8 ms·
The FCC maintains a list of equipment and services (Covered List) that have been determined to “pose an unacceptable risk to the national security
by WarOnPrivacy 7mo ago
The FCC maintains a list of equipment and services (Covered List)
that have been determined to “pose an unacceptable risk to the
national security
Recently, malicious state and non-state sponsored cyber attackers
have increasingly leveraged the vulnerabilities in small and home
office routers produced abroad to carry out direct attacks against
American civilians in their homes.
Vulnerabilities have nothing to do with country of manufacture. They have always been due to manufacturers' crap security practices. Security experts have been trying to call attention to this problem for 2 decades.
Manufacturers have never had to care about security because no Gov agency would ever mandate secure firmware. This includes the FCC which license their devices and the FTC who (until recently) had the direct mandate to protect consumers.
Our most recent step backward was to gut those agencies of any ability to provide consumer oversight. All they they can do now is craft protectionist policies that favor campaign donors.
The US has a bazillion devices with crap security because we set ourselves up for this.
- orthogonal_cube 7mo agoThat’s the ironic part. Plenty of consumer-grade devices have had very lax security settings or backdoors baked in for purposes of “troubleshooting” and recovery assistance. It’s never been limited to foreign-made devices. Security has never been part of the review process. The only time any agency has really cared is when encryption is involved, and that’s just been the FBI wanting it to be neutered so they can have their own backdoors.
- longislandguido 7mo ago> Vulnerabilities have nothing to do with country of manufacture. They have always been due to manufacturers' crap security practices. Sorry but this is merely a convenient excuse. Source: I have hard evidence of a Chinese IoT device where crap security practices were later leveraged by the same company to inject exploit code. It's called plausible deniability and it's foolish to tell me it's a coincidence. You're not going to convince me that a foreign state actor pressuring a company to include a backdoor wouldn't disguise it as a "whoopsie, our crap code lol" as opposed to adding in the open with a disclaimer on it. It's all closed source firmware. Even the GPL packages from most consumer router vendors are loaded with binary blobs. Tell me I should trust it.
- cowpig 7mo agoWhat was the company, and what did they inject?
- gobins 7mo agoAre you saying that other manufacturers don't do this?
- longislandguido 7mo agoAre you asking me if I have the master list of naughty and nice router manufacturers? No, I don't have it but you may check with Santa Claus.
- cjk 7mo agoIf US manufacturers (or manufacturers in allied countries) do this, legal avenues exist to hold those manufacturers accountable. Not so with China. (That is not to say that the FCC change will move the needle on the underlying issue of router security; as some of the ancestor comments have said, lax security practices are common industry-wide, irrespective of country of development/manufacture.)
- mindslight 7mo ago> legal avenues exist to hold those manufacturers accountable Oh, sweet summer child. Disclaiming these possible avenues of liability is the main goal of clickwrap "terms of service".
- AnthonyMouse 7mo ago> Manufacturers have never had to care about security because no Gov agency would ever mandate secure firmware. The problem is that "secure firmware" is a relativistic statement. You ship something with no known bugs and then someone finds one. What you need is not a government mandate for infallibility, it's updates. But then vendors want to stop issuing them after 3 years, meanwhile many consumers will keep using the device for 15. And "require longer support" doesn't fix it because many of the vendors will go out of business. What you need is the ability for consumers to replace the firmware. That solves the problem in three ways. First, when the company goes out of business you can still put a supported third party firmware on the device. Second, you can do that immediately, because the open source firmwares have a better security record than the OEMs to begin with. And third, then the device is running a widely used open source firmware instead of a custom device-specific proprietary black box, which makes it easier for the government or anyone else who is so inclined to find vulnerabilities and patch them.
- gerdesj 7mo ago"You ship something with no known bugs and then someone finds one." You managed to say that with a straight face! Let's keep this ... non partisan. You might recall that many vendors have decided to embed static creds in firmware and only bother patch them out when caught out. How on earth is embedded creds in any way: "no known bugs"? I think we are on the same side (absolutely) but please don't allow the buggers any credibility!
- AnthonyMouse 7mo ago> How on earth is embedded creds in any way: "no known bugs"? You misunderstand how organizational knowledge works. You see, it doesn't. Some embeds the credentials, someone else ships the product. The first person doesn't even necessarily still work there at that point. Remember that time NASA sent a Mars orbiter to Mars and then immediately crashed it because some of them were using pounds and the others newtons? Literally rocket scientists. The best we know how to do here is to keep the incentives aligned so the people who suffer the consequences of something can do something about it. And in this case the people who suffer the consequences are the consumers, not the company that may have already ceased to exist, so we need to give the consumers a good way to fix it.
- khana 7mo ago[dead]
- rayiner 7mo ago> This includes the FCC which license their devices The FCC licenses devices to the extent that devices can cause spurious transmissions in the radio spectrum. It’s not a general consumer protection agency. Computer security also is outside the mandate of the FTC, which exists to protect consumers from anticompetitive conduct and unfair business practices, not crappy products.
- rstat1 7mo agoSo if a company uses as part of its marketing for a product the phrase "advanced security, privacy, and connectivity for homes of every shape and size" and then is later found to have lied about the "advanced security" and "privacy" part of their marketing by shipping firmware with security bugs, does that not now fall under the "deceptive" category of the "unfair, deceptive and fraudulent business practices" part of the FTC's mission? Sounds like it does to me. Also you're forgetting the part where the FTC under a prior administration either banned DLINK from selling in the US or heavily fined them for selling routers in the US that they knew were running insecure, buggy firmware. (both quotes were taken verbatim from first, Netgear's US website, and secondly the Bureau of Consumer Protections' section of the FTC's website)
- dlcarrier 7mo agoI could see why someone might be confused in the Mayer of what the FCC can regulate, considering that it regulates the content of television and radio broadcasts and somehow regulates cable TV providers, despite the use of wired connections to customers, instead of radio transmissions.
- kelnos 7mo agoWhere in the Federal Communications Commission's governing legislation does it say that they're only allowed to regulate things sent through the airwaves?
- rayiner 7mo agoIt applies to communications over radio or wire: “The provisions of this act shall apply to all interstate and foreign communication by wire or radio and all interstate and foreign transmission of energy by radio, which originates and/or is received within the United States, and to all persons engaged within the United States in such communication or such transmission of energy by radio, and to the licensing and regulating of all radio stations as hereinafter provided…”
- Glyptodon 7mo agoIMO they should have a choice between open source that can be updated out of band from the manufacturer or assuming direct liability for issues for the product's life.
- zobzu 7mo agoI know it's the norm to criticize the admin, but I don't think its what they're saying. I think they're saying "they know of the vulns they leave in and only fix them after it's been exploited by their states". Not that any consumer router is super nice and safe, honestly, you're better off making your own these days.
- WhyNotHugo 7mo agoI suppose foreign routers might not have convenient mechanisms for the government to access and control them at will, hence the "unacceptable risk to the national security".
- pimterry 7mo ago> no Gov agency would ever mandate secure firmware Interestingly, Europe is about to try this: the Cyber Resilience Act is going to become obligatory for all sold digital products (hardware & software) by the end of 2027, with a bunch of strict minimum requirements: no hardcoded default passwords, must check for known vulnerabilities in components/dependencies, encryption for data at rest, automatic security updates by default (which must be separate from functionality updates), etc. Remains to be seen whether this'll help, but good to see somebody have a go at fixing this.
- ozlikethewizard 7mo agoEncrypting data at rest is security theatre right? Unless consumers control the keys (which they generally dont want to), the keys will have to be accessible by the system storing the data. So if the system is compromised so are the keys? Like I cannot see the security benefits from encrypting data at rest in a non E2E system.
- rkangel 7mo agoIt's a whole lot easier to store the keys in a special hardened location than it is to store your whole storage.
- ozlikethewizard 7mo agoRight but access to those keys will be available in an unhardened location then? Otherwise you're serving encrypted data. So if the system accessing the data and using the keys is compromised, which we can assume is the case if the data is compromised, then access to the keys is as well? Maybe I'm being an idiot but it seems like a lot of extra complexity to protect against really only physical attacks where someone directly steals the data storage.
- winstonwinston 7mo ago> to protect against really only physical attacks where someone directly steals the data storage. Yes, physical access poses a significant risk to data security, it should not be ignored.
- PunchyHamster 7mo agoIf they cared about security they'd mandate time to fix for the found vulnerabilities, or outright requested the source to be available
- mcv 7mo agoSo after two decades, the FCC finally does something about insecure routers by banning security updates unless you jump through a bunch of extra hoops. That's definitely going to improve the situation.
- graemep 7mo ago> Vulnerabilities have nothing to do with country of manufacture. They have always been due to manufacturers' crap security practices. True, but the country of manufacture is related to the risk of back doors. There is a huge security problem (everywhere, not just the US) with insecure consumer devices (not just routers, everything from Wi-fi enabled lightbulbs to cars). AT least someone seems to be waking up to the problem even if their solution is half-baked.
- mrexcess 7mo ago>Vulnerabilities have nothing to do with country of manufacture. That depends on how you define "Vulnerability", doesn't it? For instance, from some standpoints, the absence rather than presence of a backdoor in consumer routers could be considered a "vulnerability", no?