Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

news.ycombinator.com

Post reply on HN
Print view View original

631–640 of 944 posts

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#631

Post by mkoubaa »

MarcoPerazaFCC wrote: post #259
jjguy wrote: post #225

For those of you unfamiliar with the specific challenges IoT patching brings, here is a blog post from just last week on one aspect of the topic: http://tomalrichblog.blogspot.com/2023/08/british-cuisine-de... FTA: > I assumed that device manufacturers update the software in their device about every month...he said they do it annually. Those devices are at least _getting_ updates - there is a long tail of devices who…

> And since this is HN - there is a startup hidden in the midst of all of this: an enterprise-grade IoT OS that "does security right." Sell to the device manufacturers, allow them to market it as "enterprise-ready" or some such. If the FCC guidelines here are approved, there will be a suddenly increased demand! Agreed. Building an automatic firmware update system from scratch would be burdensome for many IoT makers,…

Firmware is fairly balkanized relative to SaaS stacks, I think regulatory pressure is likely to nudge the industry towards more consolidation, which would open the door for this kind of service. But I have no idea what form the regulation should take to produce the right market and incentives

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#632

Post by structural »

MarcoPerazaFCC wrote: post #156
sumtechguy wrote: post #108

Earlier quoted context omitted.

I would like to add most of the IoT problem is no patches at all. The firmware they get is usually bog standard with some very minor tweaks out of china somewhere. It is a problem of vendor locked in products where you have to buy a hub to do an update. If there even is an update. If you want to get a good picture of how sideways updating can even be watch the linus tech tips on where he wanted (and has the tech abil…

Re: the licensing issue, companies wanting to put a label on their product would probably want to extract similar guarantees up their supply chain. Especially with a voluntary program like the one the FCC is proposing, good practices won't become the norm across the market overnight. But maybe, at the very least, the segment of product and component makers that take security seriously will begin to grow. I encourage…

As someone who designs IoT devices like these for a living, the device manufacturers here are in many cases the smallest companies in the supply chain and have very little ability to influence things upstream of them, especially for specialty products or companies entering a new market. It's often a major win to get a chipmaker to pick up the phone and sell us their product, much less receive any support at all.

I wish I could put a label like this on all of my products and I've been wishing for this for over twenty years, but the reality on the ground is that our support ends when the support for the individual parts in our product ends. We've looked at our supply chain periodically to see if we can replace parts with better documented/supported comparable parts, but frequently there just really aren't any better options.

This is a great idea in concept, but I fear that the flaw in the FCC's proposed rulemaking is that only indirectly addresses the root cause (the software, documentation, and support/updates provided by chipmakers for their parts). Furthermore, by focusing on device manufacturers who are the weaker partners in the chain, the regulation is likely to punish smaller, more innovative manufacturers.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#633

Post by monch1962 »

ics wrote: post #377
bick_nyers wrote: post #364

Earlier quoted context omitted.

This is an amazing idea and I would only buy a product that has this stamp on them. I would put some additional triggers into the publication of source code as well, notably if the company goes out of business. I would also put some kind of timer and renewal process on it, like a company needs to recertify every 1-5 years (pros and cons to different time lengths) and that they have indeed been providing actual update…

The OEM could be allowed to choose their recertification period, perhaps with slight differences in requirements. Perhaps even different options offered by company size. For example 1-5 employee companies might get a "no recertification, provided as-is" option which releases automatically 3 years after filing. Vendors who re-certify every 6 months could get an extra mark on their stamp or whatever. There are tons of…

Agree this approach seems to be worth investigating further, but as a citizen of a non-US country, I'd like to see a solution that wasn't based on a US-centric set of controls and governance bodies.

These days, with nationalism and populism rampant across the world, I think we need a solution where no one country (or country's leader) can simply decide to turn off critical infrastructure for the rest of the world and/or hold the rest of the world to ransom. Then you run into questions of "do we really want (insert bad country) to be able to expose IOT source code to their evil hackers?".

This is a really difficult problem to solve, but ultimately I think ownership of the "keys" to unlock escrowed code needs to reside with (winging it here...) a body such as IEEE or ISO. Or possibly something like a global council where e.g. any 5 countries out of 7 can collaborate via a sharing of keys to release source code, but no one country is able to do so.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#634

Post by 01100011 »

ryukoposting wrote: post #378

As a firmware engineer, I'm one of the people who actually writes the code that goes inside the IoT devices. I'm very interested in what the FCC might be able to do here. How does the FCC define a security flaw? Would updates only be distributed when there is a flaw that needs fixing? Remote update mechanisms can themselves present security problems in some domains. Thus, some devices should only be updatable if the…

It would help if there were reference designs and testsuites for common embedded tasks like remote updates, configuration storage, input validation, etc.

I don't do much embedded work these days, but I remember a lot of shoddy, ersatz designs based on random OSS components. I remember a small mfg of hardware devices used widely in payment processing tell me they were secure because "they used SSL" despite not taking care of physical or system security in a coherent, effective way.

Honestly, companies need to have some liability or other incentives to even care about security a lot of the time.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#635

Post by ClumsyPilot »

EricMausler wrote: post #613
dotancohen wrote: post #544

Earlier quoted context omitted.

> I dont think anyone would like it very much if someone came to their > house and documented all the ways to rob it they could find, even if > it's for research purposes. The correct analogy would be if someone documented all the ways to rob a house that is currently mass-produced and sold on the market. And yes, as a consumer I most certainly would approve of such activity, especially if I've yet to make a purchasi…

In that scenario I would MUCH rather the company be aware someone is putting that lust together, notfiy me in advance of the research being concluded, provide updates, organize and manage the contents of that list, offer solutions, patch the fixes in new models, and generally work with the people who already purchased the house. I would not prefer someone to do it all in secret and then at the last second decide they…

> In that scenario I would MUCH rather the company ... notfiy me ... provide updates..

Here is the problem - the company does not give a crap. You get robber, and it's their fault? They don't care. But they will sue the researcher, because the researcher has discovered that it's their fault you got robbed.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#636

Post by structural »

WalterBright wrote: post #626
ryukoposting wrote: post #378

As a firmware engineer, I'm one of the people who actually writes the code that goes inside the IoT devices. I'm very interested in what the FCC might be able to do here. How does the FCC define a security flaw? Would updates only be distributed when there is a flaw that needs fixing? Remote update mechanisms can themselves present security problems in some domains. Thus, some devices should only be updatable if the…

> Remote update mechanisms can themselves present security problems in some domains. I've proposed many times that the device have a physical write-enable switch on it, not a software switch. That way, a malware infestation won't survive a reboot, and your backup hard drives won't get compromised. I'm amazed that nobody does this. (Hard drives used to have a write-enable switch on them.)

Many flash chips have write enable pins at the hardware level. So this support really does still exist in theory!

However, these pins mostly aren't used for any kind of switch in basically every PCB design I've seen. Either it's "always enabled" so the storage can always be written, or it's a chip that's programmed from the factory and always disabled to prevent any kind of user update.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#637

Post by landemva »

SimingtonFCC wrote: post #530
simne wrote: post #517

Greetings from Ukraine, European country with real Great war just now. I must say, we see extreme grow of cyber-crime as part of modern war. I think, in nearest future, cold war will guaranteed have huge cyber-crime part. And, hacking of IoT devices has very significant share of cyber-crime now. For real war it is question of life and death, because hacked devices with radio emission, are used by hostile intelligence…

Hi and thanks for commenting. My concern with this topic is motivated in part by the AcidRain family of energy infrastructure attacks and the larger questions they raise about infrastructure security. Teardowns on Chinese-sourced equipment have been somewhat worrying as well -- one report I've read highlighted about two dozen versions of SSH in a single base station. Best wishes and good luck.

> the larger questions they raise about infrastructure security.

Not your mission to fix a network design problem which should air gap all of those devices. USA taxpayers can't afford your agency scope creep.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#638

Post by mkoubaa »

coldpie wrote: post #192
SimingtonFCC wrote: post #167

Earlier quoted context omitted.

I understand your skepticism. That's why I want to see the label functioning as something like an enforceable representation to consumers. If someone wants to sell brick-proof glass, and get a sticker from the US Government saying so, it better be brick-proof.

Well, my comment is predicated on the, apparently erroneous :), assumption that no glass is brick-proof. It is impossible to build a secure software product with our current tooling & development practices. The number of security flaws in every software product is so high as to make the label meaningless. I don't think there's a meaningful distinction to end consumers between "this product has 1,000 holes, 100 of whi…

A car that's safe to crash in is also impossible to build, but the NHTSA has standardized crash tests that they built up over time that has meaningfully made cars safer.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#639

Post by [deleted] »

EricMausler wrote: post #613
dotancohen wrote: post #544

Earlier quoted context omitted.

> I dont think anyone would like it very much if someone came to their > house and documented all the ways to rob it they could find, even if > it's for research purposes. The correct analogy would be if someone documented all the ways to rob a house that is currently mass-produced and sold on the market. And yes, as a consumer I most certainly would approve of such activity, especially if I've yet to make a purchasi…

In that scenario I would MUCH rather the company be aware someone is putting that lust together, notfiy me in advance of the research being concluded, provide updates, organize and manage the contents of that list, offer solutions, patch the fixes in new models, and generally work with the people who already purchased the house. I would not prefer someone to do it all in secret and then at the last second decide they…

[deleted]

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#640

Post by mkoubaa »

lrvick wrote: post #461

I have personally found several IoT vulns in everything from Zoom devices to Japanese robot hotels, and I run a security consulting firm. Swooping in with my 2c. Most of the time the engineers making these things -think- they are reasonably secure, but they tend to have little to no infosec experience and are moving too fast with no accountability. Worse, even when there is some accountability such as code review, th…

I really like #7
Post reply on HN