Hacker News Reader

Comment by riskable | Hacker News Reader

I've been warning about this kind of thing for years and years. Both professionally and in my personal life. On forums and anywhere people will listen...

IoT is a security disaster

I hate to suggest things like this but we may need legal remedies to solve the problem before it becomes an Internet Zombie Armageddon (IZA). It's that bad.

There's going to be tens of billions of IoT devices installed at businesses and homes in just a few short years. If they're not receiving regular, timely security updates the Internet as we know it may just plain collapse from the sheer weight of all the zombies.

I propose a mandatory "nutrition label" of sorts for IoT device packaging. Something like this:

    * Updates itself regularly
    * Conforms to NIST security standards
    * Public penetration test results: https://ptr.iot.nist.gov/A2L7P9D23345
    * Shares data with 3rd party: No
    * Administration by vendor: No
    * Requires Internet connection to administer: No
    * Requires 3rd party service to function: No
    * Notifies of intrusion: Yes
    * Logs all access: Yes
    * Encrypts all network traffic: Yes

Something like a publicly-posted penetration test would be incredibly valuable. Especially if it was performed after each update of the device and at regular intervals. Even if it was an automated test (which in theory could be 'gamed') it would still be better than what we have now which is nothing!

View on HN

As Dan Geer warned[1], embedded devices must not be both unfixable and immortal. Either they have some sort of remove management interface and receive regular security updates, or they must have a limited lifespan.

Creating embedded systems that won't be updated and live indefinitely is knowingly creating a hazard and nuisance to society.

[1] http://geer.tinho.net/geer.blackhat.6viii14.txt

> or they must have a limited lifespan

This seems like it would give free range to sell shitty devices that are obsolete the moment they come out of packaging - or worse, that brick themselves on a timer for supposed security purposes (think HP ink cartridges.)

I agree, but the unfixable+immortal combination isn't really an acceptable situation.

The solution for most devices is to simply keep them off the internet. Being a host on the internet requires some level of care and maintenance so you don't become a hazard to others. I doubt most light-bulbs or thermostats are worth the ongoing expenses of maintaining security updates into the indefinite future. In theory, traditional goods that last more than a few years should be more successful on the market than self-destructing devices with dubious internet features.

This is fine, there is a market for that like anything else. The problem is where that is not a function the consumer is aware off at the time of purchase.

Now perhaps some good recycling laws would combat abuses of such an effect.

Tying IoT devices to cloud services almost guarantees a limited lifespan.

While this is a case of "two wrongs make a right"[0] - anything that provides even some value without the backend up will still be connected, perennially at risk of getting taken over by a bad actor.

[0] And a pretty strong argument against "forever" IoT devices.

Maybe the solution is some sort of prepaid credit for a cloud computing network? like lambda or something. That would at least shift the burden of staying running.

That only means they might eventually stop fulfilling their primary function. But they might remain plugged in and serve as bot without anyone noticing for years.

Very true. While I had assumed that most people would toss their gadgets once their functionality had been disabled, I wouldn't buy a new fridge or other appliance just because I can't load cat pics on it anymore.

Depends on the appliance. Your fridge will probably work when disconnected from the cloud. Your LED lightbulbs? I can imagine them getting bricked. I know of one laser cutter, featured some time ago on HN, that becomes a very big paperweight when disconnected from the Internet...

Maybe we should leave the task of authentication, encryption and whatever phoning home these devices need to do to some kind of industry standard relaying protocol that lives on a router. You would then only need updating the router to keep any WAN activity safe for the IoT devices. Updates can also be delivered safely trough this mechanism, which lazy manufacturers would definitely still forget to do (but may be useful for keeping local network access safe , which would not rely on this mechanism).

That is, if router manufacturers could also keep their crap safe...

If you don't trust an off the shelf router for this, you could also use a computer setup as a router with such relaying software. It would be as simple as running a dhcp server or something.

Routers could also default to denying any authentication from WAN, with the user changing this policy on a per device basis or just allow eveything.

> As Dan Geer warned[1], embedded devices must not be both unfixable and immortal.

So when do you want me to turn off your colored LED light bulbs you bought? Yeah, thought so.

> you bought?

I assure you I have not (and never will) purchase any "internet enabled" (or "smart") device. Most devices worked just fine without a network interface.

To turn off my (standard) LED light bulbs, use the switch on the wall.

Well, probably it will be a security nightmare for a while, until the sheer weight of vulnerabilities and incidents causes vendors to radically change their security practices, regulation or not. I think a good example of what I would expect to happen is by analogy to the PC internet of the 90's, where Windows 9X viruses and worms were just a fact of life when using computers, and every email inbox was 95% spam each time you opened it. Remember that what is now considered basic security practices (UAC, https, "Are you sure you want to run this exe?") were at the time considered hardcore security measures that only enterprise systems needed to care about.

The difference is that now more of our daily lives depend on the internet being reliable, and, that some IoT device's failure mode might involve a cost in human lives. But the fact that the incidents are going to be worse will also probably put more pressure on companies to fix their security. Regrettably, I don't think this will actually happen until some startup's fancy new IoT gadget gets hacked in a way that causes it to kill a few hundred people and the resulting lawsuits end the company.

The problem is the IoT devices don't harm their owners or the company that built them but rather other targets on the internet.

It's probably not a great idea, but how about legalizing hacking for self-defense? If you get DoSed then those devices, are fair game.

That would shift incentives back to the owners to some extent, since they're basically acceptable targets as long as their devices are insecure.

I'm not sure how that would help the problem. When you're talking about thousands or more devices, counterattacking them individually wouldn't be feasible.

Also I imagine many botnet owners secure the devices they take over so that others can't steal them for their own botnet.

This comment shows the disconnect between many comments I read on this forum[0] and the real world, frankly.

Whenever Apple or Samsung release an update for their smartphones, I have a to help family members click through dialogs to install them. How are they supposed to assess and implement security for an IP camera they bought at a department store?

How would they do it anyway? Is the expectation that they fire up Wireshark, identify traffic flows to and from their device, then configure the firewall on their consumer-grade router to limit this traffic?

[0] previously read just '... disconnect between this forum ...'

Please don't generalize from a single comment to "this forum". You're painting thousands of people with a very broad brush.

Fair point, have updated my comment.

This is a Bad Idea, because you have no way of knowing whether the devices you are "counter-hacking" are simple IoT devices or if they perform a critical function of some sort. The last thing you want to do is accidentally take offline/brick an Internet-connected medical device or computer at a hospital ER room, for instance, since it might literally result in someone's death.

That sounds like a "but think of the children" argument to me. We can conjure up ways how anything can go wrong.

But should we really worry about that scenario? If you have internet-exploitable and already-exploited devices in the ER room, haven't the horses left the barn already?

Provided they continue to function as expected and aren't harming the network they're a part of. Both are big assumptions.

Stolen IoT data is the perfect way to case a house. That's a market waiting to happen.

Do people still case houses? I know at least in my area burglaries are waaaaaay down because unloading the stuff inside is basically impossible. The few remaining burglaries are essentially smash the door run in and grab any loose cash, unlocked guns or jewelry and run out. To pull that off it seems easier to do it the old fashioned way, by ringing the door bell.

I'd be much more worried about identity theft & credit card theft with IoT devices than physical theft.

Those are the burglars who aren't able to peer inside multiple homes via xbox cameras.

>ntil the sheer weight of vulnerabilities and incidents causes vendors to radically change their security practices

I've been in the professional IT game for 15 years. The "please run this macro in word to view content" issue still exists today and is one of the main vectors in ransomware. Heck, the "click this to view my photos" 'sexy-pics.exe' problem has not been solved in Windows either. End users don't care about UAC pop-ups, they click through them. See the recent literature on "Security Fatigue."

I think you have way too much faith in the industry to fix its own problems. Its clear that there are many classes of security problems that remain unfixed for decades. We're just seeing the newest version of the very same problems we've failed to address in the past.

I have no idea what the solution here is, but I imagine some level of certification is needed. Perhaps as simple as validating that you're forced to change the default password/keys and auto-update for security updates is on by default with some level of commitment to perform security updates for x amount of years after purchase. Toss in mandatory fail2ban-like functionality and you've patched the most common exploit use cases. I imagine that's a fairly hands-off approach here that won't interrupt business and will cost very little to implement.

On the end-user side of things, having a router that can detect when you're part of a botnet/DDOS and stop traffic would be valuable. Why aren't these $200+ Netgears and Linksys's running any sort of IPS? No IPS in this day and age is pretty crazy. An implementation of snort or similar wouldn't eat too much CPU and would only raise the cost marginally.

Its still very much the wild west out there from a security perspective.

You're suggesting to put a ("snort or similar") IPS console in front of the end-user who still clicks on the "click this to view my photos" sexy-pics.exe?

In my opinion, the end-user is not the one causing the problem. The manufacturer is causing the problem and -- just like we do things at $work -- he who causes the problems (should be the one who) suffers by being the one to also fix it.

The real solution for end users will be to add an actual physically different input path for the problem.

For example, imagine if home PCs and even laptops, had a special (macro) SD card like slot. This is the slot that the user put in their ownership card to get it to turn on at all, to log in to their OS account.

The computer would REFUSE to continue to operate with this card present. It would then enter 'normal mode'.

In normal mode no OS updates would process, no programs could be installed, no new scripts / downloads could be run. Trying to run a new thing would bring up the Authentication Required screen. They would need to insert the ownership card again. They would then need to expressly authorize what the new program could do.

That's the experience that end users for an appliance might desire; at least once they got used to it. I also strongly require that the end user is also the //owner// of the hardware. Not whoever made the OS/etc. All of the above controls would be in software, which could be replaced if they decided.

Yes, it really is amazing to look back at the slating UAC got when it was released under Vista.

And I _still_ have to disable it on every Windows machine so I can modify things in Program Files without jumping through hoops.

Why are you modifying things in Program Files? Are you using very old software that expects the user to modify that?

Reverse engineering, mostly.

I've been trying too. On Reddit I just get downvoted - which I actually don't understand.

I've also been warning governments about how bad things are and how bad things are going to be. I can see some movement, but it is too slow. We need more mandatory, automated penetration testing of all corporations by regulation. We also need cyber army reserves to help bring some of the knowledge that we have in the private sector to our governments without having to work in a shitty beige office downtown Ottawa.

A bunch of Teslas hacked at the same time is a weapon of mass destruction. We need to recognize that we have weapons of mass destruction online and take countermeasures now so we don't wake up one day to the news that 20 million cars accelerated to 200km/h and crashed into gas plants and government buildings all around the country. We need to regulate industry so the "move fast and break things" doesn't actually move fast and break things.

> A bunch of Teslas hacked at the same time is a weapon of mass destruction.

Daemon[1] was a fun read, but I have no desire to see it become reality.

[1] https://www.goodreads.com/book/show/6665847-daemon

Fantastic book, great ideas.

And terrible prose :(

> We need more mandatory, automated penetration testing of all corporations by regulation.

No thank you, there be dragons there. Before you know it that regulation leaks to all software development that includes calls to connect() or bind().

But an Underwriters Laboratory for pen testing? Yes, please. (Or even UL themselves!) I saw an article on HN within the last 12-18 months about a similar concept/security auditing.

That's a slippery slope argument. I know regulating tech is not going to be popular here, and maybe we leave it for corporations that are valued at over a certain amount, but right now foreign governments are hacking our financial services companies, communications companies, phones, laptops, everything. 95% of the time a it's an extremely easy hack that would have been discovered by a routine scan.

There's an important distinction between "regulating" as in setting prices, and "regulating" as in setting the rules of the competitive marketplace.

For example: You can't sell phones that explode. You can sell phones that are cheaper than the competition.

UL and similar agencies already check that plugging a device into your electrical system doesn't set something on fire. They have simple, yet strict standards that must be applied.

Likewise the FCC is very particular about radio emissions and will outright reject your product if it's too noisy.

We absolutely need something that can handle obvious problems like this, plus a way of coordinating with the vendors of these products should a vulnerability emerge that requires a patch or a recall.

> Likewise the FCC is very particular about radio emissions and will outright reject your product if it's too noisy.

That's only really recently true--just ask a ham radio guy about the noise floor if you want an earful. The FCC was pretty lax about this until this year when they finally quit accepting cross-certification from emissions labs from countries like China.

Maybe IoT manufacturers or even the consumers owning the things should be liable for damages if their products participate in a DDOS. "Underwriters" labs proves you built your product to some standard, and that presumably makes you insurable because you have a first line of defense against a lawsuit.

But as opposed to EMC standards, software vulnerabilities arise periodically and standards need to be continually updated. Would devices need to be audited periodically to maintain certification?

Among others, the right to explore and fix these devices ourselves.

That current abilities to do so, in the U.S. are arbitrated by the Library of Congress, seems entirely insufficient. Except that it perhaps gained us some temporary rights to do so that corporate lobbyists via Congress would otherwise already have taken away.

This tech has become essential to society. Intellectual property "rights" need to find their limits at a point before they put this essential function at risk. If the original manufacturers can't get this right, and where the underlying chipset technologies are from what strikes me as an oligopoly -- regardless of the number of brands and models they get stuffed into -- then the public should have every right to research, verify, and fix the products, themselves.

Ultimately and hopefully, this also works, financially. If you can't make it work properly, you lose control of your revenue stream, rather than using a government-granted monopoly (IP) and your income on lawyers and lobbyists to coerce people to suffer with your failure.

I've called for a mandatory physical "wifi off" switch for all Internet-connected devices that disconnects the antenna. Useful for the times when you want your light bulb to just be a light bulb, and not DDOS some journalist.

Some IoT and IoT-like things are simply completely non-functional without some sort of network connection. A physical switch is great for light bulbs, but it turns my child's crib-cam into a decorative art piece.

And when you would flip that switch, anyway? Wouldn't it make more sense to control this from your router? Something like changing the wifi password or network name would work even better (assuming you control the router.)

IoT should be Intranet of Things, not Internet of Things. I'd say it's simple as that. But the commercial interests are so opposed to engineering sanity that I have no idea how to tackle it.

Maybe someone should start enforcing mandatory VPNs for households? I.e. I get you want to control your LED bulbs from your phone, but that doesn't imply they should be accessible from public Internet.

Also I wonder if the whole thing isn't just a symptom of a problem that we can no longer expand connected technologies while expecting zero knowledge from end users. Maybe it's about time to require some minimum amount of computer knowledge from citizens of a technological civilization?

You don't even need a VPN, just have the device only accept connections from local IPs (and use TCP to avoid spoofed IPs).

That allows attacks comes from another compromised device or TCP SYN packet that uses unusual routing. We've already seen Javascript based attacks that use the browser as a gateway to the LAN.

You need strong authentication and secure (proven input recognizer[1]) code in anything that connects to any network, even a guaranteed LAN. Border security is only one layer of protection, and LANs are rarely an isolated network.

[1] https://media.ccc.de/v/28c3-4763-en-the_science_of_insecurit...

That doesn't work universally, for example when your device is at home and your smartphone is in another country. Using VPN allows to build a secure network over public infrastructure.

If something has a connection to the Internet--even if only through a proxy--we must treat it and all devices on the same network as if they are connected to the Internet. Because they are!

If Internet connections worked like radio broadcasts (one-way) then we'd be fine but they are inherently two-way connections. That means that for every outbound request a hole is opened up for return traffic. Even if you think, "that doesn't count" one must still account for the fact that PCs get compromised via side channels all the time and are subsequently used as pivot points for further attacks on any attached networks.

We need to stop treating intranets like they're somehow "safe" or special places apart from the Internet. They're not.

Always treat every device on any network as if it is being placed directly on the Internet because most of the time it really is. NATs and proxies aren't security tools even if they pretend to be.

I think so too. Public networks are networks full of hackers and NSA agents. The VPN-like protocol should be built into device so it doesn't accepts any packets not coming from its home network. And VPN (unlike SSL) allows encrypting traffic for external obverver while keeping it plaintext for owner.

I agree that for some devices it doesn't make sense. But having the power to take a device offline, and know in your bones that it is offline, is useful.

That doesn't mean that you shouldn't be able to control it all from your router too. But if your home router gets hacked, or there's a devastating crypto vulnerability, or you suspect your teakettle is ratting you out to the NSA, you should still be able to boil water with it.

Finally, a mandatory physical switch would remind people (and inform them) of just how much stuff they use is now net-connected.

I like your sentiment but merely disconnecting the antenna isn't good enough. That just results in bad reception which often results in power being boosted which can introduce a lot of unnecessary noise into the WiFi RF spectrum.

I don't see any way around implementing them as bog standard "RFKill" switches. A software switch is basically the only way to go because the WiFi chips are controlled in software.

Thanks for pointing that out. I'm happy with a software kill switch, as long as it's provably isolated from the rest of the system.

The nub of the idea is a legal requirement for a physical switch that will in all cases immediately disconnect the device from the network.

>we may need legal remedies to solve the problem

I doubt we can solve this problem legal way because all economic forces are against us.

Making a product secure costs many times more than making a product itself. "Regular security updates" is a nightmare to vendors. Nobody actually does it, especially on consumer market. Vendors react to massively exploited vulnerabilities at best. Any long-term maintenance, including security, simply don't fit into current business models.

And people want cheap products, they don't want secure products. Government contractors want super cheap products (with support but this doesn't change much). And education/propaganda won't change that until some big disaster happen.

I think there's an analogy to be made with the FCC (and non-US equivalents). IoT consumer devices are not general purpose devices. They are mass-produced and serve a specific purpose. They should be certified and accountable in a way. If not, they should get fined for being irresponsible.

If we can't force manufacturers and carriers to ship security updates to Android phones, there's zero chance of forcing it for light bulbs.

Get insurance companies interested. Force IoT vendors to buy insurance against potential damages caused by vulnerabilities in their devices.

Well, as I keep repeating...

Do not plug your "things" on the Internet unless there's a serious gain from it!

This solves most of the problem. The rest will only get solved by free software, and if the government should mandate anything, it is that the software can be managed by the user, not a laundry list of warnings that will mean nothing in practice.

(By the way, that "conforms to NIST security standards" is intended as a "yes" mean "bad" kind of warning, right?)

> Do not plug your "things" on the Internet unless there's a serious gain from it!

Why not? It's kind of a tragedy-of-the-commons situation.

I gain a fancy lightbulb that can change colors when I play with my phone. Do I, personally, really care if that lightbulb is part of a botnet that's beating someone's website into submission? Statistically, it's unlikely to affect me, so it's all gain for no cost beyond paying for the bulb.

But you would care if the lightbulb was caused to heat up and start a fire.

Sure, but manufacturers have adequate incentives to avoid that, because they will be held liable.

It's way more likely to affect you than that it making any relevant harm to anybody else.

Do you care about thieves checking your lights from anywhere on the city? And what about your lights launching attacks against your other computers?

> Do you care about thieves checking your lights from anywhere on the city?

Well, this article (and discussion) is mostly about these devices being sources of DDOS attacks.

> And what about your lights launching attacks against your other computers?

I thought my comment was pretty explicitly clear that most people would not care at all, even if they knew.

Maybe you would care if that website was yours. These attacks do not discriminate. If your Wifi connected lightbulb (just writing that makes my eyes roll back) is part of a botnet, one day, it might just take down something that you actually need.

That said, them being connected to the internet isn't an issue itself. Make all your IoT devices connect through one central gateway (in your house) that controls all of them and suddenly instead of 20 devices broadcasting on the internet you have a single entry point. Obviously this entry point would be the target of many, many attacks, but securing this one gateway (that would be easier to update than your lightbulb.) is much less of a complicated task than securing all twenty.

All very well in theory, but I'm sure it will suffer the same fate as ordinary nutrition labels - the general populace just doesn't care/isn't motivated enough to care

Bundle all of those points up into some sort of standard level of acceptance and let conforming products have a big shiny sticker saying so on the front of the package?

As a bit of an analogy, while I may enjoy poring over computer system security details, I'm pretty novice at a lot of more real-world things. Yesterday I was buying a new dryer exhaust hose. I read some reviews online, and looked at boxes in the store. I managed to learn enough to realize I wanted an all-metal construction so it wouldn't catch on fire. But I really wanted some big shiny signal to let me know "HEY YES IF YOU HAVE NO IDEA WHAT YOU'RE DOING, BUY THIS ONE!"...

What mjg59 has been doing is utter genius. Buy something online, discover it is full of backdoors and violates the GPL, post utterly scathing review, buyers stop buying it. We need more people to do that.

While I'm not a security professional nor am I always a fan of adding bureaucracy or overhead if there is no clear benefit, I absolutely agree with you. Even if this information is not easily consumable at first to the layperson, it would be helpful to security professionals. It would also allow for easier comparison - at least from a security perspective. Let's face it, some IoT things like security systems get installed by installation companies, so I'm sure they would appreciate knowing more details about the various products, and which to recommend for their installations, etc. Furthermore, it would set a precedent, and who knows, maybe in the future the newer iterations (of these "labels/label info") could improve enough for the ease of reading/understanding by consumers.

If I put my consumer/layperson hat on for a moment...Even if there is no government mandate to add this type of "label" to these IoT products, if I see 2 comparable products side-by-side on a shelf (or ecommerce website), but one has this "label/label info", and one lacks it, I would definitely purchase the one which HAS the label.

If the traffic is encrypted how do you guarantee that the device doesn't spy on user and doesn't have backdoors preinstalled?

And why would a device need full Internet access? Shouldn't it be only accessible in home network with maybe some (user selected) servers from Internet it is allowed to connect to?

We could use some sort of VPN (from device to other owner's devices) so that even if it is connected to Internet directly it doesn't accept any packets coming not from its owner. VPN also provides encryption while allowing user to examine traffic in clear text.

I think we need some type of easyly deployed, ubiquitous, simple, snandartised VPN type protocol so that the users can build protected networks over public insecure infrastructure.

Today if you connect your device to Internet you connect it directly to NSA and chinese hackers.

And if your device is disconnected from public network hackers cannot break into it even if they have exploits.

NIST has too much influence from the NSA. There needs to be a better standards equivalent where the US doesn't wield so much influence in subverting security protocols. It may be a pipedream considering every Western country wants to be part of the five eyes program.

edit: The most democratic and open platform in the world was made by developers from all across the world vs US made operating systems like Windows and Apple which were basically trojan horses. We need an equivalent for security protocols, and protocols in general.

We can't let US stazi entrenched Silicon Valley and their faux "Startup Scene" destroy the internet as rapidly as they are today.

http://www.nytimes.com/2016/06/08/technology/the-webs-creato...

I agree with you. I was just using the NIST as an example because they've been in the news recently; they just released some new security standards that are actually quite good! Presumably we'd use an independent organization who's whole job is to come up with best practices for the security of IoT devices.

Semi-related aside: Microsoft Active Directory violates the NIST's new password hashing guidelines because it doesn't use a random salt when storing password hashes.

>> The most democratic and open platform in the world was made by developers from all across the world vs US made operating systems like Windows and Apple which were basically trojan horses.

By platform do you mean the Internet? The Internet was initiated by the U.S. Defense Advanced Research Projects Agency.

This will realistically not be a major problem. Most of these IoT devices operate only in a LAN or talk to a specific "cloud" service.

Thus, there's no way for an attacker to get access to services on them on a large scale basis (well, without hacking the cloud service, but hopefully someone can actively maintain that).

The cameras are only an issue because many people exposed them directly to the internet so they could access them remotely.

You will not see many people expose speakers, lightbulbs, blind controllers, thermostats, fridges, TVs, etc to the internet, so it's not exactly a major threat for most devices.

Not for now at least. If IPv6 becomes wide spread available to consumers, we're in for a whole new wave of attacks on these types of devices unless home routers are configured to block incoming traffic by default to devices behind them.

Your assumptions about the safety of LANs are wrong. LANs are not "safe" from attackers and NAT is not a security tool.

If an attacker compromises any device on your network you think they'll stop there? Hell no. They're going to pivot and compromise every other vulnerable device on the network and we're already seeing "crime kits" (aka customizable malware) with built-in exploits for things like networked printers and cameras. It won't be long before they have built-in exploits for light bulbs, refrigerators, and more.

Also, what about IPv6? To date, consumer routers that support IPv6 are configured by default to hand out global IPv6 addresses (as they should!) to connected devices via DHCPv6. What this means is that your IoT light bulb is going to get a globally-accessible IPv6 address.

You can setup the firewall to block inbound connections to your light bulbs, toasters, microwave, refrigerator, etc but who is actually going to do that? Firewalls are a huge pain in the ass to configure for zillions of little devices like that and in order for them to work properly you'll need to ensure that each device gets a reasonably static IPv6 address which means going deep into the configuration of your router.

Also consider that even if you have near perfect security for your LAN we're all constantly moving in and out of our homes with connected devices that could be compromised elsewhere. Laptops, phones, tablets, etc leave our homes, connect to who-knows-what free WiFi network and then return; possibly in a compromised state.

Never assume that because something is on a LAN it is "protected" by the mere fact that it doesn't have a direct connection to the Internet! If something else on that LAN has a connection to the Internet you must treat it as if it were exposed to the Internet because it is.

> If an attacker compromises any device on your network you think they'll stop there? Hell no. They're going to pivot and compromise every other vulnerable device on the network and we're already seeing "crime kits" (aka customizable malware) with built-in exploits for things like networked printers and cameras. It won't be long before they have built-in exploits for light bulbs, refrigerators, and more.

Yes, while it would certainly work on a targeted basis, it's impossible on a massive scale basis. You can't just go hack all smart lightbulbs because you can't just go hack all home networks. There's no large-scale threat here if a vulnerable lightbulb is behind a NAT, where it cannot be directly attacked. It might be a point where an attacker who broke in already could lurk, but it's not a new and trivial point of intrusion.

> Also, what about IPv6? To date, consumer routers that support IPv6 are configured by default to hand out global IPv6 addresses (as they should!) to connected devices via DHCPv6. What this means is that your IoT light bulb is going to get a globally-accessible IPv6 address.

I commented on this already: By _default_ routers need to be firewalling off incoming connections completely via v6 too, as they effectively do with v4, NAT is probably the only reason we're not still in the worm era. This is incredibly trivial for manufacturers to do, and I'm hoping the majority will do it. Seriously, it's like one iptables rule that needs to be in their config.

NAT _is_ a security tool, like it or not, if you're preventing your most vulnerable devices from being directly attacked, that's a damn good security tool. Not a perfect one by any means, but a very important one for the non-expert majority of home network operators.

Legislation would only be used as a vehicle to achieve monopoly control by large tech companies who would have their lobbyists write the law. The Internet would become a true oligopoly with other uses of the wire forbidden.

The only answer is to fix the Internet to make DDOS harder and less effective. Implementing standards to block IP spoofing is a start since it would make source quench actually work.

Another not mutually exclusive answer is decentralization. DDOS works because you can use it to take down all but the largest central servers or those that don't buy protection. But if apps are decentralized, an attacker can only play whack a mole with individual endpoints to far less effect. If decentralized protocols do mobility well victims could just switch connections or their ISPs could react by rotating IPs.

> Legislation would only be used as a vehicle to achieve monopoly control by large tech companies...

Food labeling requirements haven't lead to monopoly control over food. Why would IoT labeling be different?

Don't get me wrong, I'm cynical too! The lobbyists that control our legislators with purse strings will most certainly do everything in their power to ensure any such labeling only makes things better for their corporate overlords! I just think, "what's good for corporate overlords" is actually good for everyone in this case.

I would expect VC-funded businesses to reject any such, "Requires 3rd party service to function" label since they're all about locking customers in with "network effects". I would also expect established, old-school businesses like Microsoft to reject any label that would identify a product as "open source".

...but what corporate overlord is going to object to labeling like, "Regularly updates itself"? That's something that's cheap for them to do but can be expensive for upstart competitors.

There's much to be gained and almost nothing to be lost with labeling IoT devices.

Food is a commodity. It would be very very hard to accomplish the same kind of lock-in. Lock-in is easy with software because of its brittleness.

Maybe it's a sign of the times. Maybe it's a sign that I'm old and cynical. Maybe I'm just having a bad day. But what if the IZA is the kind of predictable, "9-11" scale event that "changes everything" - meaning lets the powers-that-be rewrite the rules of the game in a way that (further) empowers them and (further) disempowers the citizenry?

How surprised would we be to hear governments uniting in response to an IZA that the answer is a new, centrally controlled and managed "internet" - because terrorists, the economy, and think of the children?

The solution is going to have to come from the network side; getting the DoSing devices automatically blackholed by routers. I know there are many technical issues with implementing something like that at scale but it seems more tractable then trying to enforce security practices on $20 web cams.

Yeah, but routers are a shitshow in and of themselves, with plenty of vulnerabilities. It's like using a sieve to plug a leak.

How can it update itself regularly without an Internet connection to a third party?

Also, "logs all connections" is tricky. Why should my fridge need a hard drive? How much space must be available, and how far back should it store logs?

Will your IoT lamp stop working if the vendor goes out of business? That's what "Requires 3rd party service to function" means.

It's not contradictory with, "Updates itself regularly".

You've got me thinking about this though... If I were selling an IoT device today I would likely just outsource the majority of the self-update problem by using an open source Linux distribution as the basis of my product and merely configure it to perform automatic updates.

The product's software could be updated via a separate software repository (e.g. like a PPA). That way it would get automatically updated at a regular interval along with the OS (assuming I put out regular updates).

This would actually be an ideal setup for consumers too because if I went out of business or my software stopped getting updates the consumer could just replace the software performing the IoT functions or merely remove it and at least be left with a functional embedded computer to hack around with.

Obviously most consumers wouldn't do that but it'd be nice to give them that option.

Replying to "logs all connections" separately...

Who said anything about logs necessitating the need for permanent storage? My router doesn't have a permanent log... It just keeps a buffer of the last N log entries in memory (e.g. `logread`).

Alternatively, I can (and have) configured it to forward its logs to a central server on my home network. Syslog forwarding and collection has been around for a really long time. It may be tricky to meet the "encrypts all network traffic" certification and syslog forwarding at the same time though since encrypted syslog normally involves a PKI.

The whole Certificate Authority concept doesn't play really well with IoT, actually.

If we want non-tech friends and relatives to buy the right things, we need to boild down to traffic light label, or something like EU energy label for score out of 8 (that manufacturers dislike, and had to be recalibrated when >50 of appliances were A rated - guess it works well too).

To me, we should have IoT devices on a different protocol not everything http(s). Nothing gets out unless you got an IoT passthrough router.

An IoT hub that shows me what devices, connections, and manages what can connect to where and when. QoS and other neat features if needed.

It'll never happen now of course, but would sure beat the current fustercluck.

Good luck with that. Most Android devices stop receiving updates after one major version upgrade. It will never, ever happen for all these extra devices. Stop dreaming.

As someone novice in network security, is there any public penetration testing tool that someone can recommend, Ideally open-sourced

Kali has a boatload of open source tools:

http://kali.org/

The original Internet was a "security disaster". The solution was not to certify every device that got connected to the Internet. Instead, we invented firewalls.

Firewalls were designed to keep bad traffic from entering LANs. For the IoT era, perhaps what we need are firewalls that keep bad traffic from exiting LANs.

> Firewalls

Sigh. Firewalls worked great for Yahoo, Sony, and LinkedIn, right?

Firewalls are just a layer. They don't even do that much!

Not only that but the average consumer knows nothing of firewalls. Do we expect Joe Average to be able to login to his router and configure a firewall to allow his refrigerator access to its security update server? Or maybe we should expect Jane Average to configure her Firewall to perform MitM attacks on SSL so traffic going to/from her IoT coffee maker can be inspected?

You are seriously under-representing the impact of firewalls on the security of the Internet. Every consumer router has a built-in firewall. They don't need to know anything about it because the default configuration works for most consumers. That's what we should be aiming for as a solution for the IoT security problem. Something that just works for most cases without configuration... much less extensive labeling with commensurate demands of technical knowledge and attention on the part of every consumer.

They are not perfect (nothing is), but a Internet without firewalls would be apocalyptically worse.

Most consumer routers have a built in firewall, yes but I've never seen one outside of my own house that's actually configured to block anything. Have you? No one configures them!

No, NAT is most decidedly not a firewall.

> perhaps what we need are firewalls that keep bad traffic from exiting LANs.

You mean like just about every firewall in existence today?

Firewalls are a horrible non-solution. The actual solution was that MS started taking security seriously after it started hurting their reputation.

This as QR-code with an app that somehow helps you out. Just a thought

My initial thought was to provide the penetration test/general security info URL as a QR Code =)

    SECURITY INFO
    <QR Code Here>
    https://some.thirdparty.org/info/ABC123456789

Something like that... Easy for anyone with a phone to scan or someone at home to enter by hand if need be.

Your username is very fitting

your first and fifth points are an oxymoron. Obviously nobody wants their dishwasher, washing machine, fridge, microwave, to put up messages, "is it okay to update now?" - can you imagine dozens of devices in people's homes doing that?

so your first point, automatically updates, implies your fifth point, administered by vendor, should be "yes". (Not "no", as you've put it.)

Further, I would like you to think more broadly about infrastructure. I think every person's home should have a local network called "shitty backdoored and malicious IoT crap". The question is how to administer that network, what its topology should be, how these devices should be able to receive information from the Internet, and in general what their capabilities should be and the way in which they should be firewalled off.

Having these devices on users' home wifi via their home router (the status quo) is obviously wrong and insufficient. I'm afraid your checklist is also, therefore, wrong and insufficient.

so, think harder at the architectural level, please. the existence of IoT stuff is obviously good. (as in, obviously there can be a benefit to devices being able to be connected - in the abstract, not based on today's very flawed infrastructural and architectural choices) the infrastructure we have for it today is obviously insufficient. I don't have a comprehensive solution in mind or anything but it is worth giving serious attention to by people who have spent years on the subject.

today, they are failing. It's not that people are ignoring their advice: they just don't have any. They've thrown up their hands and given lists like yours, which are not a comprehensive solution and are not even internally consistent. They need to think outside the box and propose completely new infrastructure.

there needs to be different infrastructure in place, not an SOP for the current infrastructure. we need better security baked into the topology and architecture of how the devices are connected.

> Obviously nobody wants their microwave to put up a message, "is it okay to update now?"

Then why are you putting it on the internet?!

Either you create devices that are secure - which may include things that neither the manufacturer or the user want to do - or you shouldn't be putting it on the internet.

> I think every person's home should have a local network called "shitty backdoored and malicious IoT crap".

Relying on border security is a terrible idea. A firewall is not an excuse to ignore host security.

Right, so with the binary choices we have today you've given a good analysis. but there are other choices when people think outside the box and experts create new infrastructure. I think we're on the same page and you see some of the same issues I do, we're not going to come up with a goood solution in this comment thread.

pretty sure we can at least agree that all IoT choices available to users and manufacturers today are hugely problematic for one or both of these parties.

> Obviously nobody wants their dishwasher, washing machine, fridge, microwave, to put up messages, "is it okay to update now?"

No, I don't expect anyone to be asked to update. I expect it to work just like Chromecast devices do: It updates in the background while in operation and applies that update at the next reboot. If idle for long enough it'll reboot itself (usually in the middle of the night when no one is expected to use it).

Self-update mechanisms aren't rocket science. In fact, there's so many FREE options to choose from at this point you can just take your pick. Don't need to code anything on your own!

I agree with you, and my point was that the list I replied to is not well put-together since we must remove the fifth requirement, that the manufacturer should not administer the device. Yes, they should. (Chromecast being an example.) so we're saying the same thing - it's just in conflict with the suggestion that manufacturers shouldn't administer devices remotely.

This doesn't solve the security issue though, it just moves it to the self update mechanism.

Lack of updates create a security issue. In fact, I'd argue that update mechanisms are the most critical security issue of our time!

By neglecting to update devices you increase risk by ensuring vulnerabilities won't get fixed. You also might not get notified in the event of product recalls (if you never registered your purchase).

I understand your argument though: By solving one security issue we're creating another: Trusting the vendor. To that I have this to say...

If you don't trust the vendor why did you buy their product in the first place!?

Lack of choices? Nearly all PCs and phones come with crapware I don't trust.

Updates cannot help against zero day vulnerability. A better solution would be not to allow anyone to connect to a device.

Sorry, that's bullshit. Automatic updates are one of the worst ideas about IoT devices, because the updates almost always remove functionality. Manufacturers have been known to remove key functionality, or just straight out brick recently sold devices when they have liability concerns or their business plan changes and they don't want people using the old devices anymore.

  - http://www.theverge.com/2016/4/4/11362928/google-nest-revolv-shutdown-smart-home-products

  - https://nest.com/support/article/Nest-Protect-Safety

* Open source: No * GPL violating: Yes * Tivoised: Yes * Backdoors: Yes

The problem is going to solve itself, just like it solves itself already. Before volumetric DDOS became widespread, no ISPs cared enough to do anything about it, the risk simply didn't worth anything to put resources into dealing with it. Today it does and many deploy some measures to quickly react and at least null route targeting IPs to minimize impact on the rest of their customer. Some IXs and large networks even provide filtering capabilities for free to filter those attacks closer to the sources and avoid sending large volumes of traffic through their networks.

So, don't worry about it.

You say that like "ISPs" are some mythical non-human entity. SOMEONE has to make that decision, and the more educated on the topic of potential threats the person making the decision is, the better the reaction time and mitigation of issues will be.

The post above was publicly broadcast in hopes that the person who makes the decision reads HN, not because it is expected that the common everyday Joe reader will do something about it.

ISPs are well aware about these kinds of problems, but don't make decisions based on potential threats. It has to become a real threat first.

Correction: it has to become a real threat to their bottom-line first. Before that, there's no business incentive to care.

The European Commission is trying to push for something like that, but I don't know if it's going to be anywhere as "strict" as what you suggest. It may be just something like C, B, A, A+, A++ ratings for security, which wouldn't be too bad, unless what's behind those ratings are really some inadequate rules.

SSL Labs' HTTPS ratings work because the developer of the test is also constantly tweaking and optimizing for current "best practices", and the ratings are not too far off from what the sites should be rated at in terms of HTTPS security.

http://www.euractiv.com/section/innovation-industry/news/com...

There is always the risk of too many standards. People doesn't know even now what all the green labels mean on the food they buy.

https://xkcd.com/927/

> People doesn't know even now what all the green labels mean on the food they buy

You don't need to know what they all mean, you only need to know what the ones you care about mean.

Reply on news.ycombinator.com