5 ms·

I hate to be running to the government for this, but... the FCC has regulations that require some level of testing for devices that are going to use certain par

by swombat 12y ago

I hate to be running to the government for this, but... the FCC has regulations that require some level of testing for devices that are going to use certain parts of the spectrum. Some parts have been declared "free zones" and I believe that's where the wifi systems tend to operate. Perhaps we need the FCC to step in there and mandate some basic security certification for connected devices. At the very least the certifications should check that: * The device always uses some form of encrypted communications if at all possible based on what it's communicating with * If the device implements some form of remote control, that remote control includes both sufficiently secure authentication and authorisation mechanisms to ensure that at least it will take some effort to break into * The device does not leak personal data to unauthorised or unauthenticated requesters, and provides a clear list of what data will be willingly communicated to whom (software should do that too...) And so on... The certification process could/should be implemented by high-reputation security companies like Kasperski or Matasano... Until/unless some barrier to entry is erected, I think it's inevitable that everything that can be connected will be, and that this will mostly be insecure. In the meantime, I guess the solution is to only buy potentially connected devices from premium technology companies (e.g. Apple, Microsoft, Google, Tesla, Nest, etc) - but then, of course, those companies don't sell everything (e.g. no microwaves, car washes, etc) so that would limit the range of things you can safely purchase, for now... On that note, given how corrupt and broken the US system is, perhaps this needs to start in Europe, where there is already a general mindset of consumer and personal data protection...

icebraining 12y ago
Frankly, that sounds like a good way to kill open source IoT projects (which can't afford to hire Matasano) while helping TLAs by centralizing the information on just a few companies. I'd much rather have strong penalties to companies selling unreasonably insecure devices, with reimbursements to clients and rewards to the reporters of security flaws.
- swombat 12y ago
  That could work as well... Perhaps a better method than the certification approach. My point is just: we probably need the government to help somehow.
- jdhouse4 12y ago
  If IoT becomes a security or safety nightmare, which I think most of us will concede as possible if not likely, there will be a public outcry that will result in either gov't oversight and regulation or the industry being sued out of existence. So, assuming for the moment that the IoT industry does not want to be suffocated by lawsuits, the real question for it is by whose hand regulations emerge and are enforced; the industry itself or the gov't? Industry-based regs, e.g. UL.com, will be the least burdensome. But almost always an industry cannot self-regulate because of free riders, et al., or out of a short-term focus over profit maximization. So, in steps gov't regulation. And gov't regulation is very often over-kill, like using a bazooka to kill a fly. Said bazooka does result in a dead bug but also a lot of collateral damage to the industry being regulated. Think the FAA and how it's Part 23 regulations have both guaranteed safe aircraft and stagnated the general aviation industry nearly to death. With articles such as this one and Gawker's "Why is My Smarthome So Fucking Stupid", it's pretty obvious that the IoT industry as a whole should be embracing and spreading industry-wide security, safety, and UX standards. Yet, for now there seems to be no such industry initiative to do so, leaving the task to Apple and, to a much lesser degree, Google. With HomeKit, Apple is forcing partners to adhere to tight security and usability standards. With its large user-base of ApplePay-enabled, willing consumers, Apple can force its will upon IoT partners going through the HomeKit acceptance process. But as if on cue, some partners, exhibiting short-sightedness, have whined to the press that Apple's process is onerous. While I'm sure Apple is more than happy to let IoT manufacturers not affiliated with HomeKit IED themselves through lax security or UX, for the industry it's a big mistake.
- jerematasno 12y ago
  Speaking as one who stands to benefit from such a rule, I also think that requiring 3rd party validation is a bad idea. First off, it's always a race to the bottom, and secondly, there are not enough qualified people in the world to look at everything. I would, however, like to see a general rule requiring software and hardware makers to take "reasonable steps" to secure their products, and opening them up to liability if they do not. A few class-action lawsuits would go a long way towards encouraging everyone to put in a secure SDLC.
jdhouse4 12y ago
A few massive home hacks and I agree that the gov't will step-in. Personally, I'd rather have the FCC than the NSA regulate wireless security.
greggman 12y ago
I agree with the sentiment but do you really trust the government can actually audit some giant codebase? The internet of things really includes your computer and your PS4 and every piece of software on them. It includes your router and your printer and your IP cam that's basically the same thing as your router with camera attached. I don't know what the solution is but I really can't imagine a government body able to audit all that code in any meaningful way. I think rather (and please punch holes in this idea) ... maybe fines if something isn't secure? I can't see how that would work either though. Not even the big guys have secure software as new issues are found all the time. Basically it seems like you need to shun companies that get caught which will hopefully send a message. Also possibly take precautions. Put your internet of things devices on their own networks etc., don't let them on the net directly, ...?
- snarfy 12y ago
  The government wouldn't be doing the work. We just need the legal framework in place. The industry would do it themselves, but they don't now since there are no real consequences. There should be. We have plenty of rules around how medical records are treated. There needs to be similar rules for all this stuff.
- higherpurpose 12y ago
  Making companies liable for any hacking would be one way to go, which may be quite effective - granted the politicians will actually listen to the People on this, and not the army of lobbyists that will be set unto Washington against such a proposal.
- tzs 12y ago
  > I agree with the sentiment but do you really trust the government can actually audit some giant codebase? He didn't say that the government would do the code auditing (unless I missed it). It would be outside firms. I believe they do something similar for certifying hardware. The FCC certifies outside hardware testing labs as being qualified to certify that hardware satisfies FCC requirements. The hardware makers wishing to gain certification hire one of those labs.
happyscrappy 12y ago
Europe should hamstring their tech companies even more with feel good but useless regulations like the cookie law?
legulere 12y ago
Security certification doesn't work and can't guarantee products to be free from security holes. What we need is an obligation for the manufacturers to provide an automatic update mechanism and updates fixing security critical bugs for several years.
- rmc 12y ago
  Sometimes "upgrades" breaks things for users, and they are reluctant to apply them. Users are trained to not apply upgrades. Ideally you'd need law that manufactors not do that.
  - digi_owl 12y ago
    That is because OEMs lump security fixes in with "value addition". What is required is a multi track maintenance scheme, similar to LTS releases etc.
  - higherpurpose 12y ago
    Oh, the updates should definitely be automatic (like Chrome). For one, it would ensure the companies are a lot more careful with what they're sending for update so as to not break millions of devices at once, and second, as you said, it removes the hassle from users having to deal with tens of different devices.
amirmc 12y ago
The government is something of a blunt instrument. The difficulty in the proposal as described is how you can precisely define the terms such that you can reliably measure 'compliance' -- cue: lots of legalese and paperwork (cf medical device regs where you really do want stringent controls and considered processes). Sanctions for data breaches and poor security might work but then they simply become costs of doing business and don't necessarily lead to improvments (just passing the buck). In my view (see my other comment [1]), we need to reconsider how we build, deploy and manage software for this 'connected-age'. If developers are not willing to try to solve this with better tools/infrastructure, then no amount of legislation is going to fix it. If anything, the poorly-secured incumbents will simply misappropriate existing laws to go after those who uncover faults. (NB: I'm not suggesting that government doesn't have a role to play, but solely relying on them is doomed to fail -- eg who d'you think would be advising them on such legislation? Not the people you'd likely want.) [1] https://news.ycombinator.com/item?id=9089160 https://news.ycombinator.com/item?id=9089160
- alexandros 12y ago
  I thoroughly agree that this is something we developers have to fix instead of adding yet more hoops to jump through. Like you I am also working on the problem of tools/infrastructure to solve this problem though probably a different aspect of the problem, with my startup resin.io
Spooky23 12y ago
Noooooooo! The only reason we have wireless innovation outside of the military is that we have these "free zones". The problems we have today aren't radio problems -- which is what the FCC is there for. It's application layer issues that exist whether you are wired or unwired, private or public networks. We're in an early adopter phase, so products are immature. You shouldn't be allowing IoT devices in high security environments, or incorporating devices into structures that cannot be retrofitted in 5 years until we move a little further up the lifecycle. If you want high assurance controllers for light fixtures, motors, and other IoT use cases, you need to talk to Johnson Controls, Honeywell, and similar companies and pay for the privilege.
superbaconman 12y ago
This is not a good idea. Now every time a want to sell a minor piece of connected hardware not only will I need a security professional on my team, but I'll need to pay someone (government approved) to audit my work. I want nothing to do with such laws.
- pjc50 12y ago
  I'm hardly a massive exponent of this kind of thing, and I've complained about CE/WEEE/RoHS in the past; but I think the general idea of some minimum product standard is a good one (with a clear "hobbyist" exemption). If you don't have a security professional to hand, how do you or I know your IoT thingy isn't going to turn into a malware vector? But I agree that governments don't have a great track record on setting the correct standards. Cameron was only recently talking about a ban on non-backdoored communication. (Note that CE supports self-certification, it just has very unclear and lengthy rules)
- pdkl95 12y ago
  To quote Dan Geer, "Yes, please! That was exactly the idea." There are many industries that require this kind of auditing or similar regulation. I would think that the technology-based industries are clever enough to find a way to accomplish these checks quickly and cheaply.
- NeutronBoy 12y ago
  > not only will I need a security professional on my team It's almost as if that's the entire point...
noonespecial 12y ago
This will result in only huge companies that can afford a bunch of paperwork and liability insurance being able to sell the same old insecure things while no one else will be able to afford to challenge them with actual secure things. As usual it will become more about permission than proficiency so we'll predictably end up with corruption instead of competence.
smutticus 12y ago
Perhaps this is what you're looking for. http://www.ftc.gov/news-events/press-releases/2015/01/ftc-report-internet-things-urges-companies-adopt-best-practices http://www.ftc.gov/news-events/press-releases/2015/01/ftc-re... It's a start at least.

by swombat 12y ago

icebraining 12y ago

Frankly, that sounds like a good way to kill open source IoT projects (which can't afford to hire Matasano) while helping TLAs by centralizing the information on just a few companies. I'd much rather have strong penalties to companies selling unreasonably insecure devices, with reimbursements to clients and rewards to the reporters of security flaws.

swombat 12y ago
That could work as well... Perhaps a better method than the certification approach. My point is just: we probably need the government to help somehow.
jdhouse4 12y ago
If IoT becomes a security or safety nightmare, which I think most of us will concede as possible if not likely, there will be a public outcry that will result in either gov't oversight and regulation or the industry being sued out of existence. So, assuming for the moment that the IoT industry does not want to be suffocated by lawsuits, the real question for it is by whose hand regulations emerge and are enforced; the industry itself or the gov't? Industry-based regs, e.g. UL.com, will be the least burdensome. But almost always an industry cannot self-regulate because of free riders, et al., or out of a short-term focus over profit maximization. So, in steps gov't regulation. And gov't regulation is very often over-kill, like using a bazooka to kill a fly. Said bazooka does result in a dead bug but also a lot of collateral damage to the industry being regulated. Think the FAA and how it's Part 23 regulations have both guaranteed safe aircraft and stagnated the general aviation industry nearly to death. With articles such as this one and Gawker's "Why is My Smarthome So Fucking Stupid", it's pretty obvious that the IoT industry as a whole should be embracing and spreading industry-wide security, safety, and UX standards. Yet, for now there seems to be no such industry initiative to do so, leaving the task to Apple and, to a much lesser degree, Google. With HomeKit, Apple is forcing partners to adhere to tight security and usability standards. With its large user-base of ApplePay-enabled, willing consumers, Apple can force its will upon IoT partners going through the HomeKit acceptance process. But as if on cue, some partners, exhibiting short-sightedness, have whined to the press that Apple's process is onerous. While I'm sure Apple is more than happy to let IoT manufacturers not affiliated with HomeKit IED themselves through lax security or UX, for the industry it's a big mistake.
jerematasno 12y ago
Speaking as one who stands to benefit from such a rule, I also think that requiring 3rd party validation is a bad idea. First off, it's always a race to the bottom, and secondly, there are not enough qualified people in the world to look at everything. I would, however, like to see a general rule requiring software and hardware makers to take "reasonable steps" to secure their products, and opening them up to liability if they do not. A few class-action lawsuits would go a long way towards encouraging everyone to put in a secure SDLC.

jdhouse4 12y ago

A few massive home hacks and I agree that the gov't will step-in. Personally, I'd rather have the FCC than the NSA regulate wireless security.

greggman 12y ago

I agree with the sentiment but do you really trust the government can actually audit some giant codebase? The internet of things really includes your computer and your PS4 and every piece of software on them. It includes your router and your printer and your IP cam that's basically the same thing as your router with camera attached. I don't know what the solution is but I really can't imagine a government body able to audit all that code in any meaningful way. I think rather (and please punch holes in this idea) ... maybe fines if something isn't secure? I can't see how that would work either though. Not even the big guys have secure software as new issues are found all the time. Basically it seems like you need to shun companies that get caught which will hopefully send a message. Also possibly take precautions. Put your internet of things devices on their own networks etc., don't let them on the net directly, ...?

snarfy 12y ago
The government wouldn't be doing the work. We just need the legal framework in place. The industry would do it themselves, but they don't now since there are no real consequences. There should be. We have plenty of rules around how medical records are treated. There needs to be similar rules for all this stuff.
higherpurpose 12y ago
Making companies liable for any hacking would be one way to go, which may be quite effective - granted the politicians will actually listen to the People on this, and not the army of lobbyists that will be set unto Washington against such a proposal.
tzs 12y ago
> I agree with the sentiment but do you really trust the government can actually audit some giant codebase? He didn't say that the government would do the code auditing (unless I missed it). It would be outside firms. I believe they do something similar for certifying hardware. The FCC certifies outside hardware testing labs as being qualified to certify that hardware satisfies FCC requirements. The hardware makers wishing to gain certification hire one of those labs.

happyscrappy 12y ago

Europe should hamstring their tech companies even more with feel good but useless regulations like the cookie law?

legulere 12y ago

Security certification doesn't work and can't guarantee products to be free from security holes. What we need is an obligation for the manufacturers to provide an automatic update mechanism and updates fixing security critical bugs for several years.

rmc 12y ago
Sometimes "upgrades" breaks things for users, and they are reluctant to apply them. Users are trained to not apply upgrades. Ideally you'd need law that manufactors not do that.
- digi_owl 12y ago
  That is because OEMs lump security fixes in with "value addition". What is required is a multi track maintenance scheme, similar to LTS releases etc.
- higherpurpose 12y ago
  Oh, the updates should definitely be automatic (like Chrome). For one, it would ensure the companies are a lot more careful with what they're sending for update so as to not break millions of devices at once, and second, as you said, it removes the hassle from users having to deal with tens of different devices.

amirmc 12y ago

The government is something of a blunt instrument. The difficulty in the proposal as described is how you can precisely define the terms such that you can reliably measure 'compliance' -- cue: lots of legalese and paperwork (cf medical device regs where you really do want stringent controls and considered processes). Sanctions for data breaches and poor security might work but then they simply become costs of doing business and don't necessarily lead to improvments (just passing the buck). In my view (see my other comment [1]), we need to reconsider how we build, deploy and manage software for this 'connected-age'. If developers are not willing to try to solve this with better tools/infrastructure, then no amount of legislation is going to fix it. If anything, the poorly-secured incumbents will simply misappropriate existing laws to go after those who uncover faults. (NB: I'm not suggesting that government doesn't have a role to play, but solely relying on them is doomed to fail -- eg who d'you think would be advising them on such legislation? Not the people you'd likely want.) [1] https://news.ycombinator.com/item?id=9089160 https://news.ycombinator.com/item?id=9089160

alexandros 12y ago
I thoroughly agree that this is something we developers have to fix instead of adding yet more hoops to jump through. Like you I am also working on the problem of tools/infrastructure to solve this problem though probably a different aspect of the problem, with my startup resin.io

Spooky23 12y ago

Noooooooo! The only reason we have wireless innovation outside of the military is that we have these "free zones". The problems we have today aren't radio problems -- which is what the FCC is there for. It's application layer issues that exist whether you are wired or unwired, private or public networks. We're in an early adopter phase, so products are immature. You shouldn't be allowing IoT devices in high security environments, or incorporating devices into structures that cannot be retrofitted in 5 years until we move a little further up the lifecycle. If you want high assurance controllers for light fixtures, motors, and other IoT use cases, you need to talk to Johnson Controls, Honeywell, and similar companies and pay for the privilege.

superbaconman 12y ago

This is not a good idea. Now every time a want to sell a minor piece of connected hardware not only will I need a security professional on my team, but I'll need to pay someone (government approved) to audit my work. I want nothing to do with such laws.

pjc50 12y ago
I'm hardly a massive exponent of this kind of thing, and I've complained about CE/WEEE/RoHS in the past; but I think the general idea of some minimum product standard is a good one (with a clear "hobbyist" exemption). If you don't have a security professional to hand, how do you or I know your IoT thingy isn't going to turn into a malware vector? But I agree that governments don't have a great track record on setting the correct standards. Cameron was only recently talking about a ban on non-backdoored communication. (Note that CE supports self-certification, it just has very unclear and lengthy rules)
pdkl95 12y ago
To quote Dan Geer, "Yes, please! That was exactly the idea." There are many industries that require this kind of auditing or similar regulation. I would think that the technology-based industries are clever enough to find a way to accomplish these checks quickly and cheaply.
NeutronBoy 12y ago
> not only will I need a security professional on my team It's almost as if that's the entire point...

noonespecial 12y ago

This will result in only huge companies that can afford a bunch of paperwork and liability insurance being able to sell the same old insecure things while no one else will be able to afford to challenge them with actual secure things. As usual it will become more about permission than proficiency so we'll predictably end up with corruption instead of competence.

smutticus 12y ago

Perhaps this is what you're looking for. http://www.ftc.gov/news-events/press-releases/2015/01/ftc-report-internet-things-urges-companies-adopt-best-practices http://www.ftc.gov/news-events/press-releases/2015/01/ftc-re... It's a start at least.