Coming soon to smart home devices? Best Before labels – with patch cut-off dates

The big outcome of a one-day special IoT security session run by the US government? A new labeling system for your smart home devices. It's not going to happen for a few years, and today's meeting in Austin, Texas, only agreed to set up a working group to look into the issue. However, after five hours of discussion with …

[Herby]

My Toaster...

Doesn't need to be connected. Don't bother, PLEASE!

While some things can be connected, it probably isn't necessary, and for many thi9ngs won't make much of a difference. About the only people who want "connected" things are the marketing people looking to tick another box in the specifications. Kinda like "digital" which is supposably better (but it isn't!).

The fact that I can build a crystal set to receive a radio station is lost with some of these people.

[Anonymous Coward]

Re: My Toaster...

Reminds me many moons ago buying a pair of headphones that were supposedly "digital". Not a single semiconductor circuit in site, the drivers themselves were very much analogue as was the wiring between them and the plug.

[heyrick]

Re: My Toaster...

I think the lie was that since CD players and the like deal with digital signals which are converted to rough approximations of analogue signals, you really need special "digital" compatible headphones in order to hear it the best.

And paint the edges of your CDs green.

And...

[Anonymous Coward]

Nyquist > "Crappy Digital" (Because Math)

Mathematics doesn't lie - Nyquist theorem is pretty definitive about digital storage of analog signals being perfect in bounded systems. The boundaries used for CDs are well in excess of human capability to distinguish the difference between "Analog" and "Digital".

Unfortunately the above statements ignores problems with AD/DA converters, clock jitter and crappy coding (DSP & DRM to name two).

There's also been some debate about analog recording being "warmer", but I hope we can at least agree that subjective arguments are a slippery slope to insanity.. ;-)

[Anonymous Coward]

Re: a pair of headphones that were supposedly "digital"

Never mind digital. Were they "gluten free"?

[Anonymous Coward]

Re: My Toaster...

Unless it won't work without being connected, who cares? Yeah, you'll pay more for that, but that's not different than if you need a toaster capable of handling four slices and the one you want comes with a bagel setting and defrost setting that you don't need.

I've seen some LG TVs recently that seem to be unable to complete setup without connecting them, but that's solved by connecting ethernet or a dummy wireless network temporarily and then disconnecting it later.

[Barry Rueger]

Re: My Toaster...

The fact that I can build a crystal set to receive a radio station is lost with some of these people.

Well, an AM radio station.

Do people still listen to those any more?

I mean, besides OTR fans?

[Anonymous Coward]

Re: My Toaster...

The fact that I can build a crystal set to receive a radio station is lost with some of these people.

Well, an AM radio station.

I'll just leave this here. (DAB might be a struggle though.)

Never mind digital. Were they "gluten free"?

I suppose technically they were, even if not advertised that way.

[heyrick]

Re: My Toaster...

Upvote for the link to the FM xtal set. It's a work of art!

[The Man Who Fell To Earth]

Re: My Toaster...

You mean you don't want a planned obsolescence date sticker on your toaster? Or do you just like old toast?

This suggestion of a planned obsolescence date sticker (end of support) is a scumbag IoT makers wet dream. Basically an abusive EULA in another form.

[Dan 55]

Re: My Toaster...

As I said in another thread, now would be a good time to resurrect the 80's BT green circle/red triangle sticker.

Green circle means that the manufacturer has followed a suitable set of standards when developing it and will supply five years' worth of updates at no extra charge. That way there's not a race to the bottom when it comes to obsolescence dates, they either promise to do something reasonable or they don't.

Red triangle also has text spelling out that every other device on your home network and the data on them is much more likely to be up for grabs.

Easy for people to understand and manufacturers don't want red triangles stuck on their boxes.

[Anonymous Coward]

I agree with that last guy...

Don't fekkin' connect what doesn't need connectin', it's just a security nightmare waiting to maul yer arse.

Security patches need to be mandatory for the life of the product. If there's an IOT dohickey as part of my fridge then I'm not throwin' out my fridge because the IOT doodad went titsup. Either you fix that thing or not only will I never buy anything with your name on it but I'll make sure to let all my local & online circle of contacts know as well.

If my damned thermostat helps DDOS some site then you had better patch that fekkin' thing right bloody now else I rip it out & replace it with a purely mechanical one salvaged from the tip.

The security holes don't stop existing after a mere two years, your device had better keep working after that time, & if you fail to keep it secure then I'll fail to buy anything from you ever again.

Android, Apple, Windows, IOT, all of you had better listen the fek up 'cuz I'm bloody well talkin' to you. If your software is buggy then fix it. Just because the device is a year old means sweet-fek-all. You made it, you sold it, now support the fekkin' thing!

GAH!

[Timo]

this may be a step in the right direction

Once the hardware has shipped and the manufacturer has pocketed the money the ongoing support just looks like cost. And as the device is supported it also means people aren't as motivated to replace them so the vendor loses out on those replacement sales too. This all works against the consumer.

So maybe educating the consuming public, and embarrassing vendors into declaring their support plans, may be the way to get this translated into business results and business terms that the beancounters can understand.

[Mark 85]

Re: this may be a step in the right direction

But it's a very basic baby step.... agreeing to set up a working committee... really? Yes, educating a public that gives FA about security of their toys is needed. Governmental mandates on updates, patching, end of support is needed and would be a better way to start things than a working committee that will hold endless meetings and if they ever come to an agreement, it will be pointless.

The IoS industry needs a swift kick to the balls to wake them up and get them doing the things that should be done. Not some "at some point in the future..." dream list.

[Speltier]

Connected Cars

Should list when patches are no longer available too. It is one thing if a DVR goes crackers, quite another if cars become homicidal remote controlled bullets.

Maybe the connectivity should just shut down at a point after the last patch date, since eventually any script kiddie will be able to crack whatever the digital signatures are used to sign software patches, never mind unpatched security holes in "XP" cars.

[The Man Who Fell To Earth]

Re: Connected Cars

According to the US DOT, the age of the average car on American roads is 11.5 years. That's the average, and it's getting longer every year. Do you really think "connected car" makers will be issuing patches for their cars a dozen years after the sale? I doubt it.

[Robert Moore]

ID-Iot

Incredibly Dangerous - Internet of Things

Or IDIoT as I prefer to think of it. I do not see an upside to this stuff. I already have a very effective remote method of controlling the lights in my house. It is conveniently located on the wall near the entry to the room. It's called a light switch.

The best part,is that if my internet goes down they still work. (Amazing, I know.)

[404]

Re: ID-Iot

You follow me on twitter? Been saying that for awhile... If I was Apple I'd sue your ass, but then if I was Apple, I would have applied for a copyright first, so you win this one...

I'm waiting for the Ultimate Mousetrap with auto reset and streaming webserver for Android and iPhone...

[Anonymous Coward]

Re: ID-Iot

I'm stealing it.

This whole thing is just to get you to buy and consume shit you don't need. The sad thing is these IDIoT devices will funk up all the time, and you know people will just go and buy a new one instead of RTFM to fix it in 60 seconds.

But...I think you can murder more easily with all these IDIoT devices, so that might interest some (I can imagine someone hacking a gas stove at 4am, then later at 4:30am hacking the ignition...everything happens once).

[Anonymous Coward]

Not sure this "expiration date" helps consumers much

Sure, people who read El Reg know the security risk of IoT devices and the importance of patches, but the average consumer probably associates patches with Flash constantly bugging you to update or Windows wanting to reboot at an inconvenient time and might go out of their way to buy the one with the shortest patch window!

The other problem is just because the OEM has committed to delivering "patches" through 2020 doesn't mean all security issues will be addressed. Sure, if some really bad exploit comes out that could be used to cause your toaster to set your house on fire they'll fix it, but if there's something that can cause your toaster to go from off to some sort of warmup state that consumes 100 watts 24x7 they might ignore it.

[Steven Roper]

It's insidious

There's this very invasive framework mentality in play, quite Orwellian in nature, that there are psople who want to get inside our homes, inside our heads, strip us down to the source code and analyse us from every possible angle. While that sounds like the essence of paranoia, there are many reasons why people would want to do this.

The primary one of course, is marketing and advertising. The original purpose of advertising was simply to let people know a product exists, what problems it solves, and where to buy it. The whole concept of trade developed around this process:

1. I have a problem and I need something to fix it (e.g. an apple to assauge my hunger, a hammer to nail this plank to patch my house, a shirt to keep me warm, whatever)

2. You have what I need.

3. What do you want in exchange for that item?

But since then there's been a gradual but ineluctable evolution away from this purpose, towards one of making us want to buy the product, and that superseding all other considerations. The usefulness of the product, its ability to solve a problem which is the reason we'd normally buy it in the first place, is losing relevance. All the companies care about is selling more product, regardless of its usefulness or any point of trade, Their sole objective has become to extract money from our wallets.

To that end, an entire science has sprung up around figuring out exactly what makes people tick for the express purpose of manipulating that process to their own gain, regardless of our loss. But control first requires understanding. So inevitably this leads to, the more we know abut someone, the more we can predict and therefore influence their decisions; the more we can influence their decisions, the easier it becomes to extract more money from them.

The IoT is the manifestation of this principle. There is no valid, consumer-oriented purpose in connecting a light bulb, a kettle, a toaster, a washing machine, to the internet. There is no problem that it solves to make the trade worthwhile. The only purpose of all this connectivity is to inject more observation points into our homes and our lives in order to better predict and thereby influence our behaviour.

So these bastards can all fuck off and die. I will never embrace this technology because it brings me no advantage whatsover, but it puts me at a distinct disadvantage to whoever wants to find ways to milk me for more money, while giving me nothing of value in exchange.

And if it becomes impossible to buy a lightbulb that works without this connectivity, I will go back to using candles. Actually, I can foresee an entire cottage industry springing up around this: Buy a smart device because you can't buy anything else, then take it down to Bodgy Bob's Mods and have him rip out its innards leaving only the basic mechanical function active. A fridge has a cooling element powered by a compressor and regulated by a thermostat. It can't be too hard to rip out all the electronics and leave just the thermostat-compressor loop active. Same with any other device. You just have to be prepared to chuck your warranty out the window. But considering the high turnover the planned obsolescence this article clearly refers to will cause, warraties aren't worth anything anymore anyway.

[Mark 85]

Re: It's insidious

Upvote for that. Well reasoned and well said. I'll be surprised if the marketing types aren't waiting for you in a darkened alley.

[Tromos]

Re: It's insidious

Presumably because the IoT controlled alley lighting has been pwned.

[tiggity]

Re: It's insidious

I can think of a "valid consumer oriented reason" reason for an internet connected toaster.

There exist toasters with preconfigured heating elements to "toast" a certain image onto your bread.

Going a step further a programmable heating element array configuration would let you change the image printed.

With internet connectivity I could thus get my daily xkcd "burned" on my morning toast

So, IoT for the win.

(Full disclosure - this post may be less than 100% serious)

[Lamont Cranston]

Re: xkcd on toast

I've had to downvote you, just for giving them ideas. You weren't being serious, but no doubt a lightbulb has just gone on over someone's head, now that they have a reason to sell an online toaster.

[Anonymous Coward]

Re: It's insidious

So True. It used to be that an advert extol how well a thing does something now all they do is tell you how happy you'll be.

[Anonymous Coward]

"stop connecting everything to the internet & spend more time doing better systems engineering"

*** I've been following the process and feel that the elephant in the room is that some corporations are bullying the market into IoT / Smart, simply by removing choice.

*** Samsung here's looking at you! Its not ok to stop selling basic non-Smart TV's, basic phones, basic washers etc. Forcing consumers over to overpriced Smart / IoT that are not ready for prime-time and lawlessly slurp... That's highly deceptive shitty economics!

*** But there needs to be incentives for offering choice in the market. Consumers especially, need to be able to buy cheap basic reliable tech while all the complexities of security and standards for IoT are resolved. This incentive needs to come from strict consumer rulings and hefty fines arising out of sloppy IoT tech, not private lawsuits where only the lawyers win or back room deals.

*** Privacy didn't get much of a mention today or its being lugged in with security. C'mon corporations, wake the fuck up. We don't want every device prying like a mini-omnipotent Facebook / Google. That's 'surveillance-capitalism'! If that's the future, i.e. no choice, then its finally time to turn the clock back and stop living in a consumer led society imho.

[Anonymous Coward]

Re: "stop connecting everything to the internet & spend more time doing better systems engineering"

Why would you buy a non-smart TV anyway?

The economies of scale are with making one standard chipset and software. Non-smart TV's need chipsets and software too. Making it smart surely doesn't add enough cost per device to offset the mass manufacturing benefits.

I mean, I bought a 48" UHD Samsung smart TV for about £650 6 months ago. How much cheaper do you think it would be if it wasn't smart? They're practically giving them away already.

You can always unplug it, you know?

[Anonymous Coward]

You can always unplug it, you know?

Ah, yes the old "just don't connect it to your network" argument.... ....Assumptions... The mother of all fuckups...

...1. Some Smart TV's disable features if you don't let them phone home. This is well documented. Past Reg articles have covered this with posters likening it to Overton-Window syndrome...

...2. At a residents meeting last year, we learned that a rogue kid in the area had connected several neighbours TV's to the net! It was 6 months before it was discovered...

...3. Some posters like to post that Smart TV's don't hunt for open connections... But that's more assumption making... No one expected LG to log the names of USB files opened on their smart TV's, yet they did! Manufacturers are far more desperate than many realize, as margins have vanished.

...4. Do buyers pay an extra premium for Smart, when the extra chipsets aren't needed??? In general Smart does cost more. Manufacturers have been offsetting this by monetizing consumers. What do you think will happen if sufficient consumers don't connect... Prices will go up or down...???

...5. Is there a different MTTF for Non-Smarts because they have fewer chips, that's the real million-dollar key question imho....

[Anonymous Coward]

Re: You can always unplug it, you know?

They don't disable the HDMI inputs and DVB tuner, do they? That's all a non-smart TV does anyway.

I'd imagine the chip count is the same, just with a more powerful general purpose processor for the smart TV.

[Anonymous Coward]

Don't connect my toaster / no more Orwellian tech...

That all falls on deaf ears... Here's why... Consumers need to wake up and stop buying, send a message:

https://www.theguardian.com/technology/2016/may/02/google-microsoft-pact-antitrust-surveillance-capitalism

[Mike 16]

Patches, and Patches

It's one thing to say "We will provide patches for this device until YYYMMDD", and quite another to guarantee "And the device will still be fit for purpose after the patch". I've lost track of the number of times I "upgraded" a device that was listed as satisfying the "system requirements", only to find that "runs" is not equivalent to "runs sufficiently well to not be completely useless". Annoying when the device is a phone or PC. Worse when it's my furnace, or auto.

[J. R. Hartley]

C-Bus

Currently working out a plan for fitting a C-Bus system to my house, initally for lighting. It's been a standard for decades. It's expandable and future proof. It's the only way.

Internet fridges can fuck right off though.

[Tromos]

Re: C-Bus

I disagree. Internet fridges are a great idea. Just one question. How do I upload and download my food?

[Kevin McMurtrie]

More than IoT

This should cover a lot more than little IoT devices. I've had two cellphones that were abandoned while under warranty. Lenovo is selling Moto phones right now that lost support months ago.

[martinusher]

IoT seems to be one Big Fail

Most products have some kind of processor in them these days and somehow they get by without being patched every five minutes. There's actually a reason for this and its not just that 'they're too simple' or that 'they're not connected to the Internet'. IoT seems to be an accident waiting to happen, an accident caused by badly designed, constructed and implemented protocols using significant complexity to perform simple tasks. These protocols come about because of a combination of shortsighted engineering -- Web protocols are apparently all people know these days -- and the omnipresent marketing push to stick their nose into everyone's business 'the better to get to know them'.

This kludge may be why there's no huge rush to buy IoT devices. Its a bit like the early days of music players. A MP3 player is a simple thing but early designs were screwed up by a need to monetize the customer base (something only Apple really figured out how to do). Then, as now, customers are faced with an array of devices that cost a lot, don't do very much, are prone to be hacked and can have support withdrawn from them at a moment's notice. What's not to like about that?

(Incidentally, if you like remote on/off, dimmers and so on then you've been able to buy them for over 40 years as 'X10' devices. Hooking an X10 controller to a remote protocol is a no brainer.)

[Anonymous Coward]

Re: IoT seems to be one Big Fail

I do wonder why they really need patching.

If they all talk, behind a NAT, to a controller and that controller only makes outbound connections ( over TLS or similar ), then only the controller may ever need to be patched. Even then, only if the TLS is broken.

That's how they work already, isn't it?

( First person to say that NAT isn't a firewall gets a punch to the groin )

[Anonymous Coward]

Re: IoT seems to be one Big Fail

The problem is how does the "Thing" find the controller? The defacto standard is UPnP. OP appears to be unaware that UPnP can/does let "Things" AUTOMATICALLY program upstream "firewalls"/"routers" to permit INBOUND port forwarding from the internet.

Seriously guys, WTF thought that was a good idea?!

[Anonymous Coward]

Re: IoT seems to be one Big Fail

So?

Unless the devices are already compromised ( in which case you're buggered anyway ), they won't open ports. As they only communicate through the hub and the hub only makes outbound connections, they're safe.

[Anonymous Coward]

This:

"That means that when you buy your smart thermostat, or lightbulb, or door lock, a manufacturer will commit to updating and patching it for N number of years, with the date stuck on the box on a label".

Until, 6 months after purchase the company goes tits-up. Then your 10 years patch garantee isn't worth shit.

A better idea would be an open source core that can be picked up by "hobbyist" coders as thats about the ONLY way to guarantee* continued support.

*In an ideal world.

[lukewarmdog]

I'm not sure this is a good idea at all.

Say I buy a smoke detector and it says "google will support this for two years". I'm not going to buy it knowing it only has a two year effective lifespan. I'd honestly rather buy the Internet-free version even without such a "guarantee".

Alternatively I buy a smoke detector with a two year support guarantee and ignore it, like any good shopper would. After two years it's still a smoke detector but now it's also a botnet.

I'm not seeing what real purpose this serves.

It surely also leaves the way open for "generic smoke detector with an online component" with support and updates and mods so you can play pong on it from a Linux community. I hesitate to say "like Cyanogen" given their current circumstances but something like that anyway. Maybe a modular system so ongoing support can also help you build the IoT house. If Google don't slap you down of course.

[Anonymous Coward]

generic IoT component with open-standard authenticated comms

a lot of these generic devices do exist: thermostats, humidity, etc. - well, basically any sensor -

but their supplier is currently China via eBay (where there are some annoying compatibility problems with counterfeit gear). They are very much DIY, arduino+RPi projects. Very botnet resistant.

The sensor mesh comms can be authenticated/signed [but not encrypted so as to avoid TLA aggression] MITM is vaguely possible (https://github.com/Yveaux/NRF24_Sniffer), I did have some success at that, but I don't really mind my neighbours knowing that

0;0;3;0;9;read: 105-105-0 s=255,c=3,t=12,pt=0,l=3,sg=0:1.0_105;255;3;0;12;1.0

is my current status, provided that only I can change it. [protip - consider changing this in MySensors library MyConfig.h

// Key to use for HMAC calculation in MySigningAtsha204Soft (32 bytes)

#define MY_HMAC_KEY 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 - to something a little less predictable]

more at

https://forum.mysensors.org/topic/1021/security-introducing-signing-support-to-mysensors/2

'nother tip, I found the semiconductor pressure sensor for arduino IoT so sensitive, such high resolution, that it does the whole 'house alarm' system in a single component. It's been fairly easy to correlate the 'nano'-changes in domotic atmospheric pressure with a particular door or window open or almost which specific person (or cat) is walking in the room! no-need for door/window vibration sensors - just sample the atmosphere

These DIY systems are potentially a lot better than cloud-based NESTy things, but aren't yet ready for wide deployment, need a few more person-years of testing & experimentation before release

[G2]

F.U. Moto / Lenovo

is this guaranteed maintenance labelling system going to also be mandatory for smartphones / mobiles?

my Moto E(gen2) 2015 phone 4G LTE XT1524 (surnia) is still stuck at android 6.0....doesn't seem that even 6.0.1 is going to be available anytime soon and the damn thing is still in warranty for one more year. (bought it retail,unlocked, in september 2015 with a 2-year warranty)

Motorola / Lenovo won't bother to update it anymore... when Moto launched it in february 2015 with Android 5.1 they promised us regular updates, then they posted a big 'FUCK YOU, (L)USERS' message on the official Moto blog, then they recanted that and grudgingly released an update to Android 6.0 and now they won't say anything else about the promised regular updates... basically, the message from Moto/Lenovo is 'HAHAHA, FUCK YOU, (L)USERS, AGAIN'... :((

[Anonymous Coward]

Future robot overlords - Please forgive us our sins, we weren't all in "Marketing"

Manufacturers trying to limit less time for a "cheap" device vs an expensive one is a business decision (duh). Bad news is they're all (almost certainly) going to be connected for a VERY long time...

There is a solution, but personally I REALLY don't like it:- instead of "buying" devices, it will be "licensed" for a limited TIME. So when support runs out the device stops working (or at least the internet functionality). Revenue for the manufacturer up front and repeatedly into the future thanks to (now explicit) planned obsolescence.

Of course device security will come with cryptographic protection, which carries jail time if circumvented so "adding" law that "regulates" manufacturers here is actually in their favor and brings a governmental guarantee to protection of revenue streams.

Sorry, did I say "will"? It's already happening... :-(

Question then becomes how is the "deactivation" handled? Folks are going to be mighty interested in manipulating that expiration functionality (both ways).

Take a more existential point of view and it should be pretty clear that Skynet and Batty's motivation are the same as Johnny 5's - "No disassemble! Alive!".

TLDR - Substitute "IoT" for "AI" or "Thing" for "Machine" and we have the plot of practically every SciFi movie in recent history.

[carl.stokes]

What manufacturers are not taking into account is the simple fact that a fridge is not like a mobile phone. Most people will happily upgrade their phone annually to get the latest model often paying extortionate monthly prices to have the latest fastest shiny.

People replace their fridge when it no longer keeps their food cold. I can understand the desire from manufacturers to further build in timed planned obsolescence. But are the general public going to stand for it? I do think their is a limit to this.

[Steven Roper]

What boots it that the public won't stand for it when intrusive IoT fridges designed to pack up after 3 years are the only kind you can buy? The free-market argument of capitalism has failed because there is now a cartel of massive suppliers, who collude in establishing control of the marketplace.

So, you need a fridge. And you can choose from Smasung, LG, Hisense, Westinghouse, or Fisher & Paykel. All of who make basically the same fridge with the same limitations and the same IoT spying ability.

What do you do? Your options are to buy one of these smart fridges or give up on refrigerated food - which I can tell you from youthful experience comes down to eating out of cans. You can bitch and moan and say you won't stand for it but you still had to buy one and the company still made their money.

Suppose an upstart startup decides to exploit the market for "non-smart" fridges, assuming there is one: while Reg readers seem to be universally opposed to this whole IoT shit, the great unwashed don't give a fuck. They're already spewing every detail of their lives out on Facebook anyway, so why would they care about IoT privacy? But, suppose this startup decides there is a privacy-conscious market after all and starts making fridges to cater to it. The big manufacturers, as soon as they see their intrusive surveillance-capitalism model threatened, simply contact all the big box stores and tell them that if they stock this startup's non-smart fridges they'll lose their supplier discounts. Bam - said startup now has no way to sell fridges, short of online, which is going to restrict their market since most people still like to browse a big-box store for large whitegoods and major appliances.

So if these bastards want to get into your home, how do you stop them? In an earlier post I mentioned a cottage industry springing up to strip out the smart stuff from these things aftermarket - but I can see that becoming a sketchy underground setup like console modchips, that soon would get shut down by an army of corporate lawyers. When was the last time you saw a modchip provider for the latest consoles? It wouldn't be long before "de-smarting" shops would suffer the same fate.