Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

White House unveils Cyber Trust Mark program for consumer devices

nextgov.com

Post reply on HN
Print view View original

81–90 of 164 posts

Re: White House unveils Cyber Trust Mark program for consumer devices

#81

Post by jonhohle »

moritonal wrote: post #71
rkagerer wrote: post #56

Earlier quoted context omitted.

the device supports software updates 'Cause they need somewhere to load in those exploits! A hypothetical device which is all read-only (except perhaps for a very carefully crafted, limited set of configurable parameters) might in some cases be more secure than the bulk of what's on the shelves today. After all, how many widespread hacks do you read about on old, single-purpose fixed analog or digital devices (which…

An interesting thought is how when devices couldn't auto-update, they had to work out the gate. I imagine this encouraged companies to do much better testing to reach a gold-plate before deploying.

Less critical, but video games are the same way. Companies will press and ship discs with known broken games and then issue a patch of dozens of GBs day one. The whole point of having a disc is when all the servers are off line, and the store have shut down, the game is still playable.

Re: White House unveils Cyber Trust Mark program for consumer devices

#82

Post by ocdtrekkie »

rkagerer wrote: post #56
kube-system wrote: post #32

Earlier quoted context omitted.

You might be getting a bit too far ahead of where the industry is at with some of those wishlist items. NIST's requirements are things that are best practices that everyone agrees with, like: * data stored/transmitted is secured by some kind of means * the device supports software updates * the device requires users to authenticate * the device has documentation * you can report security vulnerabilities to the develo…

the device supports software updates 'Cause they need somewhere to load in those exploits! A hypothetical device which is all read-only (except perhaps for a very carefully crafted, limited set of configurable parameters) might in some cases be more secure than the bulk of what's on the shelves today. After all, how many widespread hacks do you read about on old, single-purpose fixed analog or digital devices (which…

Yep! My Insteon home automation devices have no firmware update capabilities. They also have an extremely simple local RF protocol. They allow smart device behavior but are too stupid to be "compromised".

Re: White House unveils Cyber Trust Mark program for consumer devices

#83

Post by simne »

knowitnone wrote: post #55
simne wrote: post #31

Earlier quoted context omitted.

> What's to stop the bad actors from just printing the logo on their gear anyways? This is federal offense, like document falsification. So if somebody will be caught on doing it - could go to jail.

except they are not in your country so how can to go to jail and why do they care about you laws?

Have you hear about customs?

Re: White House unveils Cyber Trust Mark program for consumer devices

#84

Post by dylan604 »

ok123456 wrote: post #78
vessenes wrote: post #13

Interesting. I'm not sure if the public comment period is over (The original proposal is dated August, 2023), but this stands out to me from their paper: We propose to focus the scope of our program on intentional radiators that generate and emit RF energy by radiation or induction.31 Such devices – if exploited by a vulnerability – could be manipulated to generate and emit RF energy to cause harmful interference. Wh…

Can we add that it's self-repairable domestically?

What could we do to make something self-repairable domestically that would also make it not repairable otherwise? Like if you bought it here, but then took it with you internationally, would it suddenly not be repairable?

Re: White House unveils Cyber Trust Mark program for consumer devices

#85

Post by nimbius »

vessenes wrote: post #13

Interesting. I'm not sure if the public comment period is over (The original proposal is dated August, 2023), but this stands out to me from their paper: We propose to focus the scope of our program on intentional radiators that generate and emit RF energy by radiation or induction.31 Such devices – if exploited by a vulnerability – could be manipulated to generate and emit RF energy to cause harmful interference. Wh…

another question: how does this work with open-source technology? Banana Pi for example is often considered an IOT.

Re: White House unveils Cyber Trust Mark program for consumer devices

#86

Post by wpm »

ocdtrekkie wrote: post #82
rkagerer wrote: post #56

Earlier quoted context omitted.

the device supports software updates 'Cause they need somewhere to load in those exploits! A hypothetical device which is all read-only (except perhaps for a very carefully crafted, limited set of configurable parameters) might in some cases be more secure than the bulk of what's on the shelves today. After all, how many widespread hacks do you read about on old, single-purpose fixed analog or digital devices (which…

Yep! My Insteon home automation devices have no firmware update capabilities. They also have an extremely simple local RF protocol. They allow smart device behavior but are too stupid to be "compromised".

Local RF? What protocol? Proprietary?

Re: White House unveils Cyber Trust Mark program for consumer devices

#87

Post by ocdtrekkie »

wpm wrote: post #86
ocdtrekkie wrote: post #82

Earlier quoted context omitted.

Yep! My Insteon home automation devices have no firmware update capabilities. They also have an extremely simple local RF protocol. They allow smart device behavior but are too stupid to be "compromised".

Local RF? What protocol? Proprietary?

It's proprietary but relatively easy to reverse engineer, the details are out there. In the US it uses like 914.5 MHz or something, and I can send instructions to devices with an extremely simple serial protocol on my computer.

No Bluetooth, no Wi-Fi, no protocol sophisticated enough to distribute code. Just locally transmitted instructions.

Re: White House unveils Cyber Trust Mark program for consumer devices

#88

Post by helsinkiandrew »

moritonal wrote: post #71
rkagerer wrote: post #56

Earlier quoted context omitted.

the device supports software updates 'Cause they need somewhere to load in those exploits! A hypothetical device which is all read-only (except perhaps for a very carefully crafted, limited set of configurable parameters) might in some cases be more secure than the bulk of what's on the shelves today. After all, how many widespread hacks do you read about on old, single-purpose fixed analog or digital devices (which…

An interesting thought is how when devices couldn't auto-update, they had to work out the gate. I imagine this encouraged companies to do much better testing to reach a gold-plate before deploying.

Assuming these are network devices - it can be harder to certify future working if the network services they rely on become unavailable or when the failure only occurs at scale.

Case in point when 700,000 Netgear routers pinged the University of Wisconsin–Madison NTP server (harcoded IP address) every second.

https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse#Ne...

Re: White House unveils Cyber Trust Mark program for consumer devices

#89

Post by SketchySeaBeast »

knowitnone wrote: post #52
readyplayernull wrote: post #15

Earlier quoted context omitted.

Laser safety glasses in Amazon are so fake anyone could come up with a conspiracy theory about some country trying to blind the population of another.

cool. you get to sue Amazon for millions for the loss of one eye

You mean get stuck in a legal battle which takes years where Amazon denies responsibility and pushes everything to the original vendor, who for some reason went out of business 15 minutes before the suit was filed?

Re: White House unveils Cyber Trust Mark program for consumer devices

#90

Post by jayd16 »

rkagerer wrote: post #56
kube-system wrote: post #32

Earlier quoted context omitted.

You might be getting a bit too far ahead of where the industry is at with some of those wishlist items. NIST's requirements are things that are best practices that everyone agrees with, like: * data stored/transmitted is secured by some kind of means * the device supports software updates * the device requires users to authenticate * the device has documentation * you can report security vulnerabilities to the develo…

the device supports software updates 'Cause they need somewhere to load in those exploits! A hypothetical device which is all read-only (except perhaps for a very carefully crafted, limited set of configurable parameters) might in some cases be more secure than the bulk of what's on the shelves today. After all, how many widespread hacks do you read about on old, single-purpose fixed analog or digital devices (which…

Some things to realize about read-only devices is that once they are cracked, they are cracked forever. The devs have dev time to secure the device, the hackers have infinite time to crack it. Once done, the game is up. All instances are now easily exploited.

The more popular the device, the more knowable upside to an exploit. If the device can be updated, then usually the exploitable timeframe is limited and its unknown if the attempt is even worthwhile.

> After all, how many widespread hacks do you read about on old, single-purpose fixed analog or digital devices (which in a sense are similarly 'read-only').

Well basically because any device of consequence is trivially hacked by now. Think about game consoles or anything that would have DRM today.

Post reply on HN