Disaster awaits if we don't secure IoT now

Of course we should secure IoT, but the article is about one very particular kind of security: roots of trust. The idea is that devices shouldn't run unsigned software, so forget about custom firmwares, and generally owning the hardware.

There is a workaround, sometimes called "user override", where the owners can set their own root-of-trust so that they can install custom software. It may involves some physical action, like pushing a switch, so that it cannot be done remotely by a hacker. But the article doesn't mention that, in fact, it especially mentions that the manufacturer (not the user) is to be trusted and an appropriate response is to reset the device, making it completely unusable for the user. Note that such behavior is considered unacceptable by GPLv3.

There are some cases where it is appropriate, GPLv3 makes a distinction between hardware sold to businesses and "User Products", and I think that's fair. You probably don't want people to tinker with things like credit card terminals. But the article makes no such distinction, even implying that consumer goods are to be included.

Talk about the worst corporate doublespeak - 'trusted computing'.

It also goes by DRM, or rental hardware, or you never actually own it cause someone else retains permanent digital control.

There is NO trust here, only control and power in never actually selling anything.

And since we're talking of IoT, this goes hand in hand with proprietary corporate clouds, anti-FLOSS like Home Assistant, rental in the form of sales, forced firmware upgrades that remove previous features to gatekeep and resell what you promised.

I don't even need to read further. Anybody, and I do mean anybody, who uses the moniker 'Trusted Computing', should be ignored, blackballed, and relegated to the bin of computing.

Even in the industrial space, it's simply not going to happen given the costs of securing wrt the business value and relative risk aside from projects that have some sort of community/municipal/national "critical infrastructure" domain (think power generation) where a legitimate business case (think in terms of MARR https://en.wikipedia.org/wiki/Minimum_acceptable_rate_of_ret... ) can be made for safety and/or regulatory compliance future-proofing and a source of cheap 3rd party (usually government) capital is made available.

There are also huge legacy IoT investments in capital inefficient low-margin businesses (think mining and ship-building) where this sort of "maintenance" and retroactively applying "defense in depth" makes little sense compared to wholesale generational migration.

Nobody is going to do it until there's some sort of abrupt forced exigent existential externality applied to the entire industry (e.g. ozone layer depletion and refrigerants) and then they'll be a single mass-migration.

The only long term viable approach for IoT security is to not allow these devices on the Internet in the first place. Have the WiFi Access Point, or some other gateway, act as the broker for all information, and the default is each device sees nothing until given permission. *

Whenever this comes up people raise the point that this won't work because it disincentivizes making devices to slurp data, but it's not like that ecosystem actually exists at all, with the exception of smart TV which hardly counts as IoT. Consumer IoT hasn't taken off because consumers are rightly paranoid about bait-and-switch and being left with useless devices in the walls of their homes.

* This is roughly what https://github.com/atomirex/umbrella is trying to head towards, hence seeing if a $50 AP can act as a media SFU, and learning it totally can.

Adding to this that the scale requirements for implementing these standards varies by about 10 orders of magnitude between the smallest and largest companies, which is such a large scale difference that it becomes qualitative with respect to standards.

This creates divergent incentives. Many companies want to optimize standards for the cheapest thing that will check a box, even if the implementation is ineffective in practice. The minority of companies that actually care about robust and efficient implementation often find this isn’t feasible (and in some cases impossible) within the constraints of what ends up in many of these standards, so they ignore the standards since they are strictly worse than whatever non-standard thing they end up doing.

Wash, rinse, repeat. I have participated in IIoT standardization efforts for almost two decades and it is the same vicious cycle irreconcilable requirements every time.

However, by career I deal with a lot of embedded devices. Embedded is where the hell begins. Embedded plus standards is pretty bad. SCADA and others. Embedded plus standards plus vendors .. now you are doomed. The half-assedness of embedded systems security is worse than any normal coder can imagine.

Basically the IIOT domain is the one place that remains where network segmentation and encirclement and so on are the only things we have that work. The worst best option.

I'm not even being sarcastic. Most of them aren't that hard to hack now as it is; I know a guy who broke at least two devices in under an hour each because that's how bad they are. A piece of junk that goes out today that maybe still flies under the radar and nobody bothers to hack it isn't going to fly under the radar in a world where there's 10, 20, 50 times more "software engineering" power in the world, in the hands of a lot more people. In 5 years those things are going to be a nightmare for their owners, for their manufacturers, for all kinds of people.

We have Boeing-level incidents daily, except that it can be swept under.

Yes, actually. I also want the groceries delivered to my door using the services and stores of my choice depending on the items and prices, and for it to integrate seamlessly with my Home Assistant instance without any funny business regarding the API or needing to install yet another bullshit app I didn't ask for.

This is the real reason we don't have nice things. The implementation is always botched by businesses who don't do a thorough job and finish their product. There's clearly a huge chasm between what the customer and the IoT business would consider an MVP. Do it right or don't do it at all.

Also, with tools like Chip Whisperer (https://www.newae.com/chipwhisperer) the physical security of the hardware root of trust needs to be reevaluated.

“Security is the ‘s’ in IoT” was an old joke back then. Still a problem but hardly a new one.

It's complete nonsense, and the only workaround is to install your own certificate authority on your network and add it as a trusted root cert. Imagine buying a device from amazon and being told to add their root ca to your machine. No non-tech person should ever be touching root ca's, and is 10x more dangerous than whatever this insane policy is trying to protect us from.

I believe all IoT devices should exist beyond a virtual airgap, and the router should by default, prevent the device from communicating with the internet. In order to send data to-and-from the cloud, it should pass through some kind of intelligent/auditable gateway. One that the router maintains, and can be updated independent of the devices.

It's obvious to me that this model is unacceptable.

A better choice is to ensure that internet stacks are secure in hardware, not software. This is how power is distributed. Internet connectivity could be secured the same way.

Then you could use anything you want without worrying about confused software or hackers, in the same way you can plug in anything to any outlet without worrying about burning the house down.

Most tech gadgets are a distraction and are about as useful off as on.

Industrial stuff sure, but if someone's internet fridge or smart TV goes haywire, so what.

Do not buy them and avoid built in ones at all costs.

Maybe at some point newer ones can be secured, but I doubt it.

Nevermind thousands have already be installed. People cannot be bothered to update their phones or computers, those updates are rather easy. Who will be bothered to update their IOTs ? Plus 2038 is coming quickly, good luck to people who have 32bit IOTs. Do 64bit IOTs even exist ?

>it’s up to system integrators, who are responsible for the security of an overall service interconnecting IoT devices, to require the features from their suppliers, and to coordinate features inside the device with external resilience and monitoring mechanisms

So we give integrators access to our devices ? How is that security ? Also what if these integrator's company is purchased or goes out of business ?

Supply chain attacks concerns are infinitesimally smaller than manufacturers writing buggy, unmaintained software / firmware.

We should instead argue for open software / firmware, or at least local control only (if desired). Also solves the problem of billions of e-waste devices whenever manufacturers go under or shutdown their servers, or moves them behind new paywalls / adwalls.