Hacker News Reader

Comment by xenophonf | Hacker News Reader

It strikes me as being somewhat dangerous to compromise open network/network neutrality rules in order to kick compromised devices off the Internet, never mind the fact that it puts the cost of security vulnerabilities on end users, who can't fix them, instead of vendors, who can.

View on HN

This feels much like laws that already exist around Attractive/Public Nuisances. A compromised device DDOSing is interfering with others' right to be able to access the internet. The users themselves would in turn have much more impetus to seek remedies, legal or otherwise, to get the devices fixed because they'd then be without the ability to use devices they paid for. In a lot of ways, doing this would put more pressure on the manufacturer, because they would have much less room to wriggle out of their responsibility to ensure their device is actually usable.

Yeah and public nuisance laws are similarly problematic: selectively enforced and sometimes used to punish the victims of crimes.

It transfers the cost to vendors because their customer has an unusable product. Guess who they call first.

It's tough to defend the rights of citizens to have their internet-of-garbage devices stay online when those devices are turned into weapons of mass outage.

If we want to transfer the costs of this problem onto vendors, it seems like recalls and penalties are a more direct way to do it.

It forces the users to disconnect the devices and hopefully learn to buy more secure devices (and pressure vendors and stores, etc).

But in front of every compromised IoT device is a compromised router. Whose responsibility is that? I am going to say the majority of users down know how to update the firmware on their routers.

From the experience I have had with customer/technical support reps at cable companies for basic things like a service outage. I can't imagine them dealing with compromised devices and firmware upgrades or locating IoT devices in customer's home. I don't think they have either the staff capacity or sometimes even the technical skill to do so with any efficiency.

Then there's the potential for false positives or bad data where my connection get s null routed and I have to wait on hold for 45 minutes or an hour to talk to someone who may or many not know whats going on. Then I need to prove that there is no IoT device on my local LAN to a support person who might not even know what a mac address is. This just sounds like a mess.

in front of every compromised IoT device is a compromised router.

Why do you say that? AFAIK the devices being infected by Mirai use UPnP to expose themselves so the router probably has no responsibility for the insecurity. It would be great if we could build some sort of immune system into home routers and force IOT companies to pay for it, but that doesn't seem likely.

Short of mass-bricking these devices, any solution is going to be incredibly labor-intensive and expensive.

Sure but UPNP just opens up the outbound connection no?

A command and control connection for a botnet would still need an inbound NAT rule as would the ability to get the IoT device on the LAN in the first place compromise it right? Or am I missing something?

NATs allow outbound connections by default; UPnP opens up incoming connections.

Oh I see the UPnP IGP AddPortMapping. Do the Merkai access that UPnP profile out of the box?

My understanding of UPNP is that it allows the router itself to become a discover-able device on the network. Then the IoT device connects to the router and adds a static port mapping from the router's public IP address on a specific port to the IoT's private IP address. The NAT still works as it normally does where any packets that try to leave the network get remapped by the router seamlessly. The danger in this case is the IoT device has a listening port on your public IP address, allowing attackers to connect directly to it through your router.

Reply on news.ycombinator.com