aeronautic

Agree.

While I love rust and think it (should) replace C for web servers and the like, the majority of the issues with IOT devices are just basic security oversights and design errors.

You raise some very good points:

1. Secure by default should be mandatory. MS learned that one the hard way.

2. Consumer protection laws would certainly get device builders attention. I think that is required. But I doubt the current administration is included to enact such laws.

It is a shame that devices are certified by UL and FCC, but there is no security certification or even a basic audit that would catch: security backdoors, default / blank passwords, auth over http, basic XSS and CSRF vulnerabilities etc.

The bad news is that we don't know how to design a device with Linux and internet services that will be secure without updates for 5-10 years. So we either insist on updating .... or we keep some of the darn devices off the internet.

At at minimum, we should insist on having devices that don't listen on ports just waiting to be hacked. Devices should only connect out.

Very good point. Even requiring the user to specify a maintenance window can ruin the experience.

Some patches should be able to be made "hot", but that takes extra ram which is often squeezed to a premium in a device.

I would recommend:

- We not put devices on the internet that do not have a core, hard requirement to be on the internet. This rules out toothbrushes, toilets, pillows etc.

- Devices do not open listening ports and only connect out. This eliminates a whole class of shodan visible attacks.

- Devices give users some option of when an update is required and when the user can apply it. If the device can be managed via a HomeKit or Phone UI - these options can be made pretty usable. Alternatively a yellow light on the front of the device if suitable to indicate an update is available.

Regardless, the current path of listening devices on the internet and not being patched is untenable.

Still true when I tested last year. The core protocol does not have a defined way to get the browser to forget the login.

You have to resort to different fudges on different browser.

Net/Net: the http auth ui sucks, has bad usability, weak crypto, and is not robust with logout.

HTML/form based auth can be made robust and is a preferable alternative in every case.

True point. The difference is that enterprise apps understand the need to patch and update. IOT devices and device builders largely do not.

IOT devices today look pretty much like any other internet device too. Linux, good CPU horsepower, ample memory and internet connection. More than a few exploits that work on enterprise servers can be adapted for IOT devices.

Add to this a lack of awareness of basic security issues among device builders and you've got a problem. That is why we are seeing so many security issues with IOT devices.

Love it.

I know! Why do device manufacturers need to be pushed for this? We consumers keep buying stuff that has been put on the internet with little to no thought about security today or tomorrow.

IOT will get much worse before it gets better. I say this from working with device builders for 2 decades. The level of attention to security is sadly lacking.

If the device does not listen, i.e. it calls out, then it is inherently much more secure. However, many devices use an embedded web server and do listen for requests.

If the device does not listen, and polls regularly for updates, then that is fine ... perhaps even ideal.

Do you mean basic & digest http auth built into the browsers? If so, yes, they are bad. The issue is you cannot reliably implement log off on all browsers.

I know, it is a very sad state of affairs.

In doing IOT for 2 decades, this is probably one of the biggest issues. At best, most devices have a "download firmware" option that 99% of users can't operate.

I could go on about dozens of other issues, like back-door field-service passwords, http not https, passwords in the clear, endless XSS vulnerabilities, but this is one of the biggest.