I am cautiously leaning towards the perspecive that Schneier is right. This problem is not going to be solved by market forces. Ordinary non technical consumers will buy things like wifi security cameras for the absolute cheapest price at $45/unit, based on them having attractive retail packages or what appears to be a good feature set/spec/price. I have not seen any signs that people are moving away from known-insecure things in droves, because in my estimate, only 1 to 5% of users of such things actually care about the operating system/under the hood software configuration of their IoT devices.
Schneier: It's Time to Regulate IoT to Improve Cyber-Security
71–80 of 185 posts
Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security
#72Earlier quoted context omitted.
You’re right, it’s not easy. But even specifying hilariously trivial stuff like HTTPS, certificate pinning, no hardocded backdoors, and per-device random initial passwords would probably be a huge boon. Simple security without even talking about the problems on the service servers. I imagine a market would appear for some of the basic software (Linux diaries, etc) to help make things easy for small companies that do…
> HTTPS, certificate pinning, no hardocded backdoors, and per-device random initial passwords would probably be a huge boon That's what I meant by check-mark security. Yes, it is better than nothing, and by all means let's do that. It's low hanging fruit, and it should be plucked. But in the end it amounts to little more than hanging an air re-freshener on a huge pile of garbage. I'm just pointing out that such certi…
Just like car safety we have to keep raising the bar.
Checklist car safety means a pretty safe car these days, and the companies that go beyond do amazing things.
Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security
#73Earlier quoted context omitted.
The creation and definition of torts (or the generalization of existing torts to cover new relsted domains) is a mechanism of regulation.
Yes. In the postwar period, the word regulation typically entails new laws, possibly a new regulating agency, and a mix of civil and/or criminal penalties. I think a more liberal interpretation of existing torts would be simpler, more just, and harder to game.
It also encourages the tiering of IoT such that insecure-and-cheap remains on the market and is pushed towards people who can least afford to be pwned.
Regulation is not blind, but it does raise the floor.
Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security
#74Earlier quoted context omitted.
You can, but you very well might not. And your desktop computer is a far, far more valuable target in terms of computing power and network connectivity. Should we be regulating that device as protection against your choosing or forgetting to not follow best practices?
> And your desktop computer is a far, far more valuable target in terms of computing power and network connectivity. It’s also FAR more secure. IoT devices are often easy to hack. And while they may not have much horsepower they have a network connection. You won’t mine many Bitcoins but it doesn’t take a lot power to be part of a DDoS. And I have one computer, one tablet, one phone. I may have 5 smart lightbulbs, a…
Also a good point, but how would you propose that we measure 'security'? Is an Android phone that hasn't received a carrier update in 8 months "secure"? How about a home server running an ancient distro which long since stopped receiving package updates?
The phone is probably a bigger concern at scale, but I have seen plenty of families with dusty "photo storage/backup" boxes that their family's resident IT person set up and networked when they were in high school.
Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security
#75Can't legislate security into existence...at least not very safely
Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security
#76Even though many people scoff at the idea of government regulations, the economic incentives in IoT security are really all messed up and it's not really clear that the market will fix itself because so much of the damage can be externalized somehow. Does the manufacturer of a cheap and outdated IoT device care if it's participating in some ddos attack? Or like Schneier said, does the consumers care if they don't not…
> One thing that could kill the market is maybe making manufacturers liable for the damages caused by security holes in their devices, but regulation doesn't have to go that far to make an impact. What reasonable case is there for making them not liable for the damages caused?
> What reasonable case is there for making them not liable for the damages caused?
After what period of time? Microsoft updated Windows XP after the official end-of-life of the OS for consumers with the patch to the Samba protocol to prevent WannaCry, but if they hadn't bothered, would they still be liable? Should they?
Are they obligated to update pirated versions of their OS?
Is the manufacturer liable if they release a software patch but the product owner doesn't apply the upgrade? What share of the liability should each party take?
Software is largely immune to liability litigation in the USA because the current legal status of it is not legally "a product". Converting it to "a product" for the purposes of liability is a major sea change for our understanding of what business models can be applied to software, licensing, ownership, etc.
Also, does the average product programmer carry some sort of programming insurance? Are we going to force every web developer and every open source programmer to carry insurance, to be licensed to program, and to live up to specific ethical standards?
I'm not saying these are undesirable changes, just that they are changes and there are a ton of issues programmers don't foresee that should be discussed before making
Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security
#77Earlier quoted context omitted.
> One thing that could kill the market is maybe making manufacturers liable for the damages caused by security holes in their devices, but regulation doesn't have to go that far to make an impact. What reasonable case is there for making them not liable for the damages caused?
> What reasonable case is there for making them not liable for the damages caused? After what period of time? Microsoft updated Windows XP after the official end-of-life of the OS for consumers with the patch to the Samba protocol to prevent WannaCry, but if they hadn't bothered, would they still be liable? Should they? Are they obligated to update pirated versions of their OS? Is the manufacturer liable if they rele…
Well, we just did a recall where the airbag was replaced in a more-than-ten-years-old car. I'm pretty sure they did that because, yes, they were still liable.
Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security
#78Earlier quoted context omitted.
It could help the market. It wouldn't be that hard to scan your local network and gather devices and firmware versions (if supported) or fingerprint them if all else fails, and compare against a database of known bad versions and provide weekly or monthly reports by email. I could see this being offered as a selling point of routers. AT&T and Comcast would almost definitely include support in their modem routers just…
I'm sorry, I don't understand. Who's going to update the firmware in your light bulbs using a patched open source version of the manufacturer's code? Edit: > it's not generally that hard to flash devices that support it, so a report that says "X,Y and Z have exploits, here are some options" could go a long way. Making devices support some minimum standard of local upgradability would help immeasurably. You're right,…
> You're right, it's not hard. But can you imagine regular users doing that? Anti-viruses, Microsoft, Apple, Google and all major browsers had to automate and force updates on users to keep devices secure.
If you've already got a database of router versions, it's not hard to include how to submit a new firmware version in that database, whether it be a POST URL, any params and the expected payload(s) or a TFTP upload. At that point, the same device that generated the report could give you a management page that listed some options and semi-automated the process. Want to update fridge with out of date/exploitable firmware with community fridge firmware X? Click here. Want to update with community firmware Y? Click here. Want to update to newer/latest proprietary firmware? Click here.
I do agree it's not a solution to the problem. But it might help. It would also allow your techie friend to run an app on their phone or laptop when they come over and let you know, or handle it for you with a minimum of fuss.
This problem won't ever get better until someone starts being held accountable for exploitable network attached devices. I think part of the reason that doesn't happen is because it's not feasible with current norms of behavior to expect producers nor consumers to do so with any level of confidence. Providing tools for this may take us one step closer.
Personally I think a blend of regulations will be required. If devices sold are required to be updatable in one of a few ways, and workable firmware open sourced if obsoleted (or clearly marked or all labeling as may be entirely unsupported after 20XX), then it becomes feasible to require users to have some level of accountability over what they put on their local networks. I think it's the same as cars and the public road system. Cars have to adhere to certain standards to be street legal, and car makers must adhere to certain standard to sell their cars as street legal.
> Heck, when was the last time you checked for firmware updates for your home router?
Every 6-12 months, generally when I'm checking why performance is bad at the moment. But I'm not getting a report, so I only check when it's on my mind.
Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security
#79China already ignores safety and radio regulations. Sure, add more. They'll keep flooding Amazon and eBay with cheap crap and people will keep buying it. Good IoT will just become even more expensive.
The only way to avoid a botnet apocalypse is to secure home routers. Outbound traffic should not be an automatic right. People should have to authorise each device for each type of traffic.
I argued this long-hand when OVH was taken down by "security" cameras. Good to see we've made no progress.
https://thepcspy.com/read/when-did-we-stop-caring-network-se...
Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security
#80Require manufacturers to pay in to a bounty fund for finding exploits, and make them responsible for fixing the exploits found.