UK Becomes First Country To Ban Default Bad Passwords on IoT Devices 39
The United Kingdom has become the first country in the world to ban default guessable usernames and passwords from these IoT devices. Unique passwords installed by default are still permitted. From a report: The Product Security and Telecommunications Infrastructure Act 2022 (PSTI) introduces new minimum-security standards for manufacturers, and demands that these companies are open with consumers about how long their products will receive security updates for.
Manufacturing and design practices mean many IoT products introduce additional risks to the home and business networks they're connected to. In one often-cited case described by cybersecurity company Darktrace, hackers were allegedly able to steal data from a casino's otherwise well-protected computer network after breaking in through an internet-connected temperature sensor in a fish tank. Under the PSTI, weak or easily guessable default passwords such as "admin" or "12345" are explicitly banned, and manufacturers are also required to publish contact details so users can report bugs.
Manufacturing and design practices mean many IoT products introduce additional risks to the home and business networks they're connected to. In one often-cited case described by cybersecurity company Darktrace, hackers were allegedly able to steal data from a casino's otherwise well-protected computer network after breaking in through an internet-connected temperature sensor in a fish tank. Under the PSTI, weak or easily guessable default passwords such as "admin" or "12345" are explicitly banned, and manufacturers are also required to publish contact details so users can report bugs.
Casio got hack from a fish tank sensor? (Score:3)
Yes I get IoT items are targets and going to be targets because updates will stop. But the example is terrible. A casino? With an IT staff? Well here's one for you, don't connect your fish tank temperature sensor to your productions network or as you call it their "well-protected computer network". Put it on an isolated network, or guest or anything else.
Re: (Score:3)
Also, don't treat any network as "inherently trusted".
Re: (Score:3)
I'd say most attack surfaces that are soft by virtue on being on a "trusted network" could easily have a viable hardened characteristic without a huge cost delta. Think various open database instances or password protected with a dumb easily guessable password.
Admittedly, this can be hard to get to because a lot of people mistake "inconvenient" for "secure", and thus if you are *not* entering 3 different OTP codes manually to access a device it's not "secure". However in a lot of cases you can replace such
Re: (Score:2)
I cringe when I look at my home IoT network; it is a separate VLAN with limited internal and no external access, but MQTT and some of the REST protocols are really hard to lock down on a residential scale. I could segment IoT more, but with it all being 2.5GHz stuff I am effectively limited to 3-4 VLANs.
Re: (Score:2)
Don't worry so much!
Unique passwords installed by default are still permitted.
Our company decided to then use the MAC address as password since our Internet provider does the same for the passwords to access their routers. /s
Re: (Score:1)
This is continuation of the same misunderstanding. You still think of it as a product, that you just sell with "hardened characteristic". You don't understand that in addition to up front costs, this imposes massive process costs for each process that was hardened.
Because security is the opposite of usability. And you have to choose somewhere on the spectrum between the two extremes. For each process. Which means that when you fuck around with heavy industrial processes and shift them away from usability, e
Re: (Score:2)
No, I don't think of security as a 'product'. Also you may want to be more specific. The low hanging fruit is the people that put some sort of service on a network with the password 'admin', because it's "trusted". There's no world in which that is a cost saving behavior, it's just supreme laziness. Now if you get into embedded space, particularly with a lot of legacy design components, ok, that 'network' is going to be trusted. I'd eye things *very* skeptically if someone claims it must be a trusted net
Re: (Score:1)
We're not going to get anywhere I think, because you are here to deny the most basic concepts of security processes, such that increasing security necessarily reduces usability.
It's especially visible in that you're only thinking in terms of IT, and that's why you don't understand security. IT security is just a tiny portion of security. Your hyper secure super duper amazing network is highly vulnerable to a guy with a tazer, a set of hand and leg cuffs and a few batteries having a talk with admin who has t
Re:Casio got hack from a fish tank sensor? (Score:5, Informative)
It's more aimed at consumers who plug their ISP supplied router in and never change any settings. Some years back one big ISP's routers used a default WiFi password that was just the wireless MAC address trivially transformed (XOR if I remember). Since the MAC address also identifies the manufacturer, it was pretty easy to find easily exploitable networks and use their broadband for nefarious purposes.
Re: (Score:2)
It's more aimed at consumers who plug their ISP supplied router in and never change any settings. Some years back one big ISP's routers used a default WiFi password that was just the wireless MAC address trivially transformed (XOR if I remember). Since the MAC address also identifies the manufacturer, it was pretty easy to find easily exploitable networks and use their broadband for nefarious purposes.
The summary points to the real problem when it says "Unique passwords installed by default are still permitted". A necessary-but-not-sufficient practice would require ANY net-connected device to force the entry of a fresh password of specified complexity before the equipment is allowed network access.
If doing that requires extra hardware - say, a USB or CAT5 port to connect to a computer or tablet to provide an interface for entering that initial password - then so be it. Good security is necessarily inconv
Re:Casio got hack from a fish tank sensor? (Score:4, Insightful)
Yeah how (Score:1)
Re:Yeah how (Score:5, Interesting)
My guess is that manufacturers will just add an initial-setup subroutine that won't allow setup to proceed until the default password is changed by the person doing the work.
One issue with requiring each and every bit of hardware to have a unique password will be more e-waste if these devices are less useful on the secondary market. A common technique to work with old hardware is to perform a factory reset on the bench before reconfiguring it for one's own purposes.
Then again, since most devices, even cheap devices, have their MAC addresses printed on them, it wouldn't be all that difficult to populate the same table used for that with the factory unique password in the printing system, and to then include that unique password on the label. It would still be a good idea to force the user to change the password, but if they don't then it would at least require someone to have gained physical access to the device in order to get that password. I suppose a dictionary attack could be used if the vendor password list leaked to the Internet as well, but that's a whole new level of failure.
Re: (Score:3, Insightful)
A lot of routers already have a unique password printed on them when you buy them. So it makes sense if your IoT thing just has a unique default password printed on a sticker/lasered on. Or at least on the box.
Re: (Score:2)
manufacturers will just add an initial-setup subroutine that won't allow setup to proceed until the default password is changed.
That's the better method. The method of embedding a unique password in the ROM at the factory (like Netgear) is certainly problematic. But also every single ISP router. Because they all rely on a sticker not getting damaged or degraded over time. I get that they aren't handled like laptops (whose underside stickers often end up completely illegible).
Re: (Score:2)
At least on laptops I've bought since 2016, there's been a metal flap on the underside that the sticker is behind. The flap could theoretically be torn off I suppose, but it's held with a magnet and is recessed enough to make that reasonably unlikely.
Re: (Score:2)
Re: (Score:2)
QNAP NAS devices default to user admin, with the password being the MAC without any colons. This does work well enough, and for the most part, one never uses this in any process unless they hit the reset button because they got locked out of their appliance, as the QNAP setup process disables the admin account by default and prompts for a username/password on initial install.
What would be close to ideal for more complex devices is an e-ink display. On initial setup, it would display a simple, easy to read
Re: (Score:2)
This makes me wonder about having a new form factor for a serial cable. Something like the RJ11 serial cable Cisco routers use, or maybe using RS232 over USB-C. This way, someone can configure a security sensitive device on a wire or using a cable before it ever sees the network.
What you're talking about is YOST.
https://yost.com/computers/RJ4... [yost.com]
The problem with it isn't the signaling at the port, it's getting the serial part to work on the host PC or other device being used. Almost nothing has RS-232 DE-9 port anymore, and even USB-A is becoming less common. Plus the FTDI scandal with cloned chips and nonfunctional drivers is another major problem.
Is this de facto in the U.S.? (Score:3)
California passed legislation to ban this in 2018. Does that mean it's basically all devices sold in the U.S., rather than splitting compliance?
https://techcrunch.com/2018/10... [techcrunch.com]
Re:Is this de facto in the U.S.? (Score:5, Informative)
One difference is that the California password allow still allows bad default passwords, so long as it enforces 'change on first use', which is a concession to a lot of automation, but if someone *never* uses it, it stays at a bad default value. UK law says it must be unique.
Another difference is the California law allows the password to be pretty guessable, e.g. derived from a serial number or some incrementing counter. The UK law says that the password must not be guessable/derived from some counter or serial number.
So one could argue that California did not ban 'bad' default passwords, but just banned the subset of 'well know common default passwords that can be used to do more than change the password'.
Re: (Score:2)
if someone *never* uses it, it stays at a bad default value. UK law says it must be unique.
At that point, it's not a "default" password, but just a setup code. It wouldn't be powered on and connected in that state.
Re: (Score:2)
Depends on the product.
Let's say you have a router, that router implements enough to work by default, and the 'setup code' is indeed needed to set it up, but the default operational state was good enough that you didn't actually "set it up". There's a lot of devices that are likely to have a "probably good enough" default operational state that may leave the password/setup code alone so that at some point in the undetermined future an attacker gets to be the one to "claim" the device rather than the reason
Re: (Score:2)
For example a well known default that is only viable if the device is 'off' and inoperable. Or a time limit from power on after which the setup code becomes inactive (like an hour or something), after which you have to unplug/replug device to get the setup code active again.
Thinking about how the modems that your ISP rents you work like that. I can factory reset it in an offline mode but as soon as that device hit the network it will be identified and flashed and password changed. A lot of signage players I've worked with operate on that principle, once the device is on your account you assign it a config from your dashboard and even if it's factory reset if it goes online it will find it's been claimed and update itself. The only way to change the password is via the dashb
Re: (Score:2)
This is a tough area... people need a router to be on the network, but it needs a secure channel for setup, and ideally a channel that can't be hijacked if someone other than the owner connects to the device after it is powered on. Having an e-Ink display that shows a temporary setup code can help, but that does cost money. Using Bluetooth is also a way, but someone else might be able to hijack it before the legit owner can complete pairing. NFC communication between the router and phone to establish a p
Re: (Score:2)
If the setup code is truly random sequence of 12 or so ascii characters only available through inspecting the labeling, then I think that could live on a while.
Problem is that scheme is highly automation hostile, and if applied to something like a fleet of hundreds or thousands of devices, wouldn't be workable. So a device targeting fleet style deployment needs some other strategy. Not sure if the UK law provides some sort of provision that would work for a mass headless deployment.
Re: (Score:2)
One difference is that the California password allow still allows bad default passwords, so long as it enforces 'change on first use',
For a lot of devices, the default configuration works sufficiently that noone ever bothers to log in and change anything, or people don't even realise the device is there at all.
IPMI devices are a good example of this, built in to most modern servers but you don't have to use them - the server will operate perfectly well if you connect a monitor and keyboard instead, so some people do that and have no idea that a default IPMI device is sitting there waiting to be used by someone nefarious.
Similarly consider
Re: (Score:2)
Re: (Score:2)
Well, for serial number, you have some issues:
-Some devices announce their serial number via some unauthenticated mechanism. There are utilities that list devices from a certain vendor and they'll list details like serial number so you can decide if you should/should not try to set it up.
-Even if not announced, the serial number makes for a nice dictionary. If I know that the password is XXXXYYYY where X is some alphabetic prefix number and Y is a numeric incrementing by 1, then the password may well be p
Calling The Doctor (Score:1)
Much needed (Score:3)
Delivering Test code also needs to be illegal (Score:2)
Re: (Score:2)
The problem stems from vendors wanting to brand the equipment but don't have the expertise to develop their own firmware. You end up with firmware that's made by some chinese OEM and then rebranded by a multitude of third parties. Even assuming the original OEM produces an updated firmware, you then have to wait for the individual reseller to apply their branding and release their branded version of the update. Often this doesn't happen at all and you're stuck with whatever version it rolled out the factory
Thatâ(TM)s novel (Score:2)
how to enforce this (Score:2)
No idea how they're going to make it happen
They didn't get hacked from Fish Sensor (Score:2)
Even if you wanted to log the data to an analytic e