8 ms·

Completely incorrect claim, the IoT industry doesn't spend a penny on security, and therefore will be vulnerable to these type of attacks. If anything this is

Completely incorrect claim, the IoT industry doesn't spend a penny on security, and therefore will be vulnerable to these type of attacks. If anything this is proof that the security industry does work, these attacks are happening on devices where there is no security budget - not on servers with large investments in security.

OJFord 10y ago
> the IoT industry doesn't spend a penny on security, Citation sorely needed [and not to be found].
hvs 10y ago
So, "companies think that security is unnecessary" is a sign that the security industry is working?
- Beltiras 10y ago
  TBF the comparison is against a well defended server of which there is a great many examples.
- raesene9 10y ago
  nope it's a sign of the strong market for lemons in IT products. There's no adequate way for consumers to differentiate between well secured products and badly secured products (every company will tell you "security is their top priority" if you ask them).
XaYdEk 10y ago
How many pennies would've been needed to insert a simple page forcing you to change user/password combo and to choose a reasonably strong password after first boot ? In the case of Mirai it's not even a cost issue, just lacking good practices.
- drzaiusapelord 10y ago
  Anything that adds any interaction with the user will cost support time, thus dollars. Its easier for these companies to hard code a password in and have it "just work" with their mobile app or web interface than actually do security correctly. Until there are regulations in place to make them do this, they will not care.
- iregistered4 10y ago
  "How many pennies would've been needed to insert a simple page forcing you to change user/password combo and to choose a reasonably strong password after first boot ?" These are written by outsourced developers who don't know anything about security. They wouldn't even think to develop something as simple as that. You are obviously unaware of how this works, companies would have to hire consultants/penetration testers to assess the product first. Then they would spend even more money making the changes suggested by the consultants. So it would cost a lot of pennies.. actually.
  - XaYdEk 10y ago
    Ok, I am aware of how it works, but I'm not talking pentests or hardening. I'm talking simple, cheap design choices in this case, that could've eliminated the whole Mirai debauchery. In your app you already have a setup wizard, right ? Add one more page to the end "Hey, we're almost done! We just need to make sure your device is secure. Please choose a username and (strong) password." Edit: Because if you have a login, you already have the components in place, you are not developing a new feature. This one simple, design choice would have cost very little, both in terms of development time and increase in support costs, because Support is a cost center that scales with your user base and your knowledge base. Obviously not pennies, but still small costs. There is the classical point of diminishing returns from security investments, problem is for most IoT products, we are significantly left, towards zero investments and, at this point, small investments and a few smart design choices would yield significant returns in security. And with developers that's exactly what I don't get. How has it not become internalized that allowing users to run the default user/pass combo is very poor idea ? I'm not asking for much, I don't expect them to know a lot about security, but not even adhering to some basic good practices of security is killing me.
    - iregistered4 10y ago
      " Ok, I am aware of how it works, but I'm not talking pentests or hardening. I'm talking simple, cheap design choices in this case, that could've eliminated the whole Mirai debauchery." Then you are not talking about the security industry or its failure to work are you? Its a failure in the development industry to have basic security awareness. If you don't engage the security industry for pentests or consulting. You can't go any blame them when you get hacked.

OJFord 10y ago

> the IoT industry doesn't spend a penny on security, Citation sorely needed [and not to be found].

hvs 10y ago

So, "companies think that security is unnecessary" is a sign that the security industry is working?

Beltiras 10y ago
TBF the comparison is against a well defended server of which there is a great many examples.
raesene9 10y ago
nope it's a sign of the strong market for lemons in IT products. There's no adequate way for consumers to differentiate between well secured products and badly secured products (every company will tell you "security is their top priority" if you ask them).

XaYdEk 10y ago

How many pennies would've been needed to insert a simple page forcing you to change user/password combo and to choose a reasonably strong password after first boot ? In the case of Mirai it's not even a cost issue, just lacking good practices.

drzaiusapelord 10y ago
Anything that adds any interaction with the user will cost support time, thus dollars. Its easier for these companies to hard code a password in and have it "just work" with their mobile app or web interface than actually do security correctly. Until there are regulations in place to make them do this, they will not care.
iregistered4 10y ago
"How many pennies would've been needed to insert a simple page forcing you to change user/password combo and to choose a reasonably strong password after first boot ?" These are written by outsourced developers who don't know anything about security. They wouldn't even think to develop something as simple as that. You are obviously unaware of how this works, companies would have to hire consultants/penetration testers to assess the product first. Then they would spend even more money making the changes suggested by the consultants. So it would cost a lot of pennies.. actually.
- XaYdEk 10y ago
  Ok, I am aware of how it works, but I'm not talking pentests or hardening. I'm talking simple, cheap design choices in this case, that could've eliminated the whole Mirai debauchery. In your app you already have a setup wizard, right ? Add one more page to the end "Hey, we're almost done! We just need to make sure your device is secure. Please choose a username and (strong) password." Edit: Because if you have a login, you already have the components in place, you are not developing a new feature. This one simple, design choice would have cost very little, both in terms of development time and increase in support costs, because Support is a cost center that scales with your user base and your knowledge base. Obviously not pennies, but still small costs. There is the classical point of diminishing returns from security investments, problem is for most IoT products, we are significantly left, towards zero investments and, at this point, small investments and a few smart design choices would yield significant returns in security. And with developers that's exactly what I don't get. How has it not become internalized that allowing users to run the default user/pass combo is very poor idea ? I'm not asking for much, I don't expect them to know a lot about security, but not even adhering to some basic good practices of security is killing me.
  - iregistered4 10y ago
    " Ok, I am aware of how it works, but I'm not talking pentests or hardening. I'm talking simple, cheap design choices in this case, that could've eliminated the whole Mirai debauchery." Then you are not talking about the security industry or its failure to work are you? Its a failure in the development industry to have basic security awareness. If you don't engage the security industry for pentests or consulting. You can't go any blame them when you get hacked.