A vigilante trying to improve IoT security • Hacker News Board

Re: A vigilante trying to improve IoT security

#211

Post by yumaikas » Thu, Apr 27, 2017, 7:06 AM UTC

After doing a little research it's worth noting a few key things:

1) This attack is not using 0-days. It's using vulnerabilities that have been in the wild for almost 6 months now, and are so trivial to exploit that some security researchers called the exploits "amaturish". These types of devices have been used to DDoS lots of internet infrastructure. What, short of something like this, is going to get those devices and their manufacturers to secure their hardware, given that Mirai wasn't enough to convince them?

2) I honestly think that finding/making a legal means for this sort of scan (specifically, scanning to check for trivially insecure devices, and bricking them if cannot be patched) to happen on a consistent basis is something that the EFF or the like might want to look into. The problem with a vigilantes is that they lack accountability, so while I might personally approve of the current approach from what I can see (even as I recognize it as illegal), it could take easily take a turn for the worse. I think having a standard around need to survive X number of hours connected to the internet and that a certain number of devices (say 10) need to survive 6/12/18/24 months down the road or face recall would be starting point. There are a lot of contingencies to work out for this, such as personal DIY projects and the like, it's not 100% fleshed out.

3) As far as I can tell, the analogy is more along the lines of a bunch people buying a bunch of stereos and/or loudspeakers that are trivially hackable (but the consumers aren't aware of that), and then putting them everywhere. If those loudspeakers and/or steroes started disturbing the peace, or getting used in ultrasonic attacks on power lines or water mains, you can bet that police would be destroying them, and/or allowing others to do the same.

Re: A vigilante trying to improve IoT security

#212

Post by mdpopescu » Thu, Apr 27, 2017, 7:22 AM UTC

pixl97 wrote: post #148

086421357909764 wrote: post #103

Earlier quoted context omitted.

I've brought this up to others, how would you feel if someone decided to brick / modify your car without you knowing? What would you do if that fix backfired and caused damage, hard locked the controls on your car, or worse, simply shut it off at the wrong time? We absolutely need to fix these issues, the governments of the world need to enforce standards on products, but vigilantism no matter how much you may agree…

>how would you feel if Feelings are irrelevant. Some vigilantes hack that said "Turn the car off at 10mph or less" is a far better outcome than the attackers option of "Press the gas and turn the wheel left as hard as you can at 100mph".

> Feelings are irrelevant.

Thank you. I am tired of these so-called arguments that start with "how would you feel if". If we're going by my feelings, you're all in deep trouble.

Re: A vigilante trying to improve IoT security

#213

Post by xroche » Thu, Apr 27, 2017, 7:40 AM UTC

fruzz wrote: post #9

It takes a special kind of entitled to destroy people's things and to then blame others (the manufacturers) for it.

> It takes a special kind of entitled to destroy people's things and to then blame others (the manufacturers) for it.

If you put a dangerous, unsecure device, live on the Internet, that can be used to attack other machines, you deserve to have your property be destroyed.

Re: A vigilante trying to improve IoT security

#214

Post by adrianN » Thu, Apr 27, 2017, 8:10 AM UTC

jahbrewski wrote: post #137

As someone who works as a software consultant for many IoT and connected device companies, how can I increase my understanding of IoT security? How can I ensure the devices I work with are secure?

The MIT has a pretty good online class about security.

https://ocw.mit.edu/courses/electrical-engineering-and-compu...

Re: A vigilante trying to improve IoT security

#215

Post by ska » Thu, Apr 27, 2017, 10:55 AM UTC

jasonm23 wrote: post #185

ska wrote: post #169

Earlier quoted context omitted.

Of course the other way around most often just gives you devices in the field nobody buys. In this, like most things, you need a balance. If you aren't commercially driven in some fundamental way you probably won't last long enough for any of this to make a difference. Of course if you apply that the wrong way, you end up with devices that suck and/or harm users. This way leads to regulation typically, since Smiths i…

> Smiths invisible and myopic hand I'm intrigued by this phrase, could you explain it please?

I mean by this that in practice markets perform a sort of local optimization algorithm that can take a long time to discover better local maxima.

Re: A vigilante trying to improve IoT security

#216

Post by pferde » Thu, Apr 27, 2017, 12:59 PM UTC

nickpsecurity wrote: post #161

sillysaurus3 wrote: post #88

Earlier quoted context omitted.

It's simply difficult to secure devices. It's hard the same way engineering is hard. I know it's fashionable to blame the MBAs instead of blame ourselves, but at the end of it, we're the ones who write insecure code. And I don't think that if you give an engineer an extra week or two to focus on security that you'd end up with a measurably more secure device. Securing something is a different skillset from building i…

"It's simply difficult to secure devices. It's hard the same way engineering is hard." Put OpenBSD and OpenSSH on them with configuration explained in a good book on the subject. Write your apps in memory-safe language that validates external input. The End [for vast majority of attacks in IoT space]. It's not as hard as you detractors claim. They just don't care.

Indeed. It's not hard, it's just more expensive than not doing it at all. And since there is usually no incentive doing it, it is not being done, because not doing it saves money.

Re: A vigilante trying to improve IoT security

#217

Post by nickpsecurity » Thu, Apr 27, 2017, 1:31 PM UTC

pferde wrote: post #216

nickpsecurity wrote: post #161

Earlier quoted context omitted.

"It's simply difficult to secure devices. It's hard the same way engineering is hard." Put OpenBSD and OpenSSH on them with configuration explained in a good book on the subject. Write your apps in memory-safe language that validates external input. The End [for vast majority of attacks in IoT space]. It's not as hard as you detractors claim. They just don't care.

Indeed. It's not hard, it's just more expensive than not doing it at all. And since there is usually no incentive doing it, it is not being done, because not doing it saves money.

Exactly!

Re: A vigilante trying to improve IoT security

#218

Post by 086421357909764 » Thu, Apr 27, 2017, 1:39 PM UTC

jancsika wrote: post #145

086421357909764 wrote: post #122

Earlier quoted context omitted.

What they get is irrelevant, it's someone using their skill set to make others aware of a flaw. I would argue it's the exact same premise. I'm going to phish people & cause them a financial cost to teach them to be safe.

> What they get is irrelevant It's actually the main relevant part of the analogy. It goes to veracity. There's a person who gave a public talk about manipulating Bitcoins with weak private keys in order to alert the owners that they were vulnerable. But he did it in a way that verified to the owner he hadn't in fact stolen the coins (moving small portions around or maybe signing with the key, I can't remember). He a…

So what's gained by bricking, disabling, or modifying devices, that couldn't be proven with a simple these devices are vulnerable announcement?

Re: A vigilante trying to improve IoT security

#219

Post by ryan-c » Thu, Apr 27, 2017, 2:09 PM UTC

jancsika wrote: post #145

086421357909764 wrote: post #122

Earlier quoted context omitted.

What they get is irrelevant, it's someone using their skill set to make others aware of a flaw. I would argue it's the exact same premise. I'm going to phish people & cause them a financial cost to teach them to be safe.

> What they get is irrelevant It's actually the main relevant part of the analogy. It goes to veracity. There's a person who gave a public talk about manipulating Bitcoins with weak private keys in order to alert the owners that they were vulnerable. But he did it in a way that verified to the owner he hadn't in fact stolen the coins (moving small portions around or maybe signing with the key, I can't remember). He a…

You're probably talking about me. I actually screwed up when I was moving coins around, and ended up emptying someone's address out, however I put everything back within a few minutes. I haven't had anyone whose coins I touched accuse me of anything unseemly, but of course there are random posters on internet forums who talk shit.

Your point that I couldn't have given a public talk had I stolen the coins is completely correct. I still spoke with a lawyer about it ahead of time, though. :-P

There was another person, who was somewhat less scrupulous, who would simply steal the coins and watch for someone to complain in public about it, then offer to return them. They use a pseudonym and as far as I can tell have vanished.

Re: A vigilante trying to improve IoT security

#220

Post by ChefDenominator » Thu, Apr 27, 2017, 2:18 PM UTC

fruzz wrote: post #9

It takes a special kind of entitled to destroy people's things and to then blame others (the manufacturers) for it.

This statement and others like it here seem to assume that the hacker has not been directly affected by the infected devices.

For example, maybe this person had a wife dying of cancer while Mirai destroyed his life's work, so in the same period he lost his wife and he lost his work.

Or, maybe he spent a lot of money trying to launch a new product through channels that were destroyed during one of the attacks, and unable to get his money back, had to close the venture.

Maybe he had to sleep in a data center for several months during the holidays and concluded the only reason he was doing this is because consumers and manufacturers aren't concerned with the damage they are doing, so he is going to make them become concerned about the damage they are doing.

The point is that we have no idea if this person has been harmed, and whether they have any other legitimate means of being made whole from harm done, as well as be able to protect themselves from future harm.

Clearly, the proposed solutions coming from industry "experts" is likely to make things worse, as the only other activities to "fight" Mirai seem to be to support legislation as a solution to a technical problem, and I'm really not clear on when this has ever worked, especially in a system that everything on the planet can connect to.