Hacker News Reader

Comment by WalterBright | Hacker News Reader

I meant the servers being attacked. The owners of them definitely care.

As for the IoT, the appliances could have their firmware in ROM instead of flash. Then, the malmare would not survive a reboot. Many customers are large scale enough (Microsoft, Google, governments, etc.) that they can demand it of vendors and vendors will deliver. Really, how often do you desire to update the firmware on your hard drive, your USB stick, etc.?

(Another way to do it is to have the write-enable line controlled by a physical switch or jumper.)

The only thing I can figure is everyone has forgotten what ROM is.

View on HN

If there's a ROM with non-editable software it will just get instantly compromised as soon as it comes back up. For your standard "internet of things" device there is no room, physically or in the bill of materials, for things like connectors for people to physically deliver updates.

This is not a difficult problem to solve. The ROM cannot be overwritten - hence it can be designed so that malware cannot run.

Also, jumpers are cheap. Just set the jumper to enable writes, and download the update.

Are you happy with it being unknowable which of your appliances are compromised or not? Would you pay $1 more for a disk drive with firmware in ROM? I would. If you were running a banking system, would you pay extra for code in ROM that cannot be compromised?

You would. But you're not the market - 99.99% of other people, who don't even know what a "jumper" is, are the market. So your preferences don't matter. Yes, even in most technology products.

As for IoT devices, I can't imagine average Joe or Jane prying off their smart whatever, destroying the pretty plastic casing it's hidden in, and manually setting jumpers to flash firmware.

Isn't it ironic that the means of updating firmware to prevent installation of malware is the vector for installing malware?

I don't think the current scheme is working very well. Even worse, there is no way to tell if your appliance has been compromised or not. There are a lot of companies that care whether their machines are infected or not.

What happens when you can't update the IoT device then, reboot may remove the attacker but the IP will be the same (and even if it changes, probably wouldn't be long before the next address is scanned and put back into being a zombie) and they would be right back in if you can't update and patch the flaw that let them in.

I think in all honesty the regulation sounds best, requiring the router makers to disable features such as UPNP would prevent massive attacks like these.

The Mirai botnet didn't write it's software into permanent storage on the hacked devices - it would be erased upon reboot.

But then the device would be 'hacked' again within minutes of it coming back online.

Then just modify the Mirai source to disable internet access and isolate the devices instead? It's already public.

Reply on news.ycombinator.com