Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Schneier: It's Time to Regulate IoT to Improve Cyber-Security

eweek.com

Post reply on HN
Print view View original

151–160 of 185 posts

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#151

Post by porfirium »

rogerbinns wrote: post #105
noonespecial wrote: post #13

On the surface, I agree with this. In practice I expect it to result in fewer products on the market that are more expensive and no more secure as this sort of regulation will simply select for large companies who are experts at paperwork and soft bribes. I wish I had a better idea.

> I wish I had a better idea Something that already works are various forms of certification. Examples are: * "Norton protected" on websites * Underwriters Laboratories on US products * US DOD Trusted Computer System Evaluation Critera for how the US military checks the security of a product * ISO 9001 for quality management * Oregon Tilth for certifying organic products Some of these are more valuable than others, b…

Do you think end consumers care at all about certifications?

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#152

Post by snarfy »

tzs wrote: post #88
Asdfbla wrote: post #20

Even though many people scoff at the idea of government regulations, the economic incentives in IoT security are really all messed up and it's not really clear that the market will fix itself because so much of the damage can be externalized somehow. Does the manufacturer of a cheap and outdated IoT device care if it's participating in some ddos attack? Or like Schneier said, does the consumers care if they don't not…

> One thing that could hurt the market is maybe making manufacturers liable for the damages caused by security holes in their devices That's what insurance is for. Something like this was discussed in my torts class in law school, except that was long before IoT devices existed so it was about things like lawn mowers. The idea is that it might make the most sense economically to make the lawn mower manufacturer liabl…

Requiring insurance is such a huge barrier to entry it would completely destroy the market. Only the incumbents will be able to play. Imagine you came up with the next greatest fizzbuzz app and wanted to publish it to the market. Immediately you need what, $10/mo, $100/mo, $1000/mo for insurance? Does an adjuster need to go through your app and determine your risk and thus rate? Does your rate go up overnight when your app lands on the front page of HN and you gain a ton of users?

It sounds great if I'm MegaCorp with an entire department for dealing with this stuff, but as an independent developer trying to start something it's a horrible idea.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#153

Post by crottypeter »

blunte wrote: post #119

It's simply not going to happen as long as elected politicians and officials are mostly technically-illiterate. These are the same people seriously considering back doors to encryption in the name of security. Give it 5-10 years when enough of them have died off; then change will happen.

No, in 5 or 10 years they will be replaced by new technically-illiterate people.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#154

Post by heavenlyblue »

cobbzilla wrote: post #115
heavenlyblue wrote: post #96

Earlier quoted context omitted.

How do you deal with insurance fraud if the manufacturer is the one paying for the insurance?

If a manufacturer engages in fraud and is caught, they would (a) be subject to criminal penalties for insurance fraud and (b) it would become very difficult or expensive for them to acquire insurance in the future. These two negative consequences serve as a strong deterrence against fraud.

What I mean is that the buyers of the products would be incentivised to damage the products (or even themselves) since the manufacturers are paying for their premiums.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#155

Post by pjc50 »

snarfy wrote: post #152
tzs wrote: post #88

Earlier quoted context omitted.

> One thing that could hurt the market is maybe making manufacturers liable for the damages caused by security holes in their devices That's what insurance is for. Something like this was discussed in my torts class in law school, except that was long before IoT devices existed so it was about things like lawn mowers. The idea is that it might make the most sense economically to make the lawn mower manufacturer liabl…

Requiring insurance is such a huge barrier to entry it would completely destroy the market. Only the incumbents will be able to play. Imagine you came up with the next greatest fizzbuzz app and wanted to publish it to the market. Immediately you need what, $10/mo, $100/mo, $1000/mo for insurance? Does an adjuster need to go through your app and determine your risk and thus rate? Does your rate go up overnight when yo…

Everyone in business should have some indemnity insurance anyway, it's just that software and products that contain it seem to have escaped liability claims for quality up to now.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#156

Post by _pmf_ »

Asdfbla wrote: post #20

Even though many people scoff at the idea of government regulations, the economic incentives in IoT security are really all messed up and it's not really clear that the market will fix itself because so much of the damage can be externalized somehow. Does the manufacturer of a cheap and outdated IoT device care if it's participating in some ddos attack? Or like Schneier said, does the consumers care if they don't not…

> because so much of the damage can be externalized somehow

It's interesting to see how the US citizen ordering the product of a back alley company in Shenzhen via Alibaba is supposed to recoup his damages. It's impossible, period.

With wired IoT devices: segment your home network, always use a trusted gateway application and never allow your IoT devices direct WAN access. With wireless devices, all bets are off, since you don't know at all who can access them (i.e. they can interpret WiFi frames in unassociated state directly in silicon, and you'll never now, even if your stack is completely open source) if they are in the vicinity.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#157

Post by pjc50 »

indigochill wrote: post #139

Can someone educate me on one IoT point: devices presumably send and receive traffic over a router. That router presumably has security measures such as a firewall in place to reject malicious traffic. So, assuming a competent user, shouldn't security be primarily handled at the router level rather than the IoT device level? Of course IoT devices should also be secured, but my thinking is insecurity and lack of polit…

IOT devices tend to talk to a backend which is controlled by the vendor rather than the user.

Or they can be attacked over the LAN before the router gets a look at the traffic.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#158

Post by pjc50 »

ttul wrote: post #2

Yes it is. Importing a cheap Chinese WiFi access point that has an exploitable default password should be as illegal as importing Chinese fentanyl.

Ah, I remember the old days of "BABT approved" modems that were substantially identical to non-approved ones other than costing twice as much.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#159

Post by indigochill »

icebraining wrote: post #141
indigochill wrote: post #139

Can someone educate me on one IoT point: devices presumably send and receive traffic over a router. That router presumably has security measures such as a firewall in place to reject malicious traffic. So, assuming a competent user, shouldn't security be primarily handled at the router level rather than the IoT device level? Of course IoT devices should also be secured, but my thinking is insecurity and lack of polit…

Home router security is pretty much a joke as well, often they're themselves the vectors of attacks. But even if not, it's hard (I'd say impossible) for a generic firewall to distinguish most malicious traffic that exploits application-level protocol bugs. Plus many of these devices rely on Cloud services that themselves can be hacked and used to exploit the device.

I assume there's an important distinction between general purpose PC traffic and IoT traffic, which is that IoT devices should usually communicate with a small set of external entities (let's say a vendor service and a user's smartphone). So we can ignore the content of the traffic and instead consider everything malicious by default if it doesn't come from a small set of explicitly trusted addresses.

This of course doesn't do anything to secure attacks via one of those trusted addresses, but does prevent someone just happening across an open device.

There's also the problem of coping with dynamic addresses, but that can probably be handled separately.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#160

Post by indigochill »

cmdkeen wrote: post #140
indigochill wrote: post #139

Can someone educate me on one IoT point: devices presumably send and receive traffic over a router. That router presumably has security measures such as a firewall in place to reject malicious traffic. So, assuming a competent user, shouldn't security be primarily handled at the router level rather than the IoT device level? Of course IoT devices should also be secured, but my thinking is insecurity and lack of polit…

"Assuming a competent user" is absolutely not what IoT is about, it shouldn't be what most of our decisions as engineers should be about. I don't want to have to be a "competent user" for my fridge, lightbulbs, sex toys - i.e. everything is potentially going IoT. Separately, no - attacks like CSRF will quite happily be routed and compromise an incompetently designed IoT device.

I was thinking about blocking all traffic routed for the IoT device which comes from any address outside a set of explicitly trusted sources (such as the vendor's service and the user's smartphone or something). Then attacks like CSRF and default admin credentials become a moot point unless those trusted sources become compromised.
Post reply on HN