Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Schneier: It's Time to Regulate IoT to Improve Cyber-Security

eweek.com

Post reply on HN
Print view View original

131–140 of 185 posts

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#131

Post by jpalomaki »

Asdfbla wrote: post #20

Even though many people scoff at the idea of government regulations, the economic incentives in IoT security are really all messed up and it's not really clear that the market will fix itself because so much of the damage can be externalized somehow. Does the manufacturer of a cheap and outdated IoT device care if it's participating in some ddos attack? Or like Schneier said, does the consumers care if they don't not…

Treat security issues as defects in the product and apply normal consumer protection laws.

Put pressure on ISPs to make them take responsibility for traffic originating from their networks. They have the the tools to notify customers if customer is sending suspicious traffic (and if necessary, they can temporarily shutdown the connection).

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#132

Post by csydas »

zatkin wrote: post #122
rogerbinns wrote: post #105

Earlier quoted context omitted.

> I wish I had a better idea Something that already works are various forms of certification. Examples are: * "Norton protected" on websites * Underwriters Laboratories on US products * US DOD Trusted Computer System Evaluation Critera for how the US military checks the security of a product * ISO 9001 for quality management * Oregon Tilth for certifying organic products Some of these are more valuable than others, b…

What about VW though? They got around regulation.

The expectation isn't that such regulation will prevent violations of the regulation from ever happening, but instead that there is a legal mechanism by which appropriate punishment can be administered. Laws and regulations don't in-and-of themselves prevent bad behavior from happening, they just grant entities permission to apply force as a response; the force can be jail time, fines, sanctions, etc, but it's granting an entity permission to apply force if the law or regulation isn't adhered to.

So yes, regulations are circumvented or ignored intentionally, but that doesn't mean that it's somehow a bad idea; the idea is to enforce positive behavior by attaching an undesirable response to not doing the positive behavior. It's meant to shape behavior in the long run, and it's why pulling funding and reach from regulatory agencies is usually shitty, as more than anything, it's meant to induce a scenario where one can say "look, we have these regulations, but X, Y, and Z continue to do the bad behavior! The regulation is senseless!"; in reality, X Y and Z have just run the costs and determined that it's cheaper to fight the regulation than to adhere to it.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#133

Post by mbar »

> there is a difference between when a hacker crashes a computer and you lose your data and when a hacker hacks your car and then you lose your life.

Forget about hacking your car, what about the hacker that hacks a car fleet? What could a hacker do with a botnet of cars, each with cameras and maybe even face recognition. How about killing off people for the highest bidder at the push of a button.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#134

Post by chopin »

michaelt wrote: post #86
walrus01 wrote: post #71

I am cautiously leaning towards the perspecive that Schneier is right. This problem is not going to be solved by market forces. Ordinary non technical consumers will buy things like wifi security cameras for the absolute cheapest price at $45/unit, based on them having attractive retail packages or what appears to be a good feature set/spec/price. I have not seen any signs that people are moving away from known-insec…

Hell, even for highly technical users it's almost impossible to evaluate a lot of this stuff. I mean, I program embedded systems for a living - and I couldn't tell you which IoT dash camera or digital camera with wifi or internet-connected car entertainment system is secure.

That's easy - presumably none. At least if you take secure as an absolute value.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#135

Post by jimktrains2 »

userbinator wrote: post #113
Asdfbla wrote: post #20

Even though many people scoff at the idea of government regulations, the economic incentives in IoT security are really all messed up and it's not really clear that the market will fix itself because so much of the damage can be externalized somehow. Does the manufacturer of a cheap and outdated IoT device care if it's participating in some ddos attack? Or like Schneier said, does the consumers care if they don't not…

Indeed, I have the feeling that all regulations will do is lead us down the slippery slope of regulating all software and computing devices, eventually creating the dystopia predicted by RMS in his famous story: https://www.gnu.org/philosophy/right-to-read.en.html Or at least, an even more modest regulation, simply allowing all consumers to hack their own devices without fear of violating any laws. More simply, they…

> Indeed, I have the feeling that all regulations will do is lead us down the slippery slope of regulating all software and computing devices, eventually creating the dystopia predicted by RMS in his famous story: https://www.gnu.org/philosophy/right-to-read.en.html

Unless said regulation was the ability to actually own your device and install your own firmware, doubly so once it becomes unsupported?

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#136

Post by oliwarner »

JumpCrisscross wrote: post #94
oliwarner wrote: post #79

China already ignores safety and radio regulations. Sure, add more. They'll keep flooding Amazon and eBay with cheap crap and people will keep buying it. Good IoT will just become even more expensive. The only way to avoid a botnet apocalypse is to secure home routers. Outbound traffic should not be an automatic right. People should have to authorise each device for each type of traffic. I argued this long-hand when…

> People should have to authorise each device for each type of traffic Nobody wants to do this. I'm a quarter way paranoid about electronic security and even I don't want to do this.

Sure. I've been through this though. See the link.

I recommend a certification programme, with manufacturers justifying the access their device needs. A little signed JSON blob of hosts and ports it plans on connecting to. The device communicates this to the router. If the signing certificate is still valid and the manufacturer trusted, the router could just allow that access, or prompt the user to just let them know that device is trying to connect. No confusing detail. And just once, at the same time you're setting up network stuff, so it's not weird or extra hassle.

It's leaps and bounds better than what we currently have. The vast majority of us have zero idea what the devices on our network are actually doing, all while we're each throwing dozens of these cheap internet-enabled things online.

For legacy devices, a more iterative approach might be needed but it can still be prompted: "Dell computer is trying to connect to clearlybaddomain-dot-com. Allow, Allow All, Deny, Quarantine". You could even layer on some "known bad" hosts or traffic patterns via centralised lists to automatically quarantine devices at the router level.

Nothing here is rocket surgery. One developer for a few months. An entity like Google could do this in an afternoon. There's just surprisingly little appetite for it.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#137

Post by oliwarner »

stordoff wrote: post #100
oliwarner wrote: post #79

China already ignores safety and radio regulations. Sure, add more. They'll keep flooding Amazon and eBay with cheap crap and people will keep buying it. Good IoT will just become even more expensive. The only way to avoid a botnet apocalypse is to secure home routers. Outbound traffic should not be an automatic right. People should have to authorise each device for each type of traffic. I argued this long-hand when…

> People should have to authorise each device for each type of traffic. Seems somewhat unreasonable to expect people to know what traffic a device needs, and if you ask too much, people will just default to allowing it without even thinking about it (I still occasionally see people suggesting using a DMZ to make online games work, rather than forwarding the necessary ports [and even that seems rarely required]).

See link or my other reply for implementation detail. This can be both very secure and simple.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#138

Post by thaumasiotes »

joe_the_user wrote: post #21
thaumasiotes wrote: post #14

Earlier quoted context omitted.

> And all for what? So you can turn the lights on after you go through multiple steps to unlock your phone? I wanted network-connected lightbulbs so I could have them turn on at the time I needed to wake up, when that time was well before dawn. I never installed them because I didn't know how to secure them and my schedule got more reasonable, but I think the use case is pretty compelling.

Why would light bulbs need to be connected to the Internet for the use case of being turned on at a specific time? They'd just need to be connected to a timer for this. I mean, an Internet connected light bulb use-case would a bulb that flashed whenever a stock you owned went down in price, which is ridiculous despite being the least ridiculous example I could think of. IoT security cameras and an automated kitchen y…

> Why would light bulbs need to be connected to the Internet for the use case of being turned on at a specific time? They'd just need to be connected to a timer for this.

I already have a network connected to the internet. I don't already have a dedicated light bulb timer, and producing one of those, or buying one that had somehow gotten produced, would be stupid.

I had no particular desire for the bulbs to be connected to the internet, but I did want them connected to my home network, and I did also want my home network connected to the internet.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#139

Post by indigochill »

Can someone educate me on one IoT point: devices presumably send and receive traffic over a router. That router presumably has security measures such as a firewall in place to reject malicious traffic. So, assuming a competent user, shouldn't security be primarily handled at the router level rather than the IoT device level? Of course IoT devices should also be secured, but my thinking is insecurity and lack of political motivation to regulate could probably be largely mitigated this way?

That said, I've more or less completely ignored IoT so far aside from passing interest in how easy Mirai was and I've only briefly dabbled in firewall configuration, so many of my assumptions could be wrong.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#140

Post by cmdkeen »

indigochill wrote: post #139

Can someone educate me on one IoT point: devices presumably send and receive traffic over a router. That router presumably has security measures such as a firewall in place to reject malicious traffic. So, assuming a competent user, shouldn't security be primarily handled at the router level rather than the IoT device level? Of course IoT devices should also be secured, but my thinking is insecurity and lack of polit…

"Assuming a competent user" is absolutely not what IoT is about, it shouldn't be what most of our decisions as engineers should be about. I don't want to have to be a "competent user" for my fridge, lightbulbs, sex toys - i.e. everything is potentially going IoT.

Separately, no - attacks like CSRF will quite happily be routed and compromise an incompetently designed IoT device.

Post reply on HN