Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates • Hacker News Board

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#541

Post by 0xDEF » Tue, Sep 05, 2023, 8:47 PM UTC

MarcoPerazaFCC wrote: post #504

consumer451 wrote: post #463

This is likely outside of the scope of this proposal, but my red team brain sees IoT devices from China as a distributed Trojan Horse. In a time of conflict with China, firmware updates will be sent which will create the largest DDOS botnet in history. Our cheap IoT lightbulbs will take down major internet infrastructure. I don’t know the solution to that problem, but it’s a problem. Isn’t it?

This is something that has us worried too. The FCC took some action on this issue last year by outright banning equipment from certain companies (e.g. Huawei), but we haven't even scratched the surface of this pervasive problem. I really encourage you to share your concerns through an official comment. Maybe the label can include commitments about the provenance (and, e.g., control of signing keys) of the on-device s…

Look into the ESP32 chip. It's by a Chinese company and is used in almost all cheap IoT products.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#542

Post by MarcoPerazaFCC » Tue, Sep 05, 2023, 8:47 PM UTC

vkaku wrote: post #473

I've dealt with this multiple times, so let me give my perspective. - It is hard for manufacturers to do this with small teams. Mostly because they do not always have good CI/CD or platforms available to keep being on top of vulnerabilities and so on and so forth. - Not all manufacturers write their own software and often contract it out to other experts in the field. This includes firmware and app developers. - If a…

These are all great points and maybe a good reason why a voluntary program like this is the way to start, so a higher-tier of secure products can begin to emerge. We would also love to see the emergence of platforms that allow small teams to build on top of a secure, update-ready base. Some interesting discussion here https://news.ycombinator.com/item?id=37394546

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#543

Post by fidotron » Tue, Sep 05, 2023, 8:48 PM UTC

ics wrote: post #319

trelane wrote: post #5

How about requiring devices to accept alternate, Free Software firmware, from the upstream provider? At the very least, it should be possible after some time period of no updates or insecurity, but a blanket requirement is less susceptible to games. Probably the best thing to happen to wireless routers is OpenWRT and the other descendents of the WRT firmware.

Possibly weird idea: federal firmware escrow. The OEM gets to put a stamp on their product after submitting firmware source/keys to the FCC. When the OEM either declares the product not supported or provides no updates for X length of time, the files are automatically published to a public repository. Perhaps there is an appropriate license which says essentially that it is almost public domain, with an exception (or…

The problem here is the government can’t be trusted with the signing keys. They will simply use them to deploy their botnets.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#544

Post by dotancohen » Tue, Sep 05, 2023, 8:50 PM UTC

EricMausler wrote: post #514

Buttons840 wrote: post #464

Earlier quoted context omitted.

Also, security researchers should have strong legal protections; they should be given the benefit of the doubt at every turn. Currently, researchers are sometimes threatened with decades in prison for testing the security of websites or devices. If they act in good faith as researchers, this should never happen. This is literally a national security issue. We currently stifle security research on essential IoT device…

This might be an unpopular opinion but I respectfully do not see it that way. I agree with promoting security for IoT devices, but there needs to be consent from the company being probed for vulnerabilities or else I find it hard to consider it legitimate research, regardless of intent. I dont think anyone would like it very much if someone came to their house and documented all the ways to rob it they could find, ev…

  > I dont think anyone would like it very much if someone came to their
  > house and documented all the ways to rob it they could find, even if
  > it's for research purposes.

The correct analogy would be if someone documented all the ways to rob a house that is currently mass-produced and sold on the market. And yes, as a consumer I most certainly would approve of such activity, especially if I've yet to make a purchasing decision. Or especially if I'm already living in such a house, I need to know that it is not safe.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#545

Post by saurik » Tue, Sep 05, 2023, 8:50 PM UTC

EricMausler wrote: post #514

Buttons840 wrote: post #464

Earlier quoted context omitted.

Also, security researchers should have strong legal protections; they should be given the benefit of the doubt at every turn. Currently, researchers are sometimes threatened with decades in prison for testing the security of websites or devices. If they act in good faith as researchers, this should never happen. This is literally a national security issue. We currently stifle security research on essential IoT device…

This might be an unpopular opinion but I respectfully do not see it that way. I agree with promoting security for IoT devices, but there needs to be consent from the company being probed for vulnerabilities or else I find it hard to consider it legitimate research, regardless of intent. I dont think anyone would like it very much if someone came to their house and documented all the ways to rob it they could find, ev…

The problem here is that the thing I am probing is something I own: the device in my house that I ostensibly purchased and am allowed to smash with a hammer or put in a blender for all anyone should care; the context is that the DMCA is often used by companies to claim that DRM on the device is there to protect copyrights--whether music the device had access to, even if it isn't the reason many or even most people buy the device (such as a smart fridge with a speaker in it and the option to log in to Spotify), or the firmware software itself--and that it is thereby illegal for me to distribute tools to help people access to repair (which is the key thing here: there actually are already some legal protections for the act of "probing", but you kind of have to do it alone which is insane) a device I own and where finding vulnerabilities should be about me and my trade-offs, not the wishes of a manufacturer.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#546

Post by AnthonyMouse » Tue, Sep 05, 2023, 8:51 PM UTC

EricMausler wrote: post #514

Buttons840 wrote: post #464

Earlier quoted context omitted.

Also, security researchers should have strong legal protections; they should be given the benefit of the doubt at every turn. Currently, researchers are sometimes threatened with decades in prison for testing the security of websites or devices. If they act in good faith as researchers, this should never happen. This is literally a national security issue. We currently stifle security research on essential IoT device…

This might be an unpopular opinion but I respectfully do not see it that way. I agree with promoting security for IoT devices, but there needs to be consent from the company being probed for vulnerabilities or else I find it hard to consider it legitimate research, regardless of intent. I dont think anyone would like it very much if someone came to their house and documented all the ways to rob it they could find, ev…

> There is an inherent risk of your vulnerabilities being broadcasted somewhere either on purpose or accidentally once that information is collected and organized by the researcher.

A legitimate researcher is going to promptly notify you of any vulnerabilities they discover and you as a large organization are going to promptly remediate them.

But the trouble isn't that the law might impose a $100 fine on a smug professor or curious adolescent to demonstrate that some audacious but mostly harmless behavior was over the line, it's that the existing rules are so broad and with such severe penalties that they deter people from saying anything when they see something that looks wrong.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#547

Post by tremon » Tue, Sep 05, 2023, 8:52 PM UTC

vkaku wrote: post #473

I've dealt with this multiple times, so let me give my perspective. - It is hard for manufacturers to do this with small teams. Mostly because they do not always have good CI/CD or platforms available to keep being on top of vulnerabilities and so on and so forth. - Not all manufacturers write their own software and often contract it out to other experts in the field. This includes firmware and app developers. - If a…

> It is hard for manufacturers to do this with small teams. Mostly because they do not always have good CI/CD or platforms available to keep being on top of vulnerabilities and so on and so forth.

"It is hard for hospitals to keep their ORs clean with small teams. Mostly because they do not always have good cleaning products or procedures available to keep being on top of contaminations and so forth". I do not believe this is a valid argument to protect small firms.

> Not all manufacturers write their own software and often contract it out

Two words: liability chain. This is standard practice in almost every other industry.

I agree with the rest of your points, but I do not think that IP protections should trump regulatory requirements: if a company cannot comply with certain requirements due to contracts with their suppliers, the device should not be allowed on the market.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#548

Post by MarcoPerazaFCC » Tue, Sep 05, 2023, 8:57 PM UTC

kevincox wrote: post #348

ncallaway wrote: post #262

Earlier quoted context omitted.

> The best you can hope for with a regulatory approach is to incentivize them to pay more lip-service to the idea While I think this is true, there's also some benefit to getting the manufacturer's to pay lip-service to the idea. In that, it becomes part of the marketing and the sales of the device. Later, consumers can _attempt_ to hold manufacturer's feet to the fire with false advertising and other fraud class act…

> Later, consumers can _attempt_ to hold manufacturer's feet to the fire with false advertising and other fraud class action lawsuits. I would hope that this becomes relatively simple at some point. 1. I have this box that says I get updates until 2025-01-01. 2. It is 2023-09-05. 3. I have applied all available security updates. 4. Vulnerability X is still exploitable and has been made public to the manufacturer for…

I think if the box says updates until the beginning of 2025, and they've stopped providing updates before then, you have a pretty good contract lawsuit against them. You'd have to show that their failure to issue a patch for four months constitutes a breach, but that is exactly the kind of thing that gets hashed out in lawsuits. You could even have a class action of all the owners suing the manufacturer. We think one of the great opportunities of this labeling program is to begin developing a caselaw of what it means to hold a manufacturer to the commitments on the label.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#549

Post by TeMPOraL » Tue, Sep 05, 2023, 8:57 PM UTC

alerighi wrote: post #487

ryukoposting wrote: post #378

As a firmware engineer, I'm one of the people who actually writes the code that goes inside the IoT devices. I'm very interested in what the FCC might be able to do here. How does the FCC define a security flaw? Would updates only be distributed when there is a flaw that needs fixing? Remote update mechanisms can themselves present security problems in some domains. Thus, some devices should only be updatable if the…

> Remote update mechanisms can themselves present security problems in some domains. Not really if done right to be fair. It's just a matter of implementing a signature verification of the firmware updates that are installed on the device. > IoT is making its way into defense and enterprise environments where reliability is a matter of national security. If it's a matter of national security surely you don't use IoT…

> If it's a matter of national security surely you don't use IoT devices connected to the public internet.

Of course they do. That's the flip side of PaaS and reverse-NIH syndrome, the "opex > capex" thinking: "Industry 4.0" is built on web tech, with all the practices and assumptions baked in. Your critical infrastructure is, or is about to, be running JavaScript on a docker-compose cluster, and expecting to be piecemal-updated daily.

And then, there's also "shadow IT" - going behind the back of IT and using COTS SaaS to work around red tape is still... going around IT and giving untracked third-party vendors access to organizational information and operations. "Making its way" doesn't only mean "introduced by design" - those vulnerabilities just creep in.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#550

Post by MarcoPerazaFCC » Tue, Sep 05, 2023, 8:58 PM UTC

scottcodie wrote: post #501

Is there a definition of a "security update"? Software has an infinite number of bugs and it is cost infeasible to fix them all. If it's years down the road, the engineers that wrote the code may be long gone.

I think you're right that it would be difficult for the FCC to precisely define exactly when security updates are required. This is a problem in law generally, one that is usually resolved by imposing a reasonableness standard. Maybe here, a vulnerability needs to be patched if it might reasonably be expected to allow an attacker to take control of a device, or to do so when combined with other known or unknown vulnerabilities. Or maybe a different standard. Then when enforcement/lawsuits come around, the judge/jury/regulator has to evaluate the reasonableness of the manufacturer's actions in light of that standard. We'd love to see commentary on the record as to what the right legal standard might be.

(originally posted at https://news.ycombinator.com/item?id=37394188)