Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates • Hacker News Board

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#211

Post by JoshTriplett » Tue, Sep 05, 2023, 4:45 PM UTC

kijin wrote: post #203

SimingtonFCC wrote: post #91

Earlier quoted context omitted.

Another great step would be a guarantee of making the firmware Open Source after no more than a certain amount of time, and having that guarantee known at compile time. Effectively, that means the device will always be supportable. It's not inconceivable that this could be a requirement for getting a label (or some tier of label.) It depends how the advocacy comes out on the record.

The requirement can be easily bypassed by going bankrupt before the required time is up. You will soon hear advice like "if you want to get in to the IoT space, create a new C Corp for each iteration of your product..." Whatever you require them to disclose after X years, it must be escrowed with a trusted third party in advance .

Agreed: any kind of future disclosure requirement should be backed up by a source code escrow requirement.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#212

Post by duped » Tue, Sep 05, 2023, 4:46 PM UTC

MarcoPerazaFCC wrote: post #185

lacker wrote: post #124

Regulation to require a certain period of security updates doesn't seem useful to me. It's very easy to send out a "security update" that doesn't actually improve security. You can send out an ad to all your users saying "You should upgrade now to our newest product!" and call it a security update. Requiring security updates may end up just requiring companies to spam their users with a certain amount of marketing ma…

I think you're right that it would be difficult for the FCC to precisely define exactly when security updates are required. This is a problem in law generally, one that is usually resolved by imposing a reasonableness standard. Maybe here, a vulnerability needs to be patched if it might reasonably be expected to allow an attacker to take control of a device, or to do so when combined with other known or unknown vulne…

One way to mitigate this is to require introspection into what the update is. This has two implicit requirements which are that the firmware is source-available and has reproducible builds. With those two requirements you would be able to see what is being updated, and prove that the update your device receives is actually the update the manufacturer said they created.

The second requirement is something that is really overlooked in the software supply chain, partly because of the difficulty in achieving it. But it's a goal that the proper push from regulators could help us reach.

A knock on benefit is this helps secure the update channel, which if you are requiring firmware updates you must also require a way to make sure those updates are secure (since it inherently creates more attack surface area)

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#213

Post by holmesworcester » Tue, Sep 05, 2023, 4:46 PM UTC

SimingtonFCC wrote: post #130

tkfu wrote: post #93

One thing that regulators need to be very careful about is how "security updates" are defined, and exactly what manufacturer obligations for issuing security updates should be. CVEs are a notoriously terrible representation of actual security risks, so a measure like "manufacturer must issue new releases that include any released patches for CVEs with a severity rating greater than 9" would be a clear non-starter. Th…

My two cents is that this would be an excellent comment on the record -- I'd love a discussion at the level of defining security risks to be part of the official federal commentary, because this is going to be a thorny implementation problem.

It would be great for people to post an update like "comment submitted" on threads like this one to make sure it was entered as a comment into the official record.

I'm sure these comments in themselves are helpful to @SimingtonFCC individually, but having them be part of the official record gives the FCC legal grounds to consider them and incorporate them into rules.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#214

Post by rlpb » Tue, Sep 05, 2023, 4:47 PM UTC

MarcoPerazaFCC wrote: post #185

lacker wrote: post #124

Regulation to require a certain period of security updates doesn't seem useful to me. It's very easy to send out a "security update" that doesn't actually improve security. You can send out an ad to all your users saying "You should upgrade now to our newest product!" and call it a security update. Requiring security updates may end up just requiring companies to spam their users with a certain amount of marketing ma…

I think you're right that it would be difficult for the FCC to precisely define exactly when security updates are required. This is a problem in law generally, one that is usually resolved by imposing a reasonableness standard. Maybe here, a vulnerability needs to be patched if it might reasonably be expected to allow an attacker to take control of a device, or to do so when combined with other known or unknown vulne…

> This is a general problem for law generally, one that is usually resolved by imposing a reasonableness standard.

Exactly this. Here in the UK we have "merchantable quality" as the standard for the required quality of any goods sold. How "merchantable" is defined is a matter for the courts to decide on a case-by-case basis. In practice, the courts take into account generally market expectations as well as the marketed price to determine the expected quality standard and it seems to work just fine. If my chair falls apart after a few years after ordinary use by ordinary people, then it wasn't of merchantable quality and the seller is in breach of the law.

In the case of security vulnerabilities, I think a similar approach would work well. The key thing is to ensure that sellers of IoT products cannot disclaim responsibility for security vulnerabilities altogether, which is exactly the problem today. If an IoT product can be subverted by an adversary after a few years of ordinary use by ordinary people, then the seller should be in breach of the law.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#215

Post by wolverine876 » Tue, Sep 05, 2023, 4:48 PM UTC

doitLP wrote: post #46

There’s some great recommendations in this thread but I just want to thank you for engaging with this community to solicit opinions from the trenches. This is really meaningful to most of us who see the regulations in our lives as something far away that we can’t influence. Another reminder for everyone that while you likely can’t influence something like a presidential election on your own, you can influence many ot…

Agreed. Thank you Commissioner Simington for reaching out to us. It makes all the difference in the world.

> while you likely can’t influence something like a presidential election on your own

In fact, there is almost nothing of significance you can accomplish (or influence) on your own. We always do and always have needed to work together - and the results are astonishing: almost everything that's ever been accomplished.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#216

Post by fidotron » Tue, Sep 05, 2023, 4:49 PM UTC

eru wrote: post #112

fidotron wrote: post #35

While the IoT security situation is out of control I doubt that regulating security updates will have any other result than radically reducing competition and innovation in the space by making it impossible to operate as a small company. It will simply push more hardware innovation out to China. Having worked in the space I came to the conclusion the only viable secure future is to adopt star topology local networks…

> The only corporate actors I encountered that understood this were the Taiwanese OEMs, who are remarkably on point and blunt behind closed doors, but they are basically powerless to do anything about it. Fascinating! Could you elaborate?

Firstly you have to appreciate the web isn’t a thing. When they want to talk protocols and crypto they mean things like sockets, mqtt and talk about where on the production line the fuses for the keys will be blown and who will have access to that area. It is a different universe.

The absolutely huge thing is they want to live in a world of standard interchangeable pieces. They despise custom solutions to problems unless totally necessary or they are enormously better than the alternatives.

They will flat out tell you that they are essentially waiting for an industry standard solution to problem X to appear, and until it does these ad hoc solutions suck.

If you want IoT security you don’t need to regulate it, you “just” need to create a no-brainer to adopt industry standard model for device operation that these people can drop in place. (I hate MQTT, but think something in that ballpark with the right security model* would be a good starting point). This is a hard enough ask as is, but is made harder by the big software giants all trying to come up with schemes that put them in the middle all the time.

As an aside I also encountered a non Taiwanese executive espousing the view (with respect to slurping up network topologies via multicast) that he hates it, but as long as it isn’t illegal they have to do it. I don’t believe the law would help as you will always have bad actors and people using aliexpress - it needs to be technically impossible, hence the star networks.

Edit to add: * and provisioning process. Were it up to me I'd have something like NFC based key exchange between broker and device during setup as part of the standard.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#217

Post by 1000100_1000101 » Tue, Sep 05, 2023, 4:49 PM UTC

treyd wrote: post #183

entropyie wrote: post #67

Earlier quoted context omitted.

This is also a key point to fighting ewaste and making devices last longer. I have appliances from the 70s including a rotary telephone, that I still use regularly. If you combined mandatory OSS support with repair cafes, you would have a model for sustainable reuse and better security. You may even start a commercial aftermarket in reflashing older devices!

Yeah if companies that make IoT hardware complain about the costs to keep old devices updated then they should be required to make them more user-modifiable and release source code / signing keys when they're abandoned by their manufacturer so that they can be picked up by the communities and development can be continued (also requires some policing to determine when hardware is functionally abandoned, as releasing a…

Releasing Signing keys seems a potentially dangerous one. Someone could produce malicious firmware, sign it, and convince your device to auto-update with it.

I think (and I'm a security know-nothing, so could very well be off in the weeds), the firmware should accept updates signed with two keys. The manufacturer key, which can allow automatic updates, and a post-service key that cannot be automatic. Either a user has to initiate the firmware update manually, or consent via some other means.

This post-service firmware may very well enable a third key for automatic updates of its own, so there's just a manual step on the transition from manufacturer to some community project you support, not each revision afterwards.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#218

Post by Y_Y » Tue, Sep 05, 2023, 4:49 PM UTC

tzs wrote: post #100

the4anoni wrote: post #14

Earlier quoted context omitted.

As far as I remember FCC about 8 years ago didn't liked OpenWRT, and even enforced on TP Link to lock it.

There was no requirement that firmware be locked down. The requirement was that consumer radio transmitters could be too easily made to use frequencies and power levels that violate FCC regulations. If a device had a transmitter where firmware could control those things, and the firmware for the device was one blob that contained everything so letting the user replace firmware meant letting the user control those res…

Isn't that a bit overreaching? I can make you a device the spews garbage on any wavelength you fancy, so they're really only preventing accidental radio pollution. Even in that case it's pretty unusual to prevent a consumer device (other than a radio) from being used in an unlawful way, Part 15 notwithstanding.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#219

Post by earthboundkid » Tue, Sep 05, 2023, 4:50 PM UTC

This is a great idea! Just last week my wife had to connect our oven to the wifi to use an app to control it, and I was thinking about how there's basically no guarantee the oven won't just become a botnet on our internal network eventually. It would be great to get some legal requirements on this stuff.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#220

Post by CameronNemo » Tue, Sep 05, 2023, 4:50 PM UTC

charcircuit wrote: post #190

CameronNemo wrote: post #138

Earlier quoted context omitted.

They may have trusted family members, friends, or neighbors who they feel comfortable allowing the management of their internet connected devices.

No. As long as their iot device is still working consumers could care less about security updates.

What do you mean by "no"? Are you denying the existence of my grandparents who trust me to manage their devices?