Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Schneier: It's Time to Regulate IoT to Improve Cyber-Security

eweek.com

Post reply on HN
Print view View original

161–170 of 185 posts

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#161

Post by icebraining »

indigochill wrote: post #159
icebraining wrote: post #141

Earlier quoted context omitted.

Home router security is pretty much a joke as well, often they're themselves the vectors of attacks. But even if not, it's hard (I'd say impossible) for a generic firewall to distinguish most malicious traffic that exploits application-level protocol bugs. Plus many of these devices rely on Cloud services that themselves can be hacked and used to exploit the device.

I assume there's an important distinction between general purpose PC traffic and IoT traffic, which is that IoT devices should usually communicate with a small set of external entities (let's say a vendor service and a user's smartphone). So we can ignore the content of the traffic and instead consider everything malicious by default if it doesn't come from a small set of explicitly trusted addresses. This of course…

Not just dynamic addresses; mobile Internet carriers used NAT layers covering many devices, so a single address is used by many people at once: https://en.wikipedia.org/wiki/Carrier-grade_NAT

Routers do have a solution: some support setting up a VPN, to which the phone could securely authenticate against. But good luck getting users to configure that.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#162

Post by shubb »

forapurpose wrote: post #98
tzs wrote: post #88

Earlier quoted context omitted.

> One thing that could hurt the market is maybe making manufacturers liable for the damages caused by security holes in their devices That's what insurance is for. Something like this was discussed in my torts class in law school, except that was long before IoT devices existed so it was about things like lawn mowers. The idea is that it might make the most sense economically to make the lawn mower manufacturer liabl…

> That's what insurance is for What are the outcomes for using insurance, and what are the outcomes for using regulation? Does anyone know the answers in a technical policy sense (not in a philosophical sense)? They are different tools useful for different problems. Thinking out loud, insurance seems like a poor solution when people will suffer serious, irreparable harm. If the lawnmower severs a foot, then an insura…

On insurance vs regulation -

What isn't being mentioned here is that insurers will require insured companies to do a bunch of stuff in order to remain insured. Have some processes in place, do some things, and so on.

Just like your car insuruance isn't valid if you drink and drive, your software company insurance might not be valid if you aren't using source control and have no testing or code review proccess.

So in some ways, what you get out of insurance is market driven 'regulation'.

Possibly, because a rival insurance company can impose different conditions, insurers are incentivised to require only the stuff that really reduces risk, while regulators might make irrational regulations driven by moral panics in the press. Similarly, they might be more responsive to supporting new technqiues that reduce risk at lower costs, because customers will seek out an insurer that lets them use those.

Possibly, insurers are less suceptible to moral hazard, where regulator employees have close relationships with industry heavyweights and make policy that helps their buisness, at the expense of consumers and sector rivals. Insurers mostly want to make money.

Regulators might be better sometimes because their staff tend to be very mission driven (they want to fix the problem, not make money). They will get a kicking from the public if there is a big accident and laws and regulations did not prevent it, while an insurer is only punished if they don't satisfy current law. So a regulator might be more proactive.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#163

Post by ryandrake »

joe_the_user wrote: post #21
thaumasiotes wrote: post #14

Earlier quoted context omitted.

> And all for what? So you can turn the lights on after you go through multiple steps to unlock your phone? I wanted network-connected lightbulbs so I could have them turn on at the time I needed to wake up, when that time was well before dawn. I never installed them because I didn't know how to secure them and my schedule got more reasonable, but I think the use case is pretty compelling.

Why would light bulbs need to be connected to the Internet for the use case of being turned on at a specific time? They'd just need to be connected to a timer for this. I mean, an Internet connected light bulb use-case would a bulb that flashed whenever a stock you owned went down in price, which is ridiculous despite being the least ridiculous example I could think of. IoT security cameras and an automated kitchen y…

Exactly. Nearly everyone who tries to explain why I would want Xyz device to connect to the Internet cites a use case that... doesn't require an Internet connection! Turning lights on and off at certain times, buzzing when a doorbell is pressed, thermostats and sprinklers that respond to the weather. Even security cameras don't need an Internet connection when being viewed locally, yet my Dropcam insists on sending all video out to a web service, just so that I can request it all back when viewing on my computer! Insane!

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#164

Post by jpindar »

ausjke wrote: post #32

Something similar existed called FIPS-140, though it is hard to certify and not a good fit for IoT. IoT router/firewall might be one of the solution here, i.e. adding IoT pattern into existing routes/firewalls to protect IoT devices, in addition to your PCs and sometimes BYODs(smart phones etc). It is very hard to make all IoT devices secure due to limited resource they have, so the first line of protection should be…

Is anyone working on this? Also, can anyone recommend a site that compares various router firmware?

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#165

Post by jessaustin »

username223 wrote: post #99
jessaustin wrote: post #81

There are two pieces here, and Schneier (or at least this tiny summary of him) is wrong on both. First, yes of course automobiles are regulated and should be. The fact that some things that are and should be regulated include embedded internet hosts does not mean that all devices that include embedded internet hosts should be regulated. This is basic logic. Second, holding one set of botnet victims responsible for th…

> consider that ISPs have lots of money and they actually could reduce DOS attacks; why not hold them responsible? You could hold ISPs liable, and they would block untrusted IoT garbage at the network level. Or you could hold IoT garbage producers liable, and they would make security changes and/or pay ISPs to do some firewalling. Either way, the costs and results will probably turn out about the same. The best solut…

Yes the best solution would be if the world were perfect.

How on earth is a civilized society going to keep "useless" devices off the internet? Who gets to decide what is useless? For example, medical devices are notoriously insecure: what politician is actually going to get behind an effort to make Grandma's life more inconvenient and also shorter just to satisfy some nerds' idea of a perfect internet?

The nerds on HN disappoint. When faced with a hard problem, instead of doing the hard work to fix it, they want to involve the lawyers...

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#166

Post by AnthonyMouse »

schrodinger wrote: post #142
wyager wrote: post #117

Earlier quoted context omitted.

The problem is that this subsidizes stupid people at the expense of not-stupid people. Injuring yourself in dumb, preventable ways should have personal repercussions.

Oftentimes the dumb, preventable way has repercussions on others. In the case of not updating these IoT devices, it could be a botnet, that really doesn’t even impact the dumb person who failed to take preventive steps. In the case of the lawnmower, expense to the healthcare system.

That's the point. You have a manufacturer that sells a product with N years of support and a customer who buys it and keeps operating it out of support for N+5 years, what is the manufacturer supposed to do about that? Support the product until the end of time? Remote brick the customer's property?

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#167

Post by alkonaut »

cletus wrote: post #3

Not that I'm a fan of government regulation for technology issues like this but the security situation is beyond a joke. For one, it's time to hold companies (and executives!) accountable for security of the data they are charged with protecting, often without your consent (eg Equifax). For another, insufficient product liability for companies being lax--even negligent--with security. Honestly I don't see an outcome…

> And all for what? So you can turn the lights on after you go through multiple steps to unlock your phone?

I don't get it either. I can get the idea of switching on and off all the lighting in a home e.g. when leaving (hotel room style) but to do that you need to have a hell of a lot of gadgets, not just a couple of "smart lightbulbs".

The only reason we have smart lightbulbs for switching to begin with was because someone realized that the sockets are standardized and users can switch bulbs.

The elephant in the room is the wall switch, it's now in series with the bulb! Every time someone switches off the light using the lightswitch, the smart bulb can't be switched on again! And no - people will NOT stop switching lights manually just because they have a smart bulb!

What people really want, would be smart switches, not smart bulbs. With a smart switch, you can switch either by hand or remotely.

I just don't get why manufacturers (and customers, most of all) don't realize this. Are people happier to buy the bulb because it's a 10 second job to change, compared to the wall switch which might be an hour worst case require an electrician?

I'd be thrilled to change all my switches and dimmners to smart ones, once there are gadgets that are cheap, secure, reliable etc. I'd mostly use it to have a master lightswitch somewhere near the front door.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#168

Post by cmdkeen »

indigochill wrote: post #160
cmdkeen wrote: post #140

Earlier quoted context omitted.

"Assuming a competent user" is absolutely not what IoT is about, it shouldn't be what most of our decisions as engineers should be about. I don't want to have to be a "competent user" for my fridge, lightbulbs, sex toys - i.e. everything is potentially going IoT. Separately, no - attacks like CSRF will quite happily be routed and compromise an incompetently designed IoT device.

I was thinking about blocking all traffic routed for the IoT device which comes from any address outside a set of explicitly trusted sources (such as the vendor's service and the user's smartphone or something). Then attacks like CSRF and default admin credentials become a moot point unless those trusted sources become compromised.

That's how CSRF works - I get you to communicate to the device from your "trusted" smartphone or other device. There is nothing you can do at the routing level to protect against it. It is entirely up to the endpoint receiving the request to have implemented proper CSRF protection against attacks.

CSRF has been around since 2001 and is in the OWASP top 10. It would be absolutely valid for regulators to require reasonable steps to be taken to prevent its abuse, along with similar attacks.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#169

Post by AnthonyMouse »

tzs wrote: post #88
Asdfbla wrote: post #20

Even though many people scoff at the idea of government regulations, the economic incentives in IoT security are really all messed up and it's not really clear that the market will fix itself because so much of the damage can be externalized somehow. Does the manufacturer of a cheap and outdated IoT device care if it's participating in some ddos attack? Or like Schneier said, does the consumers care if they don't not…

> One thing that could hurt the market is maybe making manufacturers liable for the damages caused by security holes in their devices That's what insurance is for. Something like this was discussed in my torts class in law school, except that was long before IoT devices existed so it was about things like lawn mowers. The idea is that it might make the most sense economically to make the lawn mower manufacturer liabl…

> I'm not sure it could work for IoT, though, because a lot of IoT devices are made by new companies that probably will not be around long. With things like lawn mowers, you could takes years to get around to cutting your hand off, and still reasonably expect the manufacturer to be around. Not so with a lot of IoT devices.

This is the problem.

And "solutions" like that can easily backfire, because they squeeze medium sized companies out of the market, who might stake out a middle ground between $20,000 Cisco hardware and $150 "disposable cameras" from Fly By Night Corp, by charging $200 for a product that actually guarantees patches for a specific number of years.

Because the liability risk raises the price the middle-ground company has to charge to the point that they can't compete with Fly By Night Corp who doesn't care. Which means more sales of insecure garbage products, because the customer no longer has the option to buy an affordable product that receives patches, and that customer can't afford the $20,000 industrial grade product, so more people end up with the insecure garbage.

It would be much more effective to just require manufacturers to provide security patches for e.g. 7 years. Fly By Night Corp still wouldn't do it, but then at least Samsung would.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#170

Post by ausjke »

zAy0LfpBZLC8mAC wrote: post #118
ausjke wrote: post #32

Something similar existed called FIPS-140, though it is hard to certify and not a good fit for IoT. IoT router/firewall might be one of the solution here, i.e. adding IoT pattern into existing routes/firewalls to protect IoT devices, in addition to your PCs and sometimes BYODs(smart phones etc). It is very hard to make all IoT devices secure due to limited resource they have, so the first line of protection should be…

OK, so how do you distinguish automatically "abuse" from "proper use" for arbitrary devices, and how would putting the code that is able to do that on a separate device be easier than compiling it into the firmware of the devices themselves?

Look, your PC and BYODs are still prone to attacks, they're much much more powerful than those networked IoT devices, and they still need firewall to protect.

I of course hope all firmware will be safe, and they should be safe as much as possible, still, you need a more powerful device to safeguard them. Put another way, no matter how secure my wifi-bulb is designed, I'm not going to expose it to the internet, and I will put it behind my firewall/NAT-router.

Post reply on HN