Comment by lazaroclapp | Hacker News Reader

Comment by lazaroclapp | Hacker News Reader

Parent Full thread

Well, probably it will be a security nightmare for a while, until the sheer weight of vulnerabilities and incidents causes vendors to radically change their security practices, regulation or not. I think a good example of what I would expect to happen is by analogy to the PC internet of the 90's, where Windows 9X viruses and worms were just a fact of life when using computers, and every email inbox was 95% spam each time you opened it. Remember that what is now considered basic security practices (UAC, https, "Are you sure you want to run this exe?") were at the time considered hardcore security measures that only enterprise systems needed to care about.

The difference is that now more of our daily lives depend on the internet being reliable, and, that some IoT device's failure mode might involve a cost in human lives. But the fact that the incidents are going to be worse will also probably put more pressure on companies to fix their security. Regrettably, I don't think this will actually happen until some startup's fancy new IoT gadget gets hacked in a way that causes it to kill a few hundred people and the resulting lawsuits end the company.

>ntil the sheer weight of vulnerabilities and incidents causes vendors to radically change their security practices

I've been in the professional IT game for 15 years. The "please run this macro in word to view content" issue still exists today and is one of the main vectors in ransomware. Heck, the "click this to view my photos" 'sexy-pics.exe' problem has not been solved in Windows either. End users don't care about UAC pop-ups, they click through them. See the recent literature on "Security Fatigue."

I think you have way too much faith in the industry to fix its own problems. Its clear that there are many classes of security problems that remain unfixed for decades. We're just seeing the newest version of the very same problems we've failed to address in the past.

I have no idea what the solution here is, but I imagine some level of certification is needed. Perhaps as simple as validating that you're forced to change the default password/keys and auto-update for security updates is on by default with some level of commitment to perform security updates for x amount of years after purchase. Toss in mandatory fail2ban-like functionality and you've patched the most common exploit use cases. I imagine that's a fairly hands-off approach here that won't interrupt business and will cost very little to implement.

On the end-user side of things, having a router that can detect when you're part of a botnet/DDOS and stop traffic would be valuable. Why aren't these $200+ Netgears and Linksys's running any sort of IPS? No IPS in this day and age is pretty crazy. An implementation of snort or similar wouldn't eat too much CPU and would only raise the cost marginally.

Its still very much the wild west out there from a security perspective.

You're suggesting to put a ("snort or similar") IPS console in front of the end-user who still clicks on the "click this to view my photos" sexy-pics.exe?

In my opinion, the end-user is not the one causing the problem. The manufacturer is causing the problem and -- just like we do things at $work -- he who causes the problems (should be the one who) suffers by being the one to also fix it.

The real solution for end users will be to add an actual physically different input path for the problem.

For example, imagine if home PCs and even laptops, had a special (macro) SD card like slot. This is the slot that the user put in their ownership card to get it to turn on at all, to log in to their OS account.

The computer would REFUSE to continue to operate with this card present. It would then enter 'normal mode'.

In normal mode no OS updates would process, no programs could be installed, no new scripts / downloads could be run. Trying to run a new thing would bring up the Authentication Required screen. They would need to insert the ownership card again. They would then need to expressly authorize what the new program could do.

That's the experience that end users for an appliance might desire; at least once they got used to it. I also strongly require that the end user is also the //owner// of the hardware. Not whoever made the OS/etc. All of the above controls would be in software, which could be replaced if they decided.

The problem is the IoT devices don't harm their owners or the company that built them but rather other targets on the internet.

It's probably not a great idea, but how about legalizing hacking for self-defense? If you get DoSed then those devices, are fair game.

That would shift incentives back to the owners to some extent, since they're basically acceptable targets as long as their devices are insecure.

I'm not sure how that would help the problem. When you're talking about thousands or more devices, counterattacking them individually wouldn't be feasible.

Also I imagine many botnet owners secure the devices they take over so that others can't steal them for their own botnet.

This comment shows the disconnect between many comments I read on this forum[0] and the real world, frankly.

Whenever Apple or Samsung release an update for their smartphones, I have a to help family members click through dialogs to install them. How are they supposed to assess and implement security for an IP camera they bought at a department store?

How would they do it anyway? Is the expectation that they fire up Wireshark, identify traffic flows to and from their device, then configure the firewall on their consumer-grade router to limit this traffic?

[0] previously read just '... disconnect between this forum ...'

Please don't generalize from a single comment to "this forum". You're painting thousands of people with a very broad brush.

Fair point, have updated my comment.

This is a Bad Idea, because you have no way of knowing whether the devices you are "counter-hacking" are simple IoT devices or if they perform a critical function of some sort. The last thing you want to do is accidentally take offline/brick an Internet-connected medical device or computer at a hospital ER room, for instance, since it might literally result in someone's death.

That sounds like a "but think of the children" argument to me. We can conjure up ways how anything can go wrong.

But should we really worry about that scenario? If you have internet-exploitable and already-exploited devices in the ER room, haven't the horses left the barn already?

Provided they continue to function as expected and aren't harming the network they're a part of. Both are big assumptions.

Stolen IoT data is the perfect way to case a house. That's a market waiting to happen.

Do people still case houses? I know at least in my area burglaries are waaaaaay down because unloading the stuff inside is basically impossible. The few remaining burglaries are essentially smash the door run in and grab any loose cash, unlocked guns or jewelry and run out. To pull that off it seems easier to do it the old fashioned way, by ringing the door bell.

I'd be much more worried about identity theft & credit card theft with IoT devices than physical theft.

Those are the burglars who aren't able to peer inside multiple homes via xbox cameras.

Yes, it really is amazing to look back at the slating UAC got when it was released under Vista.

And I _still_ have to disable it on every Windows machine so I can modify things in Program Files without jumping through hoops.

Why are you modifying things in Program Files? Are you using very old software that expects the user to modify that?

Reverse engineering, mostly.

Reply on news.ycombinator.com