News for hackers. Stuff that matters.

A comment on U.S. Government Finally Gets Serious About IoT Security.

Re:U.S. Government Finally Gets Serious About IoT Security by calibas on Friday March 19, 2021 @12:50AM (#26510242)
>NIST’s initial rules include today’s best practices, such as having an over-the-air device update program

Weren't these kinds of automated updates the basis for the SolarWinds attacks?

[ Parent | on HN ]
Re:U.S. Government Finally Gets Serious About IoT Security by Leherenn on Friday March 19, 2021 @03:07AM (#26510722)
It's a trade-off. With OTA updates you increase your attack surface, but you make it more likely that the device is updated if needed.
[ Parent | on HN ]
Re:U.S. Government Finally Gets Serious About IoT Security by Rebelgecko on Friday March 19, 2021 @02:10AM (#26510512)
I don't think that's an inherent problem with OTA updates, just bad security practices
[ Parent | on HN ]