Re:U.S. Government Finally Gets Serious About IoT Security
by WalterBright on Friday March 19, 2021 @12:18AM
(#26510119)
There's something wrong with "we need to be able to remotely update the ROMs to protect the ROMs from remote updates."
> trained operator
I'm not sure that flipping an "enable updates" switch requires training.
> reinfected five minutes after they reboot
Scenario A: malware installs itself in device ROM. You remove malware, the ROM code reinfects the system. You have no idea if the device is compromised or not. Your only choice is to buy all new components.
Scenario B: malware keeps reinfecting system 5 minutes after reboot. You remove the malware. Reboot. Your system is clean.
I choose (B).
Re:U.S. Government Finally Gets Serious About IoT Security
by bostik on Friday March 19, 2021 @04:28AM
(#26511119)
> Scenario B: malware keeps reinfecting system 5 minutes after reboot. You remove the malware. Reboot. Your system is clean.
... for about 5 minutes.
This is very close to what happened with the Slammer worm.[0] It was in-memory only, spread like wildfire, and any unpatched systems were infected within minutes.
Re:U.S. Government Finally Gets Serious About IoT Security
by WalterBright on Friday March 19, 2021 @04:52PM
(#26518048)
You're still much worse off if you suspect the ROMs on your devices were corrupted.
If a device has a trained operator, sure, have a write-protect switch.