Hacker News Reader

Comment by x86_64Ubuntu | Hacker News Reader

I'm not a security expert in the least and I have never heard of this company till it folded, but I've got a question. How do they prevent someone from later acquiring the domain down the line, and then talking to these devices for malicious purposes? Do these devices expect a specific certificate, and won't communicate regardless of the domain?

View on HN

It's easy: they don't. Certificate pinning in IoT devices is pretty unlikely.

If you're lucky, some engineers added signature validation for firmware updates, but then your device is a brick because you can't do anything new with it.

A long time ago on a BaaS platform I worked on, we dealt with an IoT company that pinned certs and when we rotated them they had no way of updating their devices... I think we had to put them on their own server and just left the old cert running forever. As the sibling comment here says, "I doubt a random IoT company does stuff the proper way..."

That would be the proper way to do it. But I doubt a random IoT company does stuff the proper way...

This will inevitably happen at some point in the future. And it could be very very ugly, depending on what hardware is compromised.

There is no chance that we can count on IOT manufacturers to pin certificates or to have any motivation whatsoever to focus on security. That is up to the user. So we really need some sort of firewall / antivirus / etc. living on the user end to defend them from this.

Reply on news.ycombinator.com