Hacker News Reader

Comment by cm2187 | Hacker News Reader

In a way it is a bit unfair to IoT manufacturers. The problem is that to make something secure today, you need to be a network protocol specialist, a linux specialist, an expert cryptographer, etc. And guess who are IoT designers? Either a low level technician in a big western company or a guy hacking stuff together on the side of a factory floor in China.

To me it is unreasonable to ever expect that all of them will be linux specialists, expert cryptographers, network specialists, etc.

Fundamentally we are at the convergence of software and hardware, but the software is too complicated, give people too many ways to shoot themselves in the foot.

I'd argue we need better software, not IoT manufacturers sinking ressources in hundreds of unrelated expertises.

View on HN

We're reaching a point where it really doesn't matter why a given company isn't capable of making a bulletproof software addition to their hardware. When cars were giant steel death traps, car safety standards improved. You probably couldn't sell most 50's era cars today because of it.

Similarly, I don't think it's unreasonable to hold IoT manufacturers accountable for releasing blatant security vulnerabilities into the wild (like that webcam that DDoS'd all those sites).

This isn't an "aww, growing pains" kinda moment of care for the poor budding IoT industry. They need to realize that they must be held accountable.

Edit: "bulletproof" isn't even what's being asked, but putting some thought into the security of their IoT devices is something we must demand of manufacturers

Honestly, my biggest objection is that there's so much nearly pointless IoT stuff out there.

If a product desperately needs network connectivity, but is still prohibitively expensive to secure, I'm sympathetic. (Not forgiving, mind, but I understand the difficulty.) But when you're releasing a wifi teakettle, or a networked lightswitch that's talking to one other switch 5 feet away? At that point I think there's basically no excuse at all. Teakettles work great as is, adding insecure network support creates a product substantially worse than one without any software at all.

More theoretically, I can imagine an IoT product so good that they should just pay for the externalities they cause and keep manufacturing. But most insecure products out there today are creating far more externality than value, and wouldn't exist if they had to deal with the harm they cause.

Ring stored WiFi credentials in plaintext on their video doorbells -- would you say it requires a cryptographer, a network specialist and an embedded device expert to know that was a terrible move for a home security device you can walk up and physically rip off the outside of someone's house?

IoT manufacturers don't have to contract Linus Torvald to review their code, but it's entirely reasonable to expect IoT manufacturers to use existing best practices to secure these products.

I would say, based on my experience that indeed it does require some level of specialization which most don't have today. I'm fighting with an IoT manufacturer right now because they ship the same root private key on every one of their devices. This is a pretty simple concept to understand:

"Are all your device privates derived from the same key? Do you ask your users to install your public root to get past security warnings?"

Yet they clearly don't understand PKI 101 and think what they are doing is completely appropriate because they are "following standards" while of course missing the bigger picture entirely.

Yeah, these are not subtle embedded-systems bugs were talking about. These are frequently things that would make any halfway-experienced programmer or sysadmin refuse a release. If your security failure gets revealed and the entire software industry screams "what were you thinking?!", you don't get to plead that finding the bug was too tricky and complex.

Hell, the Ring issue wouldn't even require one direct employee to avoid. You could solve that in a 30 minute call to an "is this obviously terrible?" hotline.

Yes. It is completely unreasonable to expect that manufacturers of cheap electronics will implement security solutions on their own for their 20$ home routers, IP cameras etc. Even huge, international companies' failing security doesn't surprise anyone and newly discovered vulnerabilities are common news. Sure, you can ban importing all connected devices that are not certified by some strict security standard, but that would probably rise prices more than users, accustomed to cheap electronics, would want to pay. And how bans on commodity goods work we know pretty well from "war on drugs"..

The only realistic solution I can think of is creation of the open communication and security protocols with easily available standard libraries. A good example is HTTPS, which is far from perfect now, but is common today thanks to TLS and OpenSSL. We need something like Linux kernel - free, widespread, well understood, easy to port and use. Few big companies could make it work, but the problem is that there's not much money in creating open protocols and FOSS libraries. Maybe some IoT orientated Linux kernel branch with minimal set of functionality, safer of out-of-box configuration and basic security solutions preinstalled?

OpenEmbedded/Yocto is one such Linux "distro", https://www.yoctoproject.org/ecosystem/iot

There is also the open-source Zephyr RTOS for IoT, of Intel WindRiver lineage, under Linux Foundation governance, https://www.zephyrproject.org

Edit: See http://mender.io for OTA updates (open-source client and server). If IoT device vendors separate their application code from the base operating system, e.g. via containers or virtualization, it may be possible for a vendor-authorized subscription service (like Mender) to deliver OTA updates for security-critical components.

I have used OpenEmbedded/Yocto, but it pretty much falls under "roll your own solution" category. I know there are many projects and papers written that try to address IoT security, but there's no clear leaders yet. Making hardware projects might span to few years, you can't simply grab something from GitHub, base your project on it and risk it going out of existence in few months.

This is giving too much credit to IoT manufacturers as posing it as too difficult. Truth is, in most cases absolutely nothing is done to keep them secure (quite the opposite).

To drive a car or keep people's Credit Card information you need certain certification. What makes no sense for me is to assume that keeping kids records on a public DB because someone has no clue on what they are doing is reasonable (for example). Or that needing an internet connection for turning off your heater is reasonable.

We need to understand IoT is not a toy, we should require certification, fines or both.

I don't think this is a fair assessment.

When I got to make a website, I don't say I can't make it secure because I can't afford to be an expert in security at every level of the OSI. I say I'm not an expert in every level of the OSI so I rely on accepted best practices and community standards to make my site secure.

I don't replace HTTPS with my own standard because I can't afford to make an adequate and secure replacement. If IoT makers can't make their own custom solutions secure then they need to build their devices out of standardized pieces that are secure.

"they need to build their devices out of standardized pieces that are secure."

That's exactly the problem with IoT-- there's no standard, out-of-box solutions right now. Try to google for "IoT security": you will find a bunch of (mostly proprietary) competing solutions with no clear leaders among them. See my other comment on this thread, were I've provided HTTPS as an example for IoT ecosystem. I'm an experienced embedded developer and most often, when it comes to security, I still have resort back to "invent my own" security solution, because I can't find anything that fits project needs.

afaict you can't use HTTPS in any reasonable way with IoT. There are no solutions that don't cost $$$$$$$+

note: I know you were not suggesting HTTPS as a solution only as an example of a standard used other places. I'm only pointing it out as another example of an issue IoT has which is lack of solutions .

Why do you need to spend money to use HTTPS with IoT?

how do you get a cert for each device? let's encrypt limits the number of certs per domain (that includes sub domains). so unless you expect users to get their own domains for their IoT devices they can't get a free cert based on user unique subdomains you provide.

The only solution I know of is Plex's solution which was to partner with a CA for $$$$$$

https://blog.filippo.io/how-plex-is-doing-https-for-all-its-...

>> when it comes to security, I still have resort back to "invent my own" security solution

What's wrong with using the mbed security stack as a standard for mcu's ?

This is the same reason why all the software on "Smart TVs" and digital picture frames and net-connected refrigerators and in-car navigation systems all SUCK. They're made by hardware companies, not software companies. I've worked for mostly hardware companies in my career, and most of them just don't grok software. Most hardware companies see software as just some line item on the BOM, equivalent to a bolt or bracket, that just needs to be delivered with the product somehow. Nobody cares if it is secure, or if the UI is fast, or if the fonts look good. They just need to check off that line item somehow so they can ship the product.

Try to find a piece of hardware in your home that was not built by a software company where the software is even close to decent.

> In a way it is a bit unfair to IoT manufacturers. The problem is that to make something secure today, you need to be a network protocol specialist, a linux specialist, an expert cryptographer, etc.

Sorry, but this is complete and utter nonsense.

Nobody is asking IoT manufacturers to provide perfect security. It's about the absolute minimum basics. There's one single security mechanism that's totally obvious that would have completely prevented the whole Mirai botnet: Don't use default passwords. It's not too much to ask for that.

> The problem is that to make something secure today, you need to be a network protocol specialist, a linux specialist, an expert cryptographer, etc.

A self-updating debian install with a unique random password you deliver in a piece of paper inside the box should be enough.

If it isn't then there's something very odd with the legal processes, as your team of experts wouldn't be able to deliver it either.

thats not entirely true.

i built a system that other people will be able to use to secure their IoT products; in fact, if you can write a simple arduino sketch, you can secure it very quickly

http://ardiri.com/blog/stockholm_terror_attack_how_iot_could...

Reply on news.ycombinator.com