My router started acting weirdly about three weeks ago (intermittent disconnections, slow connection etc. ) and then stopped working all of a sudden.
I asked for a replacement from the provider and they changed it last week. Now I am freaked out, because if the device was compromised I will need to change all my passwords which is a real pain in the a
FBI tells router users to reboot now to kill malware infecting 500k devices
261–270 of 299 posts
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#262Earlier quoted context omitted.
> I didn't say they did... I was providing two examples. But Cisco (i.e. Talos) are the ones finding the vulnerabilities in routers made by other companies in this case. > Maybe if companies building software can't afford to keep it safe... they shouldn't be companies? Is that so controversial? They still would be companies though. That's the point. If they expect to be out of business by then regardless, or they're…
>Regulation and liability only works against monopolies and other huge companies. That's not true at all. Many industries that are very competitive and are full of small companies are effectively regulated. >There is no blood to be had from that stone. There's a simple fix to this problem. You require companies to carry insurance to cover the problems you're talking about. We do it with general contractors, doctors,…
> That's not true at all. Many industries that are very competitive and are full of small companies are effectively regulated.
There are many industries that are very competitive and full of small companies and have regulations, but what most commonly happens in those cases is that the regulations are rarely enforced which nobody much minds because the competition is preventing abusive practices regardless.
> There's a simple fix to this problem. You require companies to carry insurance to cover the problems you're talking about. We do it with general contractors, doctors, tree removal companies etc...
None of those things happen at scale. When a doctor makes a mistake, it affects one patient. A single security vulnerability can affect millions of people.
That's the problem with this. Typically what regulators try to do with risk is to find a deep pocket to stick it to that can absorb it with minimal consequences, but there isn't one here because the risk is large compared to the (inexpensive) cost of the device.
It's also a poor thing to try to insure because the main risk factor is code quality but insurance companies are generally not equipped to evaluate that. It doesn't help anybody to triple the price of every device just so the customer can still get pwned because once the insurance is covering it the developers lose the incentive the liability was supposed to be giving them to improve their security.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#263Headline is a bit incorrect - a reboot will interfere with the malware by restarting the it’s C&C process, which the FBI now controls. This does not eliminate the malware, but it will stop it’s data collection and makes it more difficult for an adversary to activate it on a large scale.
If they've seized the C&C domain, can't they push an update that disable the malware?
In one case they asked a judge for permission to do just that, but as you cam imagine taking on that responsibility isn't something to do lightly.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#264Earlier quoted context omitted.
On the contrary, it's the legal perspective that's most worrying. If every software bug carries the potential for liability, there's no way your legal department will let you have a widely-visible bug tracker, or easily report bugs at all. It'd be much like copyright violations are treated today, where there's a formal process to raise the issue and everyone's specifically trained not to discuss them openly.
What makes software so special in engineering, aside from the amazingly terrible culture we've crafted around it? Change the phrase "software bug" to "engineering error". Then consider the liabilities involved with the manufacture of any real-world-might-kill-someone product. The lawyer's view starts to make a helluva lot more sense.
The pace of software innovation to lack of liability from simply writing code has brought us the entire information age.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#265Earlier quoted context omitted.
>> can you give me a ballpark > you're asking for a hard number? No, I am not asking for a hard number, I specifically asked for a ballpark. > invest in the security of the project you're using I agree, but slapping fines of developers for using openssl to enhance security makes it a bit hard for anyone to afford putting any extra money towards security > arguing about the specific mechanics is pointless Agreed, my g…
> No, I am not asking for a hard number, I specifically asked for a ballpark. Yes, and it's a fake law that doesn't exist. How would I possibly answer this? Off handedly, I'd say that the fine could really range depending on a lot of things. Was this an outdated version of OpenSSL that they just didn't patch? Was it a programmer error using the library? A 0day? All of these things would probably make a big different…
>charging companies for 0days in 3rd party code, in at least many cases, would not make sense.
Well you've just made the workaround trivial. Open source the majority of everything under a separate org and then use that stuff from the product being shipped. Therefore any vulns are not their problem.
>And if we're talking about router companies, they have the cash
I don't think you understand how tiny the margins are in consumer networking gear. Lowest price dominates.
>the legal components of this are not something I'd want to get into since I'm not qualified to.
Suggesting they be liable is a legal component.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#266Earlier quoted context omitted.
> after being rooted by 4 lines of JavaScript Could you provide any sort of source for this extraordinary claim of yours?
That's probably an exaggeration, but I agree with the sentiment of what they are saying. It's not crazy hard to write quality software. Most corporations don't bother because they know they don't have to, since they can escape liability laws. It's gotten to the point where most software developers somehow view this situation as "normal". Do you have a QA department? What do they do? If you're like most software compa…
This sounds like it's really expensive, and hard to prove the benefits of to most purchasers. I doubt we'll get the sort of industry change this would require without since strong formalization of the discipline.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#267I'm amazed at how many people here think that a company should be default responsible for what is essentially a third-party tampering with their product. Unless the problem is a result of negligence, it's unreasonable to say that a company should be automatically responsible, except perhaps if they decide not to address the problem in in future products.
What are bugs, if not negligence?
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#268Earlier quoted context omitted.
You really want vendor to patch vulnerabilities in firmware without pushing any buttons.
And you really don't want malicious actors to push malware to vulnerable firmware without pushing any buttons. When firmware can't fully trust itself (and it cant), the correct option is to deffer ultimate judgement and control to the physical owner.
This wouldn't work with consumer hardware.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#269Earlier quoted context omitted.
Carmakers will not be liable if I break your brakes. Why should your router manufacturer be liable if I break your router? Clearly in both cases the company failed to manufacture a secure enough product.
One difference: you can repair your brakes, or replace them, without having to get a new car. Most routers do not have updates available after the first one or two patches, and you can't even install your own OS on most. Your only options are: live with it, or buy a complete new router.
Trade-in your old router every two years.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#270Earlier quoted context omitted.
If a software company tells me, that their software is safe, they should be liable in case it isn't. Most FOSS licenses come with 'without warranty' notice. Businesses, who use it, should know that.
Sounds like it would be smartest for all software to come with a warning that it may be vulnerable to malicious interference. It'll be the software version of a Prop 65 warning. There's no such thing as absolutely safe software.
We have fairly complex rules already in place when it comes to hardware safety. Manufacturers aren't liable if they can show that they performed due diligence in designing their product. Why can't we have something similar for software?