Hacker News Reader

Comment by phonon | Hacker News Reader

Underwriter's Laboratories should start including basic security hardening in their tests.

Vulnerabilities can be surprisingly hard to find: http://mjg59.dreamwidth.org/45098.html

(Matthew is an absolute expert at breaking into cheap IoT devices)

But with this particular vulnerability, e.g. weak passwords and no way to reset it, I would think that UL could in fact test for this and fail the device.

I like the idea of UL testing for at least basic security vulnerabilities.

I think you mean testing for basic security best practices. Testing for vulnerabilities is the hard part, but having good practices is easier to test (e.g. is it a vulnerability or a feature it can't reset?).

They should be hard to find. Basic UL testing could establish that the most common problems are at least tested for.

I the small electronics market, price is everything. Thus any compliance that raises costs is likely to be routed around, especially by Chinese companies. Do most products coming from China even get UL listed?

Many distributors won't stock products that are not UL listed.

Who needs a distributor when you have China Post?

I doubt millions of IP security cameras were bought off eBay or Alibaba. We're talking more like "Will Walmart stock it"?

I wouldn't make the perfect the enemy of the good. It could start off with just a checklist of common vulnerability types and go from there. The root cause of these issues is that no one cared about them at all. Just the idea that a certifying agency you are going through anyway will be checking would help enormously.

I mean just a couple days ago on the front page we read about a Paypal multifactor bypass by.... Wait for it... Deleting the token field from the post request.

Vulnerabilities are often trivial in hindsight and lost in a massive forest up until the moment they are serendipitously discovered.

I'm not saying a proper audit shouldn't have found this and flagged it. But yes, agree strongly, vulnerabilities can be surprisingly hard to find.

I completely agree with his sentiment. While it certainly won't catch all vulnerabilities, it should at least catch the more obvious and easily exploitable ones. And it concentrates the skills required in an entity that has a business model that can sustain it.

I see it as analogous to FCC certification of RF related equipment.

The logical answer to this, which is what we're seeing in the US, is to tie every device to the corporate backend servers.

This does a few things.

1. Secures endpoints down 2. Chains users to company 3. Makes cloners hard to copy product, given server based logic

Hell, Google and Microsoft can't even bother to keep up products or their DRM up for any length of time. But again, users are willing to rent chained devices like the Nest.

That's not going to work--we just had the discovery of a major vulnerability in Linux that has been around for years but got patched last week! It is what it is.

Regulating IoT is going to be impossible when tiny little devices can be shipped undeclared. Even if it could be policed effectively it would destroy the economics of some of these cheaper devices.

Instead, how about ISP supplied modems/routers have sensible defaults(and have the admin password reset)?

Much more cost effective.

Reply on news.ycombinator.com