Study: Firmware Plagued By Poor Encryption and Backdoors 141
itwbennett writes: The first large-scale analysis of firmware has revealed poor security practices that could present opportunities for hackers probing the Internet of Things. Researchers with Eurecom, a technology-focused graduate school in France, developed a web crawler that plucked more than 30,000 firmware images from the websites of manufacturers including Siemens, Xerox, Bosch, Philips, D-Link, Samsung, LG and Belkin. In one instance, the researchers found a Linux kernel that was 10 years out of date bundled in a recently released firmware image. They also uncovered 41 digital certificates in firmware that were self-signed and contained a private RSA encryption key and 326 instances of terms that could indicate the presence of a backdoor.
The beginning of the "internet of things" (Score:5, Insightful)
It will be like the internet of humans was. Everyone will be in a gold fever. Everyone will want to join the train and everyone just HAS to get with the latest fad and have a sock drawer that has some kind of internet connection. Every petty, crappy, useless gadget will need to have some sort of internet access.
And of course the manufacturers will deliver it. Everything and their dog collar will be online.
Then the first people, I'd predict some geeks with a rather odd sense of humor, will start to piss people off by "talking" to their fridge and telling it to put some milk bones and condoms on the next shopping list, just to make your friends wonder about your ... private life should they get their hand on it.
And given time, someone will come up with a way to abuse the whole shit not just for fun but also for profit. And only THEN we'll stand there and ask why oh why security has not been a core topic right from the start because that should have been obvious... and it probably was.
It was just way cheaper to ignore it. And as long as people buy it (who will react just like the very first person in this thread, i.e. "who's going to hack your fridge?"), why bother with security? Security costs money and it's no selling point. So... to the crapper with it.
really? (Score:4, Insightful)
Re:Of course (Score:5, Insightful)
It's not specifically about fridges, but it points to the widespread terrible security practices, and how a single vendor who makes the underlying stuff can basically destroy security for all of it.
As you add more and more stuff with the same vulnerabilities, the scope of the problem just gets magnified.
So, your internet connected CCTV, your smart TV, your notional smart fridge, and from the sounds of it possibly even your router ... these are all subject to vulnerability through their weakest links. And it sounds like there's a lot of weak links.
As long as these companies have a culture of lax security and other terrible practices like this, this problem isn't going to go away.
What's wrong with a 14 year old kernel? (Score:3, Insightful)
If it works on the hardware in question, what's wrong with that? Sometimes being newer isn't better, it's just newer.
I don't see this as a huge problem for embedded systems.... Unless it's something like a firewall or a router that lives on the internet, then it *might* be worth looking at. If it's something like a media player or printer on your private network, who cares? (unless you are member of the tin foil hat society).