Barbara,
On 04/11/2016 04:00, STARK, BARBARA H wrote:
>>> I could be wrong, but I believe that Dyn was DDoSed by the Mirai
>>> botnet, which propagates by exploiting devices configured with default
>> credentials.
>>> This has nothing to do with outdated firmwares.
>>
>> The problem is that you cannot realistically update those firmwares.
>
> Many companies provide devices that do automated updates. It's totally
> realistic to update firmwares.
Not always. My CE can't be updated any more, I think because its flash memory
is too small
for recent versions. And I had the same experience a few years ago with a
previous CE. Not to
mention that most vendors simply stop supporting old hardware after a few
years. Also
as Juliusz pointed out, if the device was shipped with user admin, password
admin and the
user (being a normal citizen) doesn't change it, any amount of new vendor
firmware won't
fix it.
Yes, I agree it's possible to do better, but what's the incentive for a
bottom-feeding vendor
of cheap devices to bother?
Regards
Brian
> There exist various methods, tools and best practices. The problem is that
> some manufacturers don't bother to make their
devices upgradable. By not having to maintain the firmware of shipped devices,
the devices can be sold very inexpensively. So
price-conscious consumers will buy them, instead of the more expensive,
well-maintained devices.
>
>> It is trivial to compile a new firmware for those devices that doesn't
>> request
>> upnp to open ports to telnet or ssh. But is is impossible to deploy such an
>> update.
>
> I can't speak for others, but DIRECTV set-top-boxes all do auto update, as do
> Digital Life IoT devices, and U-verse residential gateways. I think iControl
> IoT devices do, too. So, no, it's not impossible. It's just cheaper and
> requires less skill and effort to create devices that can't be updated. The
> exploited vulnerabilities (in the Dyn attack) have been known for years, and
> fixes have been available for years. Even after they were known, new units
> were still shipping with the vulnerability. Secure methods for updating
> devices and best practices for using these methods have existed for years. If
> the device manufacturer had built in a mechanism to allow for secure,
> automated updates (and not hard-coded a default password for access to all
> devices that couldn't even be changed by firmware update), and had made
> updates available in a timely manner, there wouldn't have been vast numbers
> of devices to exploit.
>
>> For consumer electronics, we cannot rely on consumers to actually download
>> and install new firmware. So part of the solution to securing those devices
>> has to be that (out of the box) they will update automatically.
>
> +1
>
>> For the same reason, having lots of devices on the internet that have been
>> abandoned by the vendor is also a huge security risk. So ideally those
>> devices
>> should shutdown automatically.
>
> Which means the vendor would still be responsible for building in a remote
> "kill switch". Ideally, manufacturers would be required to warn consumers
> prior to purchase that the device will be bricked (or maybe just have all IP
> connectivity disabled) if it is ever discovered to have an easily exploitable
> vulnerability.
>
>> Note that PCs, browsers, etc. are now somewhat secure because they
>> update automatically. We need to do the same with all other devices
>> connected to the internet.
>
> +1
>
> Barbara
>
> _______________________________________________
> homenet mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/homenet
>
_______________________________________________
homenet mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/homenet
