Live data from Hacker News

Schneier: It's Time to Regulate IoT to Improve Cyber-Security

eweek.com

111–120 of 185 posts

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#111
Watch this go terribly wrong.

Honestly, I don't understand why consumers lack the restraint to simply not buy unfinished products, but this is where the leverage to improve IoT security has to come from. If today's IoT devices are such a liability, then prove it in court; but don't think that you can write a law that ensures security instead of mere standardization.

Meticulously studying the introduction and effects of regulations in this vein, I highly doubt they will have the intended effect.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#112
post #20

Even though many people scoff at the idea of government regulations, the economic incentives in IoT security are really all messed up and it's not really clear that the market will fix itself because so much of the damage can be externalized somehow. Does the manufacturer of a cheap and outdated IoT device care if it's participating in some ddos attack? Or like Schneier said, does the consumers care if they don't not…

> opening the source code once security updates for the device stop, so consumers could help themselves That might help the readers of HN, but not users in general. Most users won't bother installing security updates for their PC if it's not forced on them. Updating one's light bulbs with something off github is a non-starter.

That's missing the point. Third. Parties.

We have them for practically everything. End users can't figure it out, the manufacturer (say Microsoft) doesn't give two craps, so a third party (>90% of my career) involves solving those problems for users.

If things were open sourced, that'd make my job insanely easier in terms of man hours invested in any project.

I've literally had to spend >100 hours diagnosing that Dynamics CRM 2013's main data import tool has a bug that they refuse to fix. (Ever since it launched.) The import wizard refuses to actually load TIMESTAMPS (as well as some other columns) in even though it specifically supports setting that column. So when you do a data import, ALL of the user's data is out of order. That's completely unacceptable for any business to have their e-mails, notes, all have the same timestamp and no proper ordering. So "all" you have to do is first diagnose that this is the problem, then find this super obscure website where a guy made a fix except his code is half completed and full of errors, then install the entire CRM SDK stack. Learn how to write a C# plugin that exploits the CRM SDK. Write the corrected version of this guys code. Compile it. Use the CRM SDK toolkit to "attach" the plugin to your CRM. Figure out (no docs) what messages/events the plugin is supposed to actually trigger on with no error messages (while it takes >5-10 mins of user input every test to find out if it worked and then remove all the data again from the DB.)

If that was open source, that'd be a one line of code fix and I wouldn't have to play the "prod the black box" game of trying to figure out exactly where the failure point is. Hell, just adding a debugger would be insanely powerful. And that was just "one" story I have with "one" product that I support out of dozens if not hundreds.

So that's the thing. Regardless of whether a manufacturer open sources or not, people like me still have to fix the damn problem. Failure isn't an option. The checks have to go out. The lung machine has to keep blowing. And whether or not the business makes it easy or hard, doesn't enter the equation (except in terms of cost and man-hours). Nobody cares that you want to protect your IP. They care that their damn time clock doesn't work and they've got millions of dollars of product to ship while their employees stand outside of a locked automatic door.

So the real question is simply: Do you love, or hate, the people who support your software? Because we're still here, every day, slogging through insane problems by poking blindly in the dark. Closed source software breaks just as often as open source. The difference is, that the essential third-party (me) has to bill 10X as many hours to fix the problem. So if you're a business, it's in your best financial interest to demand open-source code whenever not prohibited (security constraints, HIPPA, whatever).

Closed-source is like buying a car and pretending it'll never break down, or that the manufacturer has the time, energy, and willpower to come down to your house and fix it. Some might go that far. The other 99% won't. And if there's a piece of software that has zero bugs, I haven't seen it in my lifetime.

So to bring this back to IoT. When a clients IP Camera goes down, they don't give a crap why. They need it back up. Yesterday. And they especially don't appreciate buying expensive hardware that ends up having security flaws... and worse... that is physically impossible to close. The clients aren't going to easily understand, "I paid $3,000 for it, and it works fine, but I should NEVER use it because it could be hacked?" That's like buying a car and a recall hits that says "the locks no longer work" and instead of fixing the locks, or allowing a third-party to fix the locks, everyone is just supposed to stop driving their car. You'd never see that in the real world, but somehow "software is magic" so it plays by different rules.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#113
post #20

Even though many people scoff at the idea of government regulations, the economic incentives in IoT security are really all messed up and it's not really clear that the market will fix itself because so much of the damage can be externalized somehow. Does the manufacturer of a cheap and outdated IoT device care if it's participating in some ddos attack? Or like Schneier said, does the consumers care if they don't not…

Indeed, I have the feeling that all regulations will do is lead us down the slippery slope of regulating all software and computing devices, eventually creating the dystopia predicted by RMS in his famous story: https://www.gnu.org/philosophy/right-to-read.en.html

Or at least, an even more modest regulation, simply allowing all consumers to hack their own devices without fear of violating any laws.

More simply, they could make all reverse-engineering legal, but then the copyright/IP lobby would strongly oppose.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#114
post #88

Earlier quoted context omitted.

> One thing that could hurt the market is maybe making manufacturers liable for the damages caused by security holes in their devices That's what insurance is for. Something like this was discussed in my torts class in law school, except that was long before IoT devices existed so it was about things like lawn mowers. The idea is that it might make the most sense economically to make the lawn mower manufacturer liabl…

Doesn't that mean that every single insurance payout will have to involve the courts, taking a long time and not always panning out? If I have an accident I probably need the money on the kind of time-scale that my bills are due on, not the time scale on which courts operate. Even then, that's ignoring the huge overhead introduced.

What court? What payout?

Freedom Markets™ are best served by binding arbitration.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#115
post #88

Earlier quoted context omitted.

> One thing that could hurt the market is maybe making manufacturers liable for the damages caused by security holes in their devices That's what insurance is for. Something like this was discussed in my torts class in law school, except that was long before IoT devices existed so it was about things like lawn mowers. The idea is that it might make the most sense economically to make the lawn mower manufacturer liabl…

How do you deal with insurance fraud if the manufacturer is the one paying for the insurance?

If a manufacturer engages in fraud and is caught, they would (a) be subject to criminal penalties for insurance fraud and (b) it would become very difficult or expensive for them to acquire insurance in the future. These two negative consequences serve as a strong deterrence against fraud.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#116
post #88

Earlier quoted context omitted.

> One thing that could hurt the market is maybe making manufacturers liable for the damages caused by security holes in their devices That's what insurance is for. Something like this was discussed in my torts class in law school, except that was long before IoT devices existed so it was about things like lawn mowers. The idea is that it might make the most sense economically to make the lawn mower manufacturer liabl…

> That's what insurance is for What are the outcomes for using insurance, and what are the outcomes for using regulation? Does anyone know the answers in a technical policy sense (not in a philosophical sense)? They are different tools useful for different problems. Thinking out loud, insurance seems like a poor solution when people will suffer serious, irreparable harm. If the lawnmower severs a foot, then an insura…

> What are the outcomes for using insurance, and what are the outcomes for using regulation?

Bad question, false dichotomy: these are not apples-to-apples comparisons. How about some minimal regulations that include an insurance requirement?

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#117
post #88
post #20

Even though many people scoff at the idea of government regulations, the economic incentives in IoT security are really all messed up and it's not really clear that the market will fix itself because so much of the damage can be externalized somehow. Does the manufacturer of a cheap and outdated IoT device care if it's participating in some ddos attack? Or like Schneier said, does the consumers care if they don't not…

> One thing that could hurt the market is maybe making manufacturers liable for the damages caused by security holes in their devices That's what insurance is for. Something like this was discussed in my torts class in law school, except that was long before IoT devices existed so it was about things like lawn mowers. The idea is that it might make the most sense economically to make the lawn mower manufacturer liabl…

The problem is that this subsidizes stupid people at the expense of not-stupid people. Injuring yourself in dumb, preventable ways should have personal repercussions.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#118
post #32

Something similar existed called FIPS-140, though it is hard to certify and not a good fit for IoT. IoT router/firewall might be one of the solution here, i.e. adding IoT pattern into existing routes/firewalls to protect IoT devices, in addition to your PCs and sometimes BYODs(smart phones etc). It is very hard to make all IoT devices secure due to limited resource they have, so the first line of protection should be…

OK, so how do you distinguish automatically "abuse" from "proper use" for arbitrary devices, and how would putting the code that is able to do that on a separate device be easier than compiling it into the firmware of the devices themselves?

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#119
It's simply not going to happen as long as elected politicians and officials are mostly technically-illiterate. These are the same people seriously considering back doors to encryption in the name of security.

Give it 5-10 years when enough of them have died off; then change will happen.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#120
post #49

Earlier quoted context omitted.

That doesn't necessarily prevent them from infecting each other and other people/devices on the internet, or being used in attacks. It's sort of like living in a neighborhood and having a rock pile you enjoy the aesthetics of, but know it's prone to having rattlesnakes move in, and instead of fixing the rattlesnake problem either as it happens or at the root, just putting a wall around your property excluding the pil…

Agreed, it's definitely not full-proof by any stretch. But it's amazing how many people enter their WiFi password into devices they really have no control over that can then for example sniff your network, slowly but steadily crack your passwords, possibilities are endless.

If that is a security problem, you probably have a much bigger problem anyway. Secure passwords cannot be cracked, the public internet is hostile anyway and you should be protecting your communication with strong cryptography. Pretty much the only sensible reason why you should protect your internal network from access (including sniffing) is because you might have IoT on it that tend to have terrible security. Putting them all in the same, but separate, network, essentially achieves nothing.
Post reply on HN