesty, and good governance desperately. Let's reduce any federal agencies that make any sort of direct-to-citizen recommendations by 100% and instead spend that on rooting out bad incentives, misinformation, etc.
devwastaken 2y ago
The FCC doesnt do testing themselves. they just trust submitted paperwork. tech gets the “good one” certified then changes the parts for cheaper. there is no regulation in tech. they own the fed.
_7acn 2y ago
"Pedobear Seal of Approval" with NSA stamp!
glitchc 2y ago
Is it somehow related to this? https://abcnews.go.com/International/us-diplomats-cuba-suffered-ear-damage-experiencing-mysterious/story?id=59772775 https://abcnews.go.com/International/us-diplomats-cuba-suffe...
netfortius 2y ago
I wonder how many of these latest "White House did X" are going to go away in two weeks...
ngneer 2y ago
The true problem is that the world is addicted to additive security. "What can we add to make our systems more secure?" Since the InfoSec industry sprung from the IT industry, the financial incentives are backwards. At the moment, people pay for security solutions that add complexity. Walk the floor in any commercial security conference and you will find these to be the most prevalent. "Take my tech" is the mantra. If people only paid for security solutions that remove complexity, then it would be a very different story. "Let me do away with your complexity" would be the better mantra. Albeit a gross simplification, the industry must flip the script to subtractive security, asking what can we remove or revise to make our systems more secure. Same thinking afflicts consumer devices. New IoT device? Which known-good security validated and battle tested software stack is the vendor reusing? Oh, your own homebrew stack that phones home? How novel! You mean you slapped on whatever it took to ship? Terrific! There is a bug in ROM with no way to securely remediate? Shocking! /s
lebubule 2y ago
They should have contacted the FSF. https://ryf.fsf.org/ https://ryf.fsf.org/ Again, decades ahead.
- Arnavion 2y ago
  Note that the FSF has no problem giving an RYF certification to hardware with unupdatable binary blobs, as long as those blobs reside in a separate chip like an SPI flash. It's not a measure of security or maintainability. Of course whether the FCC label will be one either remains to be seen.
vaadu 2y ago
Why the FCC as opposed to CISA?
DeepYogurt 2y ago
Interesting. This is probably a good thing to have around as a baseline for all the iot crap out there
silisili 2y ago
What's to stop the bad actors from just printing the logo on their gear anyways? Like they do with UL and N95?
- ehaskins 2y ago
  You have to have rules before you can enforce them... It looks like part of the label [1] will include a QR or link to a public registry, so in theory you can easily confirm the device has actually been certified. [1] https://docs.fcc.gov/public/attachments/FCC-23-65A1.pdf https://docs.fcc.gov/public/attachments/FCC-23-65A1.pdf point 42
- anotherhue 2y ago
  The vendor is supposed to check I think. Not that that makes sense in a comingling inventory world.
  - likeabatterycar 2y ago
    I'm sure Amazon - whose store is mostly generic Chinese schlock nowadays - will check. Not that it matters, posters on this very site who claim to care will continue buying stuff off AliExpress, proud they got it for pennies on the dollar. Look ma, a mini PC for $22! And they didn't even charge for the preinstalled malware! Has anyone ever considered this junk is sold at a loss as a price of doing business, to expand a PRC-controlled botnet?
    - simne 2y ago
      Looks like you just have not deal with bad traders on platforms. I once found on local aggregator product too cheap to be good (unfortunately at that moment only two stores sell these product). I stored their number in my notebook and going to my shopping, calling them from bus stop, and they answered me some nonsense. I made my shopping, and some walk, then opened platform and these shops already disappear. Less than hour. In other case I managed to make order and paid from card, and also shop disappeared. - In a week I received SMS from bank "your payment returned to your account".
Terr_ 2y ago
Digging for more details, but a lot of the technical requirements (e.g. encryption, password handling, etc.) are still unclear. https://www.fcc.gov/CyberTrustMark https://www.fcc.gov/CyberTrustMark
- krunck 2y ago
  "Which products will be included in the program? The program applies to consumer wireless IoT products. Examples of eligible products include internet-connected home security cameras, voice-activated shopping devices, smart appliances, fitness trackers, garage door openers, and baby monitors." Ok, nothing I use then. I hope this comes to home and SMB network gear.
schnable 2y ago
Probably overlaps with the EU RED Cybersecurity requirements for IoT devices that are supposed to go into effect this year: https://www.ul.com/services/ul-solutions-cybersecurity-advisory-red-compliance https://www.ul.com/services/ul-solutions-cybersecurity-advis...
jzebedee 2y ago
The combined requirements of govt purchasing must carry the mark and major US surveillance tech manufacturers like Amazon are leading the rollout, makes this seem less like a cybersecurity concern and more of a protectionist carve out.
- deadbabe 2y ago
  [flagged]
  - Jtsummers 2y ago
    This has been in the works for a while now. This is not a last minute thing.
    - deadbabe 2y ago
      [flagged]
      - Jtsummers 2y ago
        At least as early as August 2023. Less than three quarters of the way through his presidency. Something that started at least 17 months ago can hardly be considered "last minute". EDIT: Found the answer for you since you can't be bothered (previously saw the date in some other doc reading about this): https://www.fcc.gov/CyberTrustMark https://www.fcc.gov/CyberTrustMark > When was the U.S. Cyber Trust Mark program created? >> In August 2023, the FCC sought public comment on how to create the Cyber Trust Mark program. In March 2024, based on public input, we adopted rules establishing the framework for the program.
      - contextfree 2y ago
        This is from July 2023: https://www.nextgov.com/cybersecurity/2023/07/white-house-announces-new-program-designate-cyber-secure-iot-devices/388589/ https://www.nextgov.com/cybersecurity/2023/07/white-house-an...
      - kube-system 2y ago
vessenes 2y ago
Interesting. I'm not sure if the public comment period is over (The original proposal is dated August, 2023), but this stands out to me from their paper: We propose to focus the scope of our program on intentional radiators that generate and emit RF energy by radiation or induction.31 Such devices – if exploited by a vulnerability – could be manipulated to generate and emit RF energy to cause harmful interference. While we observe that any IoT device may emit RF energy (whether intentionally, incidentally, or unintentionally), in the case of incidental and unintentional radiators, the RF energy emitted because of exploitation may not be enough to be likely to cause harmful interference to radio transmissions. I guess it is the FCC so this makes sense from their point of view. From my perspective, I'd like to see marks indicating: * If the devices can be pointed to an alternate API provider if the company stops supporting * If firmware has been escrowed / will be made available if the company stops supporting * If device data is stored by the company * If that data is certified as end to end encrypted * Some marks for who / how the data is used
- drdaeman 2y ago
  > If that data is certified as end to end encrypted This needs better and more detailed clarification. I've reverse engineered a camera-equipped pet feeder, and videos sent to a cloud (or my emulating server in my case) were partially encrypted - I-frames were, P-frames were NOT. Someone ticked a checkbox "videos are encrypted", and still left the thing glaring open. Then, of course, it's also a matter of ciphers and modes, authentication, key generation, transmission and storage, etc etc. Feels like encrypted storage and transmission features alone require a full whole label, like the FCC's broadband facts label, or FDA's nutritional facts label, which outlines what data exists in the system, where the data is stored, how it's encrypted, how it's authenticated, and so on. Which is probably not happening until cryptography 101 becomes a part of general school curriculum and layman people start to understand the basics. Without people asking real questions and refusing to purchase products from sloppy engineering companies (aka voting with their wallets*), companies will always wave it away with tried-and-proven "military-grade security" bullshit. ___ *) That is, if there's even a competition. When no one does things right (because consumers don't know and thus don't ask for it), there's nothing to pick from.
floxy 2y ago
Seems like good fodder for a tongue twister. Try saying it 10 times fast: - Must the Cyber Truck (Musk) bear the Cyber Trust Mark?
- motohagiography 2y ago
  nice: Must Musk's Cyber Truck Bear the Cyber Trust Mark? It's adding a standards and governance layer to tech, which creates a capacity for compliance management in regualted industries. annoying for sure, but the US has lost its unipolar superpower role because its critical infrastructure systems were made of garbage code and its population is effectively defenseless. it doesn't solve it, but it improves the dynamic.
- sebastiennight 2y ago
  Hmm as a tongue-twister it lacks twists and has too many extra sounds. I'd suggest something like: Most Musk Cyber Trucks metrics trick Cyber Trust Mark's trust
beams_of_light 2y ago
Things like this are useless, in my mind, because hackers are always going to innovate and find ways around protection mechanisms. Today's "locked down" IoT device could easily become tomorrow's "vulnerable to an easily exploitable pre-auth RCE". What the government probably _should_ do is begin establishing a record of manufacturers/vendors which indicates how secure their products have been over a long period of time with an indication of how secure and consumer-friendly their products should be considered in the future. This would take the form of something like the existing travel advisories Homeland Security provides. Should you go to the Bahamas? Well, there's a level 2 travel advisory stating that jet ski operators there get kinda rapey sometimes. Should you buy Cisco products? Well, they have a track record of deciding to EOL stuff instead of fixing it when it's expensive or inconvenient to do the right thing. Should you buy Lenovo products? Well, they're built in a country that regularly tries and succeeds in hacking our infrastructure and has a history of including rootkits in their laptops.
- kube-system 2y ago
  NIST isn't a bunch of dummies that don't know this. The requirements posed are not micromanagement of device design; some address your concern exactly... like a requirement that developers provide contact information to report vulnerabilities and that devices makers just can't ignore authentication entirely. But this is IoT stuff we're talking about here, not Lenovo/Cisco... but ReoLink/PETLIBRO/eufy/roborock/FOSCAM/Ring/iRobot/etc. Security (or the lack of it) in the IoT world is a whole different ball game. It isn't uncommon for IoT devices to be EOL on release date, or just lack authentication or encryption entirely.
  - timewizard 2y ago
    > NIST isn't a bunch of dummies that don't know this They've provided thorough definitions and a label that implies they've all been understood by the manufacturer. It doesn't mean that this solves any real world problem. > Security (or the lack of it) in the IoT world is a whole different ball game. Those can be described as IoT devices. They're more appropriately categorized as "consumer electronics" and often have a firmware update right out of the box. That's what makes this badging program an absurd idea with no meaningful outcome. This segment is not going to care. This isn't "Energy Star" where the purchased product does not have additional functionality which can be exposed or exploited through software and no third party testing can be exhaustive enough to prevent the obvious exploit from occurring. Even to the extent they can it then enforces a product design which cannot be upgraded or modified by the user under any circumstances. Worse the design frustrates the users ability to do their own verification of the device security. It's a good idea applied to the wrong category of products and users.
JohnMakin 2y ago
Cool, I'd rather have a stamp that indicates a company will support their product for X number of years, and if they don't, they will release the software as OSS so you can maintain yourself. I have an extremely expensive scale that came with wifi support and an app, only bought it 3 years ago, half the features already don't work because they nuked the app and stopped supporting the scale. did I need a smart scale? Absolutely not, and I don't really need any other "smart" devices the more I think about stuff like this, and now seek to buy "stupid" devices as much as possible. I'm not sure what such security stamps are supposed to provide other than false sense of security, as most things can be hacked eventually with enough determination or someone unknown zero day.
- mxuribe 2y ago
  Yeah, nowadays i try to buy many things that are "not smart" in order to avoid what you experienced with the smart scale. That being said, i wonder if what you're asking for is more on the warranty side, rather than security/promise side? To clarify, i am 100% in agreement with you that after a company stops supporting a product, they should open source it (which could create a secondary ecosystem of techs who offer services to support said open source software if a person is not inclined to manage the OSS themselves, etc.)...However, technically wouldn't a company's "promise" to support software be more like a warranty? And in that case, whatever gov. agency who oversees warranties would need to nudge business to comply...nevertheless both this cybermark, a warranty on software lifecycle, and other things are the LEAST that shoild exist nowadays.
  - heresie-dabord 2y ago
    > try to buy many things that are "not smart" This is the best strategy, but let's be clear... consumers who make a purchase have a reasonable expectation of owning a durable product that does not increase the threat surface of consumers' lives. This means that the product requirements should be clear and the supply chain must be secure. Until a "trust label" can guarantee these principles, the proposal is just another prop in a grand security theatre.
gibibit 2y ago
I wonder how much this is going to add to the cost/effort of creating a new IOT product for startups/small businesses?
- simne 2y ago
  I'm sure, it will depend on how large part of product is made abroad and in which country. I wonder, how strict will be regulations on Chinese software parts. For EU/US/Australia/Korea originated should be less strict if could prove source.
- duskwuff 2y ago
  Based on the sorts of recommendations in [1], probably not to any meaningful degree, if at all. Much of what it's asking for is table-stakes functionality, along the lines of "have a factory reset feature", "use encryption when transmitting data", or "have a product support page" - things that any responsible developer should have been doing already. [1]: https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8425.pdf https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8425.pdf
- mxuribe 2y ago
  I honestly don't know...but isn't this sort of like when toasters first came out? I don't know for sure, but i guess toasters maybe didn't have the UL symbol...and probably some accidents happened, maybe house fires and such? Fast forward to nowadays and toasters tend to be pretty safe - well, if used properly and purchased from a reputable manufacturer who has been tested via entities like UL, etc....So yeah, maybe a little extra cost...but wouldn't we want at least some modicum of a signal of quality assurances for IoT devices - like we have for things like toasters?
jmclnx 2y ago
This is all well and good. You can have thousands of "mark of approvals", but is the most important item needed required ? User upgradability if the Company Folds or Sunsets the product. When that happens, the user will need to buy a new device or live with comprised devices. Most will live with the comprised device. So, IMO, the product should be fully open source and easily upgraded in order to get the Cyber Trust Mark.
- duskwuff 2y ago
  > User upgradability if the Company Folds or Sunsets the product. This isn't something which a company can meaningfully guarantee to consumers. Even if it's technically possible for users to install their own software on a device - for that matter, even if the company goes out of their way to support it by releasing documentation and source code - there simply isn't interest from developers to build and maintain custom software for those devices. And the same goes for devices which depend on online services - those services cost money to run, and the number of users capable and willing to run their own is miniscule.
crazygringo 2y ago
I'm interested in the actual details here -- 1) What are the requirements for the mark? E.g. no passwords stored in plaintext on servers, no blank/default passwords on devices for SSH or anything else, a process for security updates, etc.? 2) Who is inspecting the code, both server-side and device-side? 3) What are the processes for inspecting the code? How do we know it's actually being done and not just being rubber-stamped? After all, discovering that there's an accidental open port with a default password isn't easy.
- kube-system 2y ago
  https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8425.pdf https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8425.pdf Yep, pretty basic stuff, like 'require authentication', 'support software updates', etc > 2) Who is inspecting the code, both server-side and device-side? UL is administering the program and they're going to come up with the requirements > UL Solutions will work with stakeholders to make recommendations to the FCC on a number of important program details, like applicable technical standards and testing procedures, post-market surveillance requirements, the product registry, and a consumer education campaign. https://www.ul.com/insights/us-cyber-trust-mark https://www.ul.com/insights/us-cyber-trust-mark
- simne 2y ago
  Good questions. As I understand, they spent months to decide who will be responsible and who will pay (and how much). Announce happen after budget passed Parliament, so now could make manning table and hire people for next steps.
  - simne 2y ago
    Some questions already answered in article - from gov't responsible NIST and FCC and from industry agreed to participate deputies from large companies, so now they will gather meetings and will create some documents. So now, any interested subject (any human or entity, even "group of hackers") could ask to responsible. Or could talk with deputies, as their contacts should appear soon.
- bloomingkales 2y ago

157 points by WaitWaitWha 2y ago

Only Gov approved spyware included!

The real problem is very few vendors are inclined to spend the time and money to make their products truly stable & secure. Instead we churn out a firehouse of crap code for a sewage dump of cheap IoT products. I'm not sure how much a government-conceived seal will raise the bar of consumer expectations. I'd still put my faith in other indicators like a company's track record, third party audits, robustness of open source library choices where applicable, my own analysis of their stack and engineering choices based on signs I can observe about their product / interface / etc (there are usually several present), my own testing and so forth. I'd argue the generally accepted pace of consumer product development these days is reckless, and not sustainable if you want truly robust results. I would have been glad to see this step in the right direction if I weren't convinced all it will likely amount to in practice is security theatre. Here's hoping my skepticism is unwarranted.

zcrossing 2y ago

[dead]

0xbadcafebee 2y ago

This is a bit scary. Knowing how software is developed, I know there's no government program that could actually ensure a device is secure. It's one thing to measure an electronic device's EMI or pump it full of power and see if it catches fire. But black box testing of software is itself a black art, as software security is a lot more complex than [typical] electronic design. The scary bit is that this label is going to be found to be ineffective, and then consumers may lose trust in government-issued safety stamps.

cookiengineer 2y ago
In Germany we had something like this from the TUEV Süd, where they certified online shops and online banking websites for their security. Suffice it to say, but the keywords are a google dork for finding easy to hack pentesting victims. Now the BSI (German institute for cybersecurity, similar to CISA) also started to push out certifications for the BSI Grundschutz, which is an absolute meaningless certificate and literally tests the absolute bare minimum things. The problem here is that there is no market, this cyber security crisis cannot be solved economically, because customers want a certificate without having to do further work. So they'll get it at whatever auditor that accepts their money. This is how it's done, even for ISO 27001 and SOC2 certifications. Nobody gives a damn if a single working student has 20+ role descriptions laying on their table. Findings are always ignored and never corrected. Cyber security policies and their effects over time need to be measurable first before there can be certification processes. Additionally there needs to be legislation that cannot be interpreted. Things like "reasonably modern" cannot be used as a law text because it doesn't mean anything, and instead standardized practices have to be made mandatory requirements. Preferably by a committee that is not self controlling, maybe even something like the EFF, FSF, OWASP or Linux foundation.
est 2y ago
> I know there's no government program that could actually ensure a device is secure Well, there's SELinux, TOR
- LinuxBender 2y ago
  I would be more specific than that. SELinux can be running and intentionally poorly written policies can allow absolutely anything to happen. The risk being, [X] Checkbox SELinux is technically running.

mikewarot 2y ago

This is equivalent to requiring an Underwriters Laboratory (UL) approval on every electrical appliance before settling on requirements for fuses or circuit breakers. No matter how good everyone in this trust mark program is, you're only one confused deputy[1] away from disaster. [1] https://en.wikipedia.org/wiki/Confused_deputy_problem https://en.wikipedia.org/wiki/Confused_deputy_problem

fulafel 2y ago

Many countries have been doing this already (usually based on this ETSI spec: https://www.etsi.org/deliver/etsi_en/303600_303699/303645/03.01.03_60/en_303645v030103p.pdf https://www.etsi.org/deliver/etsi_en/303600_303699/303645/03...)

ngneer 2y ago

Who are these UL Solutions? They seem to have come out of nowhere and hit the jackpot, inserting themselves as arbiters for security. Smells a bit like how Common Criteria proffered independent certification labs, which were no panacea either.

amaterasu 2y ago
Underwriters Laboratories, UL. Look at the back of pretty much any mains powered device and you'll see their mark. They were founded 130 years ago, and test and warrant devices (typically high voltage) to be safe. Security is a new thing for them, but they're well suited to provide the services.
- cesarb 2y ago
  > Underwriters Laboratories, UL. Look at the back of pretty much any mains powered device and you'll see their mark. I just looked at the closest mains powered device I have here (a fancy humidifier/fan), and only saw an Inmetro mark, there's no UL mark at all. (My point is: plenty of people are not from the USA. I happen to have already heard that the UL is sort of the USA equivalent of our Inmetro, though like many things in the USA it's a private entity instead of a government entity, but the parent poster probably hadn't heard of that.)
- ngneer 2y ago
  Thanks for that context, quite interesting and very much appreciated. I ought to have looked them up proper, but their name is unrecognizable in the security scene. I am not sure I understand why UL are "well suited" to provide these services. Is it that they have a compatible business model? I do not see how 130 years of solid experience in one domain means (much of) anything for an entirely different domain. Sounds like they have a nice round 0 years of experience in security. To make a crude analogy, this is like telling CERN to go start building spaceships. I mean, CERN has a proven track record for building complex things, right?

trod1234 2y ago

This is doomed to failure. Cybersecurity best practices are a point in time snapshot, the label will be dependent on at purchase time, how will that help people who have purchased second hand, or had products where items on shelves suddenly had a vulnerability discovered? You really think they are going to go through the cost of sending those back? All software bugs can potentially be security bugs. This follows classic shock doctrine.

magic_smoke_ee 2y ago

NIST is involved (Dual_EC_DRBG). Verdict: nope. This is something that an independent, international cybersecurity nonprofit should be in-charge of, not a standards org that shills for what we think may have been the NSA (BULLRUN).

delfinom 2y ago

This is basically going to become a monopoly program. Stores and governments will start mandating it for sales like energy star. Then because UK is the administrator, the costs to certify will skyrocket. Basically this is going to ensure the only devices you can buy are those made by a select few megacorps.

mattmaroon 2y ago

It's as if the federal government doesn't realize nobody trusts it. Whether due to ineptitude or dishonesty, the only thing we can be sure about this is that we can't be sure about it. We need a blue ribbon commission on transparency, honesty, and good governance desperately. Let's reduce any federal agencies that make any sort of direct-to-citizen recommendations by 100% and instead spend that on rooting out bad incentives, misinformation, etc.

devwastaken 2y ago

The FCC doesnt do testing themselves. they just trust submitted paperwork. tech gets the “good one” certified then changes the parts for cheaper. there is no regulation in tech. they own the fed.

_7acn 2y ago

"Pedobear Seal of Approval" with NSA stamp!

glitchc 2y ago

Is it somehow related to this? https://abcnews.go.com/International/us-diplomats-cuba-suffered-ear-damage-experiencing-mysterious/story?id=59772775 https://abcnews.go.com/International/us-diplomats-cuba-suffe...

netfortius 2y ago

I wonder how many of these latest "White House did X" are going to go away in two weeks...

ngneer 2y ago

The true problem is that the world is addicted to additive security. "What can we add to make our systems more secure?" Since the InfoSec industry sprung from the IT industry, the financial incentives are backwards. At the moment, people pay for security solutions that add complexity. Walk the floor in any commercial security conference and you will find these to be the most prevalent. "Take my tech" is the mantra. If people only paid for security solutions that remove complexity, then it would be a very different story. "Let me do away with your complexity" would be the better mantra. Albeit a gross simplification, the industry must flip the script to subtractive security, asking what can we remove or revise to make our systems more secure. Same thinking afflicts consumer devices. New IoT device? Which known-good security validated and battle tested software stack is the vendor reusing? Oh, your own homebrew stack that phones home? How novel! You mean you slapped on whatever it took to ship? Terrific! There is a bug in ROM with no way to securely remediate? Shocking! /s

lebubule 2y ago

They should have contacted the FSF. https://ryf.fsf.org/ https://ryf.fsf.org/ Again, decades ahead.

Arnavion 2y ago
Note that the FSF has no problem giving an RYF certification to hardware with unupdatable binary blobs, as long as those blobs reside in a separate chip like an SPI flash. It's not a measure of security or maintainability. Of course whether the FCC label will be one either remains to be seen.

vaadu 2y ago

Why the FCC as opposed to CISA?

DeepYogurt 2y ago

Interesting. This is probably a good thing to have around as a baseline for all the iot crap out there

silisili 2y ago

What's to stop the bad actors from just printing the logo on their gear anyways? Like they do with UL and N95?

ehaskins 2y ago
You have to have rules before you can enforce them... It looks like part of the label [1] will include a QR or link to a public registry, so in theory you can easily confirm the device has actually been certified. [1] https://docs.fcc.gov/public/attachments/FCC-23-65A1.pdf https://docs.fcc.gov/public/attachments/FCC-23-65A1.pdf point 42
anotherhue 2y ago
The vendor is supposed to check I think. Not that that makes sense in a comingling inventory world.
- likeabatterycar 2y ago
  I'm sure Amazon - whose store is mostly generic Chinese schlock nowadays - will check. Not that it matters, posters on this very site who claim to care will continue buying stuff off AliExpress, proud they got it for pennies on the dollar. Look ma, a mini PC for $22! And they didn't even charge for the preinstalled malware! Has anyone ever considered this junk is sold at a loss as a price of doing business, to expand a PRC-controlled botnet?
  - simne 2y ago
    Looks like you just have not deal with bad traders on platforms. I once found on local aggregator product too cheap to be good (unfortunately at that moment only two stores sell these product). I stored their number in my notebook and going to my shopping, calling them from bus stop, and they answered me some nonsense. I made my shopping, and some walk, then opened platform and these shops already disappear. Less than hour. In other case I managed to make order and paid from card, and also shop disappeared. - In a week I received SMS from bank "your payment returned to your account".

Terr_ 2y ago

Digging for more details, but a lot of the technical requirements (e.g. encryption, password handling, etc.) are still unclear. https://www.fcc.gov/CyberTrustMark https://www.fcc.gov/CyberTrustMark

krunck 2y ago
"Which products will be included in the program? The program applies to consumer wireless IoT products. Examples of eligible products include internet-connected home security cameras, voice-activated shopping devices, smart appliances, fitness trackers, garage door openers, and baby monitors." Ok, nothing I use then. I hope this comes to home and SMB network gear.

schnable 2y ago

Probably overlaps with the EU RED Cybersecurity requirements for IoT devices that are supposed to go into effect this year: https://www.ul.com/services/ul-solutions-cybersecurity-advisory-red-compliance https://www.ul.com/services/ul-solutions-cybersecurity-advis...

jzebedee 2y ago

The combined requirements of govt purchasing must carry the mark and major US surveillance tech manufacturers like Amazon are leading the rollout, makes this seem less like a cybersecurity concern and more of a protectionist carve out.

deadbabe 2y ago
[flagged]
- Jtsummers 2y ago
  This has been in the works for a while now. This is not a last minute thing.
  - deadbabe 2y ago
    [flagged]
    - Jtsummers 2y ago
      At least as early as August 2023. Less than three quarters of the way through his presidency. Something that started at least 17 months ago can hardly be considered "last minute". EDIT: Found the answer for you since you can't be bothered (previously saw the date in some other doc reading about this): https://www.fcc.gov/CyberTrustMark https://www.fcc.gov/CyberTrustMark > When was the U.S. Cyber Trust Mark program created? >> In August 2023, the FCC sought public comment on how to create the Cyber Trust Mark program. In March 2024, based on public input, we adopted rules establishing the framework for the program.
    - contextfree 2y ago
      This is from July 2023: https://www.nextgov.com/cybersecurity/2023/07/white-house-announces-new-program-designate-cyber-secure-iot-devices/388589/ https://www.nextgov.com/cybersecurity/2023/07/white-house-an...
    - kube-system 2y ago

vessenes 2y ago

Interesting. I'm not sure if the public comment period is over (The original proposal is dated August, 2023), but this stands out to me from their paper: We propose to focus the scope of our program on intentional radiators that generate and emit RF energy by radiation or induction.31 Such devices – if exploited by a vulnerability – could be manipulated to generate and emit RF energy to cause harmful interference. While we observe that any IoT device may emit RF energy (whether intentionally, incidentally, or unintentionally), in the case of incidental and unintentional radiators, the RF energy emitted because of exploitation may not be enough to be likely to cause harmful interference to radio transmissions. I guess it is the FCC so this makes sense from their point of view. From my perspective, I'd like to see marks indicating: * If the devices can be pointed to an alternate API provider if the company stops supporting * If firmware has been escrowed / will be made available if the company stops supporting * If device data is stored by the company * If that data is certified as end to end encrypted * Some marks for who / how the data is used

drdaeman 2y ago
> If that data is certified as end to end encrypted This needs better and more detailed clarification. I've reverse engineered a camera-equipped pet feeder, and videos sent to a cloud (or my emulating server in my case) were partially encrypted - I-frames were, P-frames were NOT. Someone ticked a checkbox "videos are encrypted", and still left the thing glaring open. Then, of course, it's also a matter of ciphers and modes, authentication, key generation, transmission and storage, etc etc. Feels like encrypted storage and transmission features alone require a full whole label, like the FCC's broadband facts label, or FDA's nutritional facts label, which outlines what data exists in the system, where the data is stored, how it's encrypted, how it's authenticated, and so on. Which is probably not happening until cryptography 101 becomes a part of general school curriculum and layman people start to understand the basics. Without people asking real questions and refusing to purchase products from sloppy engineering companies (aka voting with their wallets*), companies will always wave it away with tried-and-proven "military-grade security" bullshit. ___ *) That is, if there's even a competition. When no one does things right (because consumers don't know and thus don't ask for it), there's nothing to pick from.

floxy 2y ago

Seems like good fodder for a tongue twister. Try saying it 10 times fast: - Must the Cyber Truck (Musk) bear the Cyber Trust Mark?

motohagiography 2y ago
nice: Must Musk's Cyber Truck Bear the Cyber Trust Mark? It's adding a standards and governance layer to tech, which creates a capacity for compliance management in regualted industries. annoying for sure, but the US has lost its unipolar superpower role because its critical infrastructure systems were made of garbage code and its population is effectively defenseless. it doesn't solve it, but it improves the dynamic.
sebastiennight 2y ago
Hmm as a tongue-twister it lacks twists and has too many extra sounds. I'd suggest something like: Most Musk Cyber Trucks metrics trick Cyber Trust Mark's trust

beams_of_light 2y ago

Things like this are useless, in my mind, because hackers are always going to innovate and find ways around protection mechanisms. Today's "locked down" IoT device could easily become tomorrow's "vulnerable to an easily exploitable pre-auth RCE". What the government probably _should_ do is begin establishing a record of manufacturers/vendors which indicates how secure their products have been over a long period of time with an indication of how secure and consumer-friendly their products should be considered in the future. This would take the form of something like the existing travel advisories Homeland Security provides. Should you go to the Bahamas? Well, there's a level 2 travel advisory stating that jet ski operators there get kinda rapey sometimes. Should you buy Cisco products? Well, they have a track record of deciding to EOL stuff instead of fixing it when it's expensive or inconvenient to do the right thing. Should you buy Lenovo products? Well, they're built in a country that regularly tries and succeeds in hacking our infrastructure and has a history of including rootkits in their laptops.

kube-system 2y ago
NIST isn't a bunch of dummies that don't know this. The requirements posed are not micromanagement of device design; some address your concern exactly... like a requirement that developers provide contact information to report vulnerabilities and that devices makers just can't ignore authentication entirely. But this is IoT stuff we're talking about here, not Lenovo/Cisco... but ReoLink/PETLIBRO/eufy/roborock/FOSCAM/Ring/iRobot/etc. Security (or the lack of it) in the IoT world is a whole different ball game. It isn't uncommon for IoT devices to be EOL on release date, or just lack authentication or encryption entirely.
- timewizard 2y ago
  > NIST isn't a bunch of dummies that don't know this They've provided thorough definitions and a label that implies they've all been understood by the manufacturer. It doesn't mean that this solves any real world problem. > Security (or the lack of it) in the IoT world is a whole different ball game. Those can be described as IoT devices. They're more appropriately categorized as "consumer electronics" and often have a firmware update right out of the box. That's what makes this badging program an absurd idea with no meaningful outcome. This segment is not going to care. This isn't "Energy Star" where the purchased product does not have additional functionality which can be exposed or exploited through software and no third party testing can be exhaustive enough to prevent the obvious exploit from occurring. Even to the extent they can it then enforces a product design which cannot be upgraded or modified by the user under any circumstances. Worse the design frustrates the users ability to do their own verification of the device security. It's a good idea applied to the wrong category of products and users.

JohnMakin 2y ago

Cool, I'd rather have a stamp that indicates a company will support their product for X number of years, and if they don't, they will release the software as OSS so you can maintain yourself. I have an extremely expensive scale that came with wifi support and an app, only bought it 3 years ago, half the features already don't work because they nuked the app and stopped supporting the scale. did I need a smart scale? Absolutely not, and I don't really need any other "smart" devices the more I think about stuff like this, and now seek to buy "stupid" devices as much as possible. I'm not sure what such security stamps are supposed to provide other than false sense of security, as most things can be hacked eventually with enough determination or someone unknown zero day.

mxuribe 2y ago
Yeah, nowadays i try to buy many things that are "not smart" in order to avoid what you experienced with the smart scale. That being said, i wonder if what you're asking for is more on the warranty side, rather than security/promise side? To clarify, i am 100% in agreement with you that after a company stops supporting a product, they should open source it (which could create a secondary ecosystem of techs who offer services to support said open source software if a person is not inclined to manage the OSS themselves, etc.)...However, technically wouldn't a company's "promise" to support software be more like a warranty? And in that case, whatever gov. agency who oversees warranties would need to nudge business to comply...nevertheless both this cybermark, a warranty on software lifecycle, and other things are the LEAST that shoild exist nowadays.
- heresie-dabord 2y ago
  > try to buy many things that are "not smart" This is the best strategy, but let's be clear... consumers who make a purchase have a reasonable expectation of owning a durable product that does not increase the threat surface of consumers' lives. This means that the product requirements should be clear and the supply chain must be secure. Until a "trust label" can guarantee these principles, the proposal is just another prop in a grand security theatre.

gibibit 2y ago

I wonder how much this is going to add to the cost/effort of creating a new IOT product for startups/small businesses?

simne 2y ago
I'm sure, it will depend on how large part of product is made abroad and in which country. I wonder, how strict will be regulations on Chinese software parts. For EU/US/Australia/Korea originated should be less strict if could prove source.
duskwuff 2y ago
Based on the sorts of recommendations in [1], probably not to any meaningful degree, if at all. Much of what it's asking for is table-stakes functionality, along the lines of "have a factory reset feature", "use encryption when transmitting data", or "have a product support page" - things that any responsible developer should have been doing already. [1]: https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8425.pdf https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8425.pdf
mxuribe 2y ago
I honestly don't know...but isn't this sort of like when toasters first came out? I don't know for sure, but i guess toasters maybe didn't have the UL symbol...and probably some accidents happened, maybe house fires and such? Fast forward to nowadays and toasters tend to be pretty safe - well, if used properly and purchased from a reputable manufacturer who has been tested via entities like UL, etc....So yeah, maybe a little extra cost...but wouldn't we want at least some modicum of a signal of quality assurances for IoT devices - like we have for things like toasters?

jmclnx 2y ago

This is all well and good. You can have thousands of "mark of approvals", but is the most important item needed required ? User upgradability if the Company Folds or Sunsets the product. When that happens, the user will need to buy a new device or live with comprised devices. Most will live with the comprised device. So, IMO, the product should be fully open source and easily upgraded in order to get the Cyber Trust Mark.

duskwuff 2y ago
> User upgradability if the Company Folds or Sunsets the product. This isn't something which a company can meaningfully guarantee to consumers. Even if it's technically possible for users to install their own software on a device - for that matter, even if the company goes out of their way to support it by releasing documentation and source code - there simply isn't interest from developers to build and maintain custom software for those devices. And the same goes for devices which depend on online services - those services cost money to run, and the number of users capable and willing to run their own is miniscule.

crazygringo 2y ago

I'm interested in the actual details here -- 1) What are the requirements for the mark? E.g. no passwords stored in plaintext on servers, no blank/default passwords on devices for SSH or anything else, a process for security updates, etc.? 2) Who is inspecting the code, both server-side and device-side? 3) What are the processes for inspecting the code? How do we know it's actually being done and not just being rubber-stamped? After all, discovering that there's an accidental open port with a default password isn't easy.

kube-system 2y ago
https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8425.pdf https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8425.pdf Yep, pretty basic stuff, like 'require authentication', 'support software updates', etc > 2) Who is inspecting the code, both server-side and device-side? UL is administering the program and they're going to come up with the requirements > UL Solutions will work with stakeholders to make recommendations to the FCC on a number of important program details, like applicable technical standards and testing procedures, post-market surveillance requirements, the product registry, and a consumer education campaign. https://www.ul.com/insights/us-cyber-trust-mark https://www.ul.com/insights/us-cyber-trust-mark
simne 2y ago
Good questions. As I understand, they spent months to decide who will be responsible and who will pay (and how much). Announce happen after budget passed Parliament, so now could make manning table and hire people for next steps.
- simne 2y ago
  Some questions already answered in article - from gov't responsible NIST and FCC and from industry agreed to participate deputies from large companies, so now they will gather meetings and will create some documents. So now, any interested subject (any human or entity, even "group of hackers") could ask to responsible. Or could talk with deputies, as their contacts should appear soon.
bloomingkales 2y ago