Hacker News Reader

Comment by Groxx | Hacker News Reader

A quote from not the current worm's author, but the author of the worm that may be the inspiration for the current one:

>The BrickerBot author argued that it would be better if the devices were destroyed, rather than sit around as cannon fodder for DDoS botnets, and haunting the internet for years.

... yea, broadly I'd agree. IoT vendors are causing a tragedy of the commons, inflicting quite a lot of damage without feeling any of the pain because it hits others.

It's the sort of thing that should be addressed by legislation of some kind, but absent that (which includes nearly all international cases)... what else can you do to stop the worst offenders?

View on HN

In Europe the we have the laws that protect consumer rights.

The thing missing is somebody to define that severe security vulnerability is considered as a defect in the product. Once this is done, consumers can either demand the seller to fix the problem, replace product or give refund. This should pretty quickly create a financial incentive to sell products which get updates.

This would be a huge improvement for made-and-sold-in-Europe, and would at least make a sizable dent... but the rest of the internet still exists, and doesn't care where the botnet devices are made or installed, only that they exist.

Still, yea, this is exactly the kind of thing that needs to become commonplace. Hopefully it will be, though this is far from the first time that something like this has happened and here we still are.

You have to start somewhere. See also: GDPR - it's already made enough waves that other nations and even some US states are considering similar legislation.

What are your experiences of acquiring information in Poland under GDPR, especially if you were either denied or came across any hurdles in exercising your rights; whether or not the subsequent disclosure was to your satisfaction?

I'm not temporal, but haven't had many bad experiences that I chased up. I didn't request some data from Revolut that they didn't provide, but I didn't email their compliance officer to request it. I think they would have provided it if I had.

Still, even just the fact that companies are now thinking about this and providing ways to download/delete your data makes me love the GDPR.

I haven't pursued any GDPR requests yet (though I considered it in some cases). For now, I'm just happily reaping benefits, such as having an option to download my data, or discovering that some off-line desktop games (like Kerbal Space Program, of all things!) did track me - past May 25, 2018, they suddenly started showing popups informing about this, and (this is the best part) I could deny it and keep playing.

A lot of companies want to sell world wide. It is a lot easier to have and support one product for the world than multiple products for each country. I have to regularly attend training which amounts to "Australian customers really want this product but we are still working on getting certification so be careful not to ship one accidentally. (It is a radio transmitter)

You can't wave a magic wand and harmonize radio frequency allocations -- they're different and change slowly.

Powerful countries have the ability to apply their law extrateritorially, especially law concerning companies... e.g. UK stipulates that bribery is illegal everywhere in the world, so a UK company employing people in China and those Chinese employees bribing Chinese officials is illegal (in the UK), so the UK parent company could be responsible...

Easy to do the same thing here, as long as the company has (and wants to keep having) presence in the EU that's enough to enforce standards worldwide.

On second thought.. It might be the law already covers this.

It would be just the question of somebody testing it. Take a relatively new() device with unpatched security hole, try to get it replaced/refunded and if necessary proceed to court to get a decision on the matter.

Although I wonder if any vendor actually wants to go to court arguing that a product with severe security issue is actually working as intended.

() Safe bet should be a device purchased less than 2 years ago, since that seems to be the time the vendor is at least responsible for defects.

Speaking EU/Germany-centric, the problem with suing a company is that the company can always make the case go away by replacing the faulty product with either a repaired product, a very similar product of equal or greater worth or refunding a customer for the product and any losses incurred. A court will readily accept this even if the plaintiff customer might not want to accept it. And it's better to just silence a single suit this way (or a few) than to get a sentence against you on the books that will encourage everybody else to demand replacements or even sue too.

Exactly. I've returned products due to firmware problems in the past, although they were not security related. In one case I was asked to give a written description of the problem before I got a refund. The other store returned the money without questions. It's not really any different from a product that broke under warranty in my experience.

> This should pretty quickly create a financial incentive to sell products which get updates.

Or an incentive not to sell in Europe.

Speaking as a European (for the time being at least) that is fine by me. If a company makes unsafe rubbish, they can feel free to not try to sell it to me. I'm sure someone else will happily take their place.

Of course that doesn't fix the global problem.

As an American I'm completely offended. I demand other people pay the price so I can fulfill all my wants and desires.

... at the lowest possible price!

What would be really nice is if a worm like this patched the crappy security of those IoT devices, but I guess that's too hard. With the question being either bricking them or allowing them to become part of a botnet, I guess the world might indeed be better off with vulnerable IoT devices getting bricked. But boy, it's really a marginally lesser evil.

Let's hope this forces manufacturers to improve their security. That's the main good that needs to come out of this.

Worms that patch with better security have been a thing before: https://en.wikipedia.org/wiki/Computer_worm#Worms_with_good_...

They have generally had mixed success, from the ones I've read about. Pretty often there are side effects that aren't good (e.g. bricking some devices, excess traffic due to being too successful, that kind of thing)

But yea, in this case I think it's clearly too complex. There are thousands of different things hooked up to the internet, and you can't fix all of them at once.

Patching is just a subsidy for the manufacturer. This malware just soft-bricks (the device can be restored by reinstalling the firmware), so it inflicts a cost without generating extra garbage. Sounds great to me.

With the risk that the owner just throws it out and buys a new one. Possibly even from the same manufacturer.

From that perspective, would the vendors even be motivated to fix it? Hmmm...

When the 2nd device bricks within a week then yeah, the online shitstorm would engulf them.

Looking at the MTD commands it runs (assuming the ones in the article weren't faked) -- on some hardware it'll clobber the bootloader.

You'd need a JTAG cable and a fresh firmware image to fix that. Hardly something within the reach of a typical home user.

How many people are going to be capable of reinstalling the firmware? I can tell you 99% of the people I know are just going to junk it.

These things would be most positive if they were more common, so a vulnerable device would get bricked while it's still in the store return period, and people would just take it back.

If they wait too long, then the result is more sales, which increases profit for the whole ecosystem that produces these devices. But if it's more common and results in returns and exchanges, the result is less profit, which might finally put some pressure where it needs to be.

The attack that crippled Akamai DNS a few years ago actually did close up security holes, though only to cement the attacker more firmly in place and keep other attackers out.

>IoT vendors are causing a tragedy of the commons, inflicting quite a lot of damage

It's an interesting problem in that the value of hackale/wormable IoT devices stems from their sheer number. In a way the culpability of any singular vendor for any singular sale is low by and of itself; it's only large in aggregate of all the vendors' products ever sold & still deployed.

This is a reverse of, but comparable to, the low value of personal data being gathered&processed (or stolen) - for every singular individual, the value/loss is exceedingly low. The value lies in the aggregate of the data; the whole is much more than the sum of its parts. Thus the prosecution of things like the Equifax hack, or the insecure IoT devices is pretty spotty at best.

Perhaps we need a new, specialized legislation & judiciary for cases where network effects dominate.

There aren't many "network effects" (the business term) in IoT, despite vendors' best efforts. The value of the network to the user does not increase with the number of nodes in the network.

That said, I agree there's a sort-of similar pattern here, which I feel underlies many of the biggest problems of our era - including climate change. The pattern is that there's a lot of entities - individual, small and large companies - engaging in transactions, and each transaction has a small negative - some personal data stolen here, some toaster joining the botnet there, some trivial amount of carbon emitted elsewhere. The negatives however add up, and ultimately manifest as huge and international problems.

We definitely need to develop legislative methods that would combat this pattern at the structural level, regardless of the business domain it shows itself in.

That's an interesting perspective. It brings to light some personal responsibility we might be glossing over. Is it the responsibility of the bottled water seller to not sell plastic bottles because they fill landfills, or the consumer to make sure to dispose of the plastic bottle responsibly?

That doesn't entirely match the current situation, but there probably is a some responsibility that lays with consumers for buying crappy devices from companies with no track record for keeping them updated. It's not always simple to reason about, but it is something to consider next time there's a decision to buy some cheaper device from some no name company or from some well known company (that hopefully has some sort of support lifetime at least).

I don't think it's ever acceptable to make an "if I didn't do it, someone else may have done something worse" defense.

Which is part of what causes tragedies of the commons, yes. I totally get your point, and it's valid, but it's being demonstrated right now that the current appropriate strategies have failed rather spectacularly.

When appropriate measures have massively failed, what are the alternatives? Vigilante actions are one option, as is "watch the whole thing burn down", and probably an infinite variety of stuff in the middle and along different axes. What's your preferred option?

edit: also, it's not quite "may [do] something worse". Insecure IoT things are used as botnets. Frequently. It's not a hypothetical threat at all, it's just a question of scale / frequency.

I see like a food safety inspector going around shutting down unsafe restaurants. These IoT devices are a danger to society and should be shut down.

DDoSes are as bad as food poisoning now?

When it causes millions of dollars of damage... Yeah. Sure. Why not? https://www.zdnet.com/article/the-average-ddos-attack-cost-f...

You measure your health in dollars? I dare say you won't find much common ground with most people.

You'll find it in tons of large-scale (e.g. governmental) decisions at the very least. "is it worth more to prevent X than to deal with the fallout" is a decision that has to be made at some point, and human life / injury are part of that equation.

So, in a way, yes. I do. So do lots of people when they go to urgent care rather than the ER, knowing that the ER could bankrupt them, and they'd rather risk the delay. I don't have numbers off the top of my head, but I don't think it's as uncommon as you seem to think it is.

What if you work in a job where you're paid by the hour and need to take time off due to illness?

I daresay that this situation even applies to "most people", or at least a very sizeable proportion of the global workforce.

Never seen the "meat chart" for folks injured in the US have you ?

You are priced per body part based on your income. Your health is most certainly defined in dollars.

The most critical part of my point was the subject(s) performing the pricing, which you guys are somehow completely dodging here.

Most people have wildly inconsistent treatment of health risks and are largely reactionary. Not sure they are a good basis for determining what is ethical/moral actions.

More like an unlicensed vigilante "food inspector" going round restaurants and burning them down on sight of a cockroach.

Soft-bricking is hardly comparable to burning something down. More like adding an extra lock and throwing away the key. Inconvenient, but not destructive.

To you as a domain expert, yes. A typical user just tosses the device into the trashcan. For him it’s effectively bricked.

In a society where people refuse to have food inspectors and some are being harmed by food poisoning, I think one could argue that there isn't something wrong with that level of action.

I think it's more like firearms. These devices can be and are used as weapons to hurt 3rd parties on the Internet. It's more like firearm owners leaving their weapons in front of their barely-sturdy windows. Then, folks needing weapons keep breaking the windows before firing them at others. The homeowners and homebuilders keep letting it happen.

So, vigilantees concerned about damage to innocent people keep breaking into the windows, stealing the guns, unloading them, and tossing them into landfills. I'd be like: "Stop putting your guns in front of the windows. Be a responsible gun owner." Enough broken windows and stolen guns might incentivize them to do that.

Food safety inspectors have an official remit to do this that is enshrined in statues and local laws. You don't get to just decide for yourself you will shut down some restaurants on a freelance basis.

That's a misleading representation of the defense. "If I didn't do it, they would eventually have become a public nuisance in the form of nodes in a botnet" captures the supposed intent more fairly, and with the intent to target every known vector used by Mirai and Qbot it seems quite realistic that these systems would eventually become botnet nodes.

It's IMO somewhat comparable to culling high-risk farm animals to prevent widespread disease outbreaks.

Okay, I accept your analogy.

Where do you have legal authority to do a vigilante culling of your neighbor’s herd, because you decided something about them merited it?

There is a dead reply to this which I think asks a fair question.

> Where do you have legal authority to do a vigilante culling of your neighbor’s herd, because you decided something about them merited it?

I am not making the argument that this is legally defensible. You can by definition not have legal authority to engage in vigilantism. It's from an ethical and practical perspective that I draw the analogy.

On the matter of legality, the difference you point out applies, but also goes both ways. There is no legal framework around "culling" insecure devices, and very little regulation.

Reply on news.ycombinator.com