News for hackers. Stuff that matters.

A comment on FCC Proposes Voluntary Security Labels for IoT Most Companies Will Likely Ignore. Parent comment

Re:FCC Proposes Voluntary Security Labels for IoT Most Compa... by ilyt on Friday September 08, 2023 @11:31AM (#37434895)
> The reality is that it takes a ton of work to get a microcontroller to blink an LED. Various clocks need to be configured, various peripheral devices (I2C controllers, GPIO controllers etc) need to be configured, interrupt vector tables need to be set up and so on.

No, that's the easy part (even if done manually). The hard part starts with networking

> There’s a huge gap between these two ends where a ton of important stuff goes unaddressed. At no point are the OEM and semiconductor vendor incentivized to sit together and addresses all the issues that fall through the cracks.

Most SDKs I've seen end up somewhere at level of TCP stack, sometimes at level of simple web server. Because everything above will be very application specific.

It's near-entirely on the app vendor to fuck stuff above that. Don't try to push blame on manufacturer of the chip here, they didn't force your password to be 12345678

[ Parent | on HN ]
Re:FCC Proposes Voluntary Security Labels for IoT Most Compa... by fidotron on Friday September 08, 2023 @01:26PM (#37436589)
But SSH etc are totally inappropriate for embedded devices (microcontroller level) anyway. Suddenly you need to deal with either a clock battery or secure NTP on boot . . . This is opening the pandora’s box of replays etc.

Frankly this whole idea the same protocols that are used on the web should go anywhere near microcontrollers is braindead.

[ Parent | on HN ]
Re:FCC Proposes Voluntary Security Labels for IoT Most Compa... by GabeIsko on Friday September 08, 2023 @03:01PM (#37437893)
Not so much microcontrollers, but IoT devices. That's the reality we live in - as devices grow more complex and hardware becomes more mass produced and less expensive, commercial interests will find their way to just including a linux kernel with everything. And once that happens, ssh will be bundled with it.

sshd has no place on most of these devices. But it comes packaged by default in many distributions. Real products are shipping with it right out of the box, and it's a problem.

[ Parent | on HN ]