Does the FCC have any authority over IOT devices? and if so how?
This seems like a massive overreach, how can a body designed to for managing shared spectrum have any authority on devices that use the internet?
Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
181–190 of 944 posts
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#182From the speech:
> Wi-Fi deauthentication attacks, which can render useless every Wi-Fi network in an area, can be carried out by a single device with a Wi-Fi antenna.
Is the prevention of such attacks within the mandate of the FCC (so long as all other relevant RF parameters are adhered to in the device)? I understood that unlicensed ISM users must not cause interference to licensed users, and they must be tolerant of interference generated by licensed users. I read this logically to conclude that unlicensed users must also be tolerant of interference from unlicensed users. (The opposite conclusion would seem to be infeasible to enforce, if any single unlicensed user could effectively bar the operation of another unlicensed user merely by being unable to tolerate the interference emitted by it.)
A WiFi deauth attack is an attack on unlicensed users of the frequency spectrum.
I'm perfectly happy for the FCC to change the rules, provided they follow the rule-making process in that rule change. If WiFi deauth attacks are to be prevented (and if I'm correct that they are legal-albeit-anti-social now), we should go through a rigorous rule-changing process to ensure that the new rule correctly balances the desire for continued, unlicensed use and the desire for that unlicensed use to be practically useful/usable.
(By the way, I appreciate you engaging the HN community and hope that you're targeting other, similar communities who may have relevant expertise on either technical or policy matters here.)
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#183How about requiring devices to accept alternate, Free Software firmware, from the upstream provider? At the very least, it should be possible after some time period of no updates or insecurity, but a blanket requirement is less susceptible to games. Probably the best thing to happen to wireless routers is OpenWRT and the other descendents of the WRT firmware.
This is also a key point to fighting ewaste and making devices last longer. I have appliances from the 70s including a rotary telephone, that I still use regularly. If you combined mandatory OSS support with repair cafes, you would have a model for sustainable reuse and better security. You may even start a commercial aftermarket in reflashing older devices!
Yeah if companies that make IoT hardware complain about the costs to keep old devices updated then they should be required to make them more user-modifiable and release source code / signing keys when they're abandoned by their manufacturer so that they can be picked up by the communities and development can be continued (also requires some policing to determine when hardware is functionally abandoned, as releasing a minor update once a year that doesn't fix real bugs should still be considered abandoned). Repair cafes would be fantastic for helping support small businesses keeping people's old hardware running.
Of course, manufacturers don't want that either because they make money off of planned obsolescence and consumers keeping old hardware running makes them less likely to buy old hardware.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#184Simple. Give the manufacturers the choice: either they must provide full (FLOSS) source code and documentation (full schematics) to the user to enable them to maintain, patch and thus secure their devices (see also: right to repair), OR they are liable for all damages (direct, indirect) for a 30 year expected lifetime that arise from security issues with the device AND must have insurance to cover those damages (so t…
> either they must provide full (FLOSS) source code and documentation I like the spirit of this, but one problem with this is that the software stack is likely not FLOSS, and the manufacturers don't own all the software. A second problem is that lot of the software for production IoT-devices doesn't live in the device. Third, there are safety concerns with a lot of devices that you'd need legal productions for. Final…
If parts of the supply chain aren't FLOSS, then manufacturers would have to lean on those suppliers to change their licensing or find different suppliers. Same with other regulations around things like lead in consumer products. Anyone wanting to be part of consumer product software supply chains would have to start offering it as FLOSS if they want any customers, so the supply chain would adjust to the new reality.
We do need to establish common sense liability if it's not already there. If you modify your circular saw to remove the guard and injure yourself, that's your fault. If you modify some software to run outside of safe design parameters and it malfunctions/injures you, that's your fault.
I don't see why zero-trust is incompatible with user-modified devices. In fact it's in line with the spirit of zero-trust: don't assume just because something is able to talk to one of your servers (e.g. because it's on your VPN/LAN) that it's friendly. People should already always be assuming customer-owned hardware will potentially be completely controlled by a malicious actor and acting accordingly.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#185Regulation to require a certain period of security updates doesn't seem useful to me. It's very easy to send out a "security update" that doesn't actually improve security. You can send out an ad to all your users saying "You should upgrade now to our newest product!" and call it a security update. Requiring security updates may end up just requiring companies to spam their users with a certain amount of marketing ma…
I think you're right that it would be difficult for the FCC to precisely define exactly when security updates are required. This is a problem in law generally, one that is usually resolved by imposing a reasonableness standard. Maybe here, a vulnerability needs to be patched if it might reasonably be expected to allow an attacker to take control of a device, or to do so when combined with other known or unknown vulnerabilities. Or maybe a different standard. Then when enforcement/lawsuits come around, the judge/jury/regulator has to evaluate the reasonableness of the manufacturer's actions in light of that standard. We'd love to see commentary on the record as to what the right legal standard might be.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#186I honestly don’t think we need a government solution to this issue. Consumers who want this security can buy from manufacturers with a reputation at stake such as Amazon or Apple. I don’t want your “help”. Let the market sort it out.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#187If a known vulnerability in an IoT device is exploited for harm then the device manufacturer should be liable.
Right now there is no penalty for firing and forgetting half-baked IoT products onto the market.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#188Regulation seldom proves to be the ultimate remedy.
The true catalyst for change lies in cultivating informed consumers who wield their purchasing power to support manufacturers committed to security.
If a law has to be put in place, ensure that every marketing advertisement and article concerning a device explicitly states the duration for which it will receive regular updates.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#189One thing that regulators need to be very careful about is how "security updates" are defined, and exactly what manufacturer obligations for issuing security updates should be. CVEs are a notoriously terrible representation of actual security risks, so a measure like "manufacturer must issue new releases that include any released patches for CVEs with a severity rating greater than 9" would be a clear non-starter. Th…
While I acknowledge that CVE scoring of risk can be inconsistent and sometimes wildly wrong, what would you suggest in its place?
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#190Earlier quoted context omitted.
99% of users don't know their iot devices have firmware nor that it can be updated.
They may have trusted family members, friends, or neighbors who they feel comfortable allowing the management of their internet connected devices.
No. As long as their iot device is still working consumers could care less about security updates.