China Electronics Firm To Recall Some US Products After Hacking Attack (reuters.com) 68
An anonymous reader writes:Chinese firm Hangzhou Xiongmai said it will recall some of its products sold in the United States after it was identified by security researchers as having made parts for devices that were targeted in a major hacking attack on Friday. Hackers unleashed a complex attack on the Internet through common devices like webcams and digital recorders, and cut access to some of the world's best known websites in a stunning breach of global internet stability. The electronics components firm, which makes parts for surveillance cameras, said in a statement on its official microblog that it would recall some of its earlier products sold in the United States, strengthen password functions and send users a patch for products made before April last year. It said the biggest issue was users not changing default passwords, adding that, overall, its products were well protected from cyber security breaches. It said reports that its products made up the bulk of those targeted in the attack were false. "Security issues are a problem facing all mankind. Since industry giants have experienced them, Xiongmai is not afraid to experience them once, too," the company statement said.
Wow (Score:5, Insightful)
How often does any company do a recall for security issues? They seem to be taking the issue at least somewhat seriously.
Looks like the made the classic mistake of assuming users would be sane enough to change the default password.
Re: (Score:1)
If they were really taking things seriously, it would've recalled or patched these products a long time ago when the security problems were first identified. Their statement just reads as PR spin.
Re: (Score:1)
... a statement that is true of every single device currently attached to the internet. There is no general purpose computing device that cannot be subverted in some manner.
Everyone has 20/20 hindsight. The point is, this company is acting better than many other companies have when their products experience some security breach. At least Xiongmai is standing up and trying to do the right thing.
Re: (Score:2)
Your claim about hindsight with respect to default passwords might be true if this was still 1998. Having your devices using a default password that can be found by simple web searches in this day and age is simply gross negligence. And secondly, one of the flaws being attacked in their products is a bug in OpenSSH that is around 12-years-old now. They get no kudos for only now fixing long-ago discovered flaws in the software they ship.
Re: (Score:2)
They get no kudos for only now fixing long-ago discovered flaws in the software they ship
I agree that patching a twelve year old bug now is not laudable, but in comparison to other manufacturers this is an example of what should be done and is something to be acknowledged as a step in the right direction.
Re: (Score:1)
Nah, sorry, fuck those other manufacturers and fuck this one. A step in the right direction is them getting litigated into oblivion.
Re: (Score:1)
If they were really taking things seriously, it would've recalled or patched these products a long time ago when the security problems were first identified.
They released a firmware update more than a year ago to fix the default credentials problem. Any devices manufactured after September 2015 require the user to set a password, instead of coming pre-configured with a default. The firmware update also addresses this, but good luck getting consumers to install a firmware update.
Re: (Score:2)
A random default password, printed on the device itself, would fix 90% of these vulnerable products.
Re:Wow (Score:4)
How often does any company do a recall for security issues? They seem to be taking the issue at least somewhat seriously.
Looks like the made the classic mistake of assuming users would be sane enough to change the default password.
More like making the classic mistake that consumers are IT professionals. Complaining that users aren't changing the default password is the security version of "you're holding it wrong." If changing the password is important, then it should be a required part of the setup process.
Re: (Score:3)
Re:Wow (Score:5, Insightful)
You misunderstand. You often can't change the password on the telnet / ssh ports. Per Krebs [krebsonsecurity.com]:
Re: (Score:2)
Every time you see a company issue a CVE. That is a software product recall. They are done thousands of times a year worldwide.
Asking too much` (Score:3)
Obviously the laziness of users around the world who don't change default passwords is a different problem, but shipping stuff configured and documented in a way that makes not securing it the default mode in the hands of users is just
Re: (Score:1)
They could use the device serial number as the default password. At least they would be semi-unique that way.
Re: Asking too much` (Score:1)
The gov won't enforce security. In fact they want less. Just see what the FBI demanded of Apple.
Re: (Score:3)
One approach that would allow them to avoid that is to disable the primary function and not accept a gateway address until the user changes the password.
Re:Asking too much` (Score:4, Informative)
https://krebsonsecurity.com/20... [krebsonsecurity.com]
Re: (Score:3)
Thats why... (Score:1)
Re: (Score:1)
It shouldn't even be an option (Score:2)
These vulnerable IoT devices are here to stay (Score:2)
Re:These vulnerable IoT devices are here to stay (Score:5, Insightful)
No we don't. We don't need any reasons for those greedy incompetent asshats to filter our traffic. Instead, manufacturers should be held liable for insecure products, forcing their hand to secure the devices they ship, and to also provide updates. A minimum two year requirement before they can end of life the device, at which point they should have to provide source code for the community to assume updates on or continue to support the device themselves.
The value of the code is then weighed by the cost of continuing support, and they can decide what's the best option for themselves.
Re: (Score:2)
A minimum two year requirement before they can end of life the device,
So what happens after 2 years? Do you expect to also mandate automatic patching? If yes, this also means that you have to have signed updates. Currently, all of this is done with RSA, but what about post-quantum?
at which point they should have to provide source code for the community to assume updates on or continue to support the device themselves.>
No vendor would ever agree to this.
Re:These vulnerable IoT devices are here to stay (Score:4, Insightful)
The problem is how do you get users to apply updates?
You could have an update server, but then it too is vulnerable and you would have to force manufacturers to hand over control to... someone when they end support and open source the firmware.
Relying on users to manually seek out and install updates is obviously never going to work, if they can't even change the default password.
Re: (Score:2)
You'll never find a perfect solution. But that doesn't mean you don't implement at least the most modest of controls. If the manufacture is held liable for security, then devices won't ship with default passwords and goatse sized vulnerabilities.
After two years of updates, the majority of vulnerabilities that do ship will mostly be identified and patched (or should be at least). After that, a general herd immunity will develop. The devices left insecure after two years will have so much variety between t
Re: (Score:2)
A secure kernel, running a well written web interface
You may be wishing for a bit much with these little trash devices. You are correct in that they only way to get things to improve would be to hold manufactures responsible for the security of their devices by law but until then we can expect more things like this [wordpress.com].
Re: (Score:2)
Nice.... So someone with a cell phone sniffs the network, hacks the device, and then uses it to load malware onto the card's photo partition, that then will likely get ran on the next computer the owner plugs the card into.
Not to mention the card itself is a WiFi seeking botnet drone.
I really don't see why they can't get sued for negligence. Car manufactures do, and so does EVERYONE else. Perhaps Dyn should take the largest manufactures of the infected devices to court for just that. Sue for damages due
Re: (Score:1)
You're impressed that they've done the bare minimum after having had insecure products on the market for years? You must be easily impressed.
Re: (Score:2)
Their products were shown to have a problem and they're volunteering to take positive action regarding same. Would you like a pony with that, too?
Re: (Score:1)
Oh how generous of them! We should all bow down at their graciousness to *gasp* fix their shitty products!
Re: (Score:2)
What's with the mocking attitude? There *are* places in between "throw kisses at their presence" and "throw presents at their kisser", you know. Maybe by the time you're old enough to buy your own beer, you'll have figured that out.
Worm all the IoThings! (Score:2)
Only a solution comes to my mind for this to not happen again: create a simple worm that infects and disables ("disables" as in "Kill") all the unprotected devices.
Yes, I would be pissed off if my devices would suddenly die, but if it has been that easy to infect all those appliances, it should be the manufacturer the responsible for repairing them.
Next time they'll implement at least basic security.
Re: Worm all the IoThings! (Score:2)
Kudos to Hangzhou Xiongmai ... (Score:2)
Given the disastrous ramifications of not changing the default passwords, IoT devices should be little more than bricks until the default password is changed to something better.
Re: (Score:2)
Re: (Score:2)
See why hardware manufacturers might not want to do this?
Do what? I am not sure what you are referring to.
Re: (Score:2)
"some US products".... (Score:2)
Hmmm...I wonder how many, and what the recall process will be for the customer.
I suspect "not many" and "horrible" respectively...
And in other news... (Score:2)
...Six software engineers were quietly executed at Phuc Tup Prison for making government-ordered back door access to the devices so blatantly obvious even barbaric Western script kiddies were on them faster than a priest on a one-legged choir boy.