Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

White House unveils Cyber Trust Mark program for consumer devices

nextgov.com

Post reply on HN
Print view View original

151–160 of 164 posts

Re: White House unveils Cyber Trust Mark program for consumer devices

#151

Post by [deleted] »

rkagerer wrote: post #56
kube-system wrote: post #32

Earlier quoted context omitted.

You might be getting a bit too far ahead of where the industry is at with some of those wishlist items. NIST's requirements are things that are best practices that everyone agrees with, like: * data stored/transmitted is secured by some kind of means * the device supports software updates * the device requires users to authenticate * the device has documentation * you can report security vulnerabilities to the develo…

the device supports software updates 'Cause they need somewhere to load in those exploits! A hypothetical device which is all read-only (except perhaps for a very carefully crafted, limited set of configurable parameters) might in some cases be more secure than the bulk of what's on the shelves today. After all, how many widespread hacks do you read about on old, single-purpose fixed analog or digital devices (which…

[deleted]

Re: White House unveils Cyber Trust Mark program for consumer devices

#152

Post by hulitu »

AJ007 wrote: post #116
ndriscoll wrote: post #102

Earlier quoted context omitted.

> Most software vulnerabilities aren't intentionally added backdoors, but flaws in the software that shipped on a device. Disagree, it is extremely common for e.g. TVs and smart phones to ship with malware included. In fact it is almost impossible to buy some classes of devices that aren't intentionally compromised. Having the thing never connect to the Internet at all and never receive updates is a far better securi…

Any sort of warranty or security representation is basically snake oil except in a very narrow set of circumstances and conditions, yet still not 100%. If Apple can't keep iPhones 100% locked down, with billions of security spend, no fucking way some government program is going to authentic security across a wide variety of devices or various hardware & software qualities. One thing the government can or perhaps shou…

> If Apple can't keep iPhones 100% locked down, with billions of security spend,

I would say this is intentional. Like hardcoded passwords in {Cisco, Palo Alto, Fortinet} routers.

Re: White House unveils Cyber Trust Mark program for consumer devices

#153

Post by ngneer »

The true problem is that the world is addicted to additive security. "What can we add to make our systems more secure?" Since the InfoSec industry sprung from the IT industry, the financial incentives are backwards. At the moment, people pay for security solutions that add complexity. Walk the floor in any commercial security conference and you will find these to be the most prevalent. "Take my tech" is the mantra. If people only paid for security solutions that remove complexity, then it would be a very different story. "Let me do away with your complexity" would be the better mantra. Albeit a gross simplification, the industry must flip the script to subtractive security, asking what can we remove or revise to make our systems more secure.

Same thinking afflicts consumer devices. New IoT device? Which known-good security validated and battle tested software stack is the vendor reusing? Oh, your own homebrew stack that phones home? How novel! You mean you slapped on whatever it took to ship? Terrific! There is a bug in ROM with no way to securely remediate? Shocking! /s

Re: White House unveils Cyber Trust Mark program for consumer devices

#154

Post by rkagerer »

jayd16 wrote: post #90
rkagerer wrote: post #56

Earlier quoted context omitted.

the device supports software updates 'Cause they need somewhere to load in those exploits! A hypothetical device which is all read-only (except perhaps for a very carefully crafted, limited set of configurable parameters) might in some cases be more secure than the bulk of what's on the shelves today. After all, how many widespread hacks do you read about on old, single-purpose fixed analog or digital devices (which…

Some things to realize about read-only devices is that once they are cracked, they are cracked forever. The devs have dev time to secure the device, the hackers have infinite time to crack it. Once done, the game is up. All instances are now easily exploited. The more popular the device, the more knowable upside to an exploit. If the device can be updated, then usually the exploitable timeframe is limited and its unk…

Fair enough but nobody ever hacked my transistor radio ;-).

Re: White House unveils Cyber Trust Mark program for consumer devices

#155

Post by jitl »

mjevans wrote: post #150
jayd16 wrote: post #127

Earlier quoted context omitted.

What you're describing is a completely unsecured device. Any security comes from elsewhere.

Precisely. The camera is not the Security SYSTEM. It should be an unthinking, and thus difficult to corrupt or abuse, sensor for a security system.

If only every human was an omniscient and perfectly rational actor with infinite time to become network security professionals and infinite budget to implement their perfect security boundary

Re: White House unveils Cyber Trust Mark program for consumer devices

#157

Post by Arnavion »

lebubule wrote: post #156

They should have contacted the FSF. https://ryf.fsf.org/ Again, decades ahead.

Note that the FSF has no problem giving an RYF certification to hardware with unupdatable binary blobs, as long as those blobs reside in a separate chip like an SPI flash. It's not a measure of security or maintainability. Of course whether the FCC label will be one either remains to be seen.

Re: White House unveils Cyber Trust Mark program for consumer devices

#158

Post by baobun »

jayd16 wrote: post #90
rkagerer wrote: post #56

Earlier quoted context omitted.

the device supports software updates 'Cause they need somewhere to load in those exploits! A hypothetical device which is all read-only (except perhaps for a very carefully crafted, limited set of configurable parameters) might in some cases be more secure than the bulk of what's on the shelves today. After all, how many widespread hacks do you read about on old, single-purpose fixed analog or digital devices (which…

Some things to realize about read-only devices is that once they are cracked, they are cracked forever. The devs have dev time to secure the device, the hackers have infinite time to crack it. Once done, the game is up. All instances are now easily exploited. The more popular the device, the more knowable upside to an exploit. If the device can be updated, then usually the exploitable timeframe is limited and its unk…

Sure. But how the firmware process functions matters.

There's a world of difference between remotely initated OTA over the interent vs flashing it locally via a USB drive or microSD card. You know like PC motherboards keep working for decades now. They are effectively read-only under normal use and need to have a certain reboot sequence (BIOS/UEFI fw admin) to unlock flashing. Or maybe even load firmware from a preinstalled SD card which makes swapping easy.

Or if you really need to be fancy wity remote updates: at least require the push of a physical button to allow flashing remotely.

Re: White House unveils Cyber Trust Mark program for consumer devices

#159

Post by dotancohen »

kube-system wrote: post #125
ndriscoll wrote: post #123

Earlier quoted context omitted.

IoT customers by default would not have devices exposed to the Internet. This has been the status quo for decades ever since wifi and NAT became popular. If they don't understand it, it will be secure by default. It would be technically quite easy for either a dedicated home-access box or just the router-AP combo box to have some auto-config wireguard setup (e.g. scan a QR code or install an app that looks for the bo…

> IoT customers by default would not have devices exposed to the Internet. This has been the status quo for decades ever since wifi and NAT became popular. If they don't understand it, it will be secure by default. Because IoT devices have historically been known as secure? Definitely not. Devices that presume someone else has already configured a firewall correctly often presume wrong. Consumers are not networking p…

  > Because IoT devices have historically been known as secure? Definitely not.
SSH: Secure Shell

HTTPS: HyperText Transport Protocol, Secure

Now you know what the S in IoT stands for.

Re: White House unveils Cyber Trust Mark program for consumer devices

#160

Post by rkagerer »

moritonal wrote: post #71
rkagerer wrote: post #56

Earlier quoted context omitted.

the device supports software updates 'Cause they need somewhere to load in those exploits! A hypothetical device which is all read-only (except perhaps for a very carefully crafted, limited set of configurable parameters) might in some cases be more secure than the bulk of what's on the shelves today. After all, how many widespread hacks do you read about on old, single-purpose fixed analog or digital devices (which…

An interesting thought is how when devices couldn't auto-update, they had to work out the gate. I imagine this encouraged companies to do much better testing to reach a gold-plate before deploying.

Agree wholeheartedly. Seems like nearly everyone seems to "cheat" these days and ship well before the product is remotely finished.
Post reply on HN