White House unveils Cyber Trust Mark program for consumer devices

You might be getting a bit too far ahead of where the industry is at with some of those wishlist items. NIST's requirements are things that are best practices that everyone agrees with, like:

* data stored/transmitted is secured by some kind of means

* the device supports software updates

* the device requires users to authenticate

* the device has documentation

* you can report security vulnerabilities to the developer

And even these are things that many devices fail to do, today. We gotta get the basics fixed first.

But for now, you can presume the Netflix button on your TV remote can't be configured to point to an alternative API if Netflix goes away. :)

The device doesn’t ship with a known, unchangeable admin password. The device doesn’t needlessly require Wi-Fi access for basic local functionality. [my wish list]

> If that data is certified as end to end encrypted

This needs better and more detailed clarification. I've reverse engineered a camera-equipped pet feeder, and videos sent to a cloud (or my emulating server in my case) were partially encrypted - I-frames were, P-frames were NOT. Someone ticked a checkbox "videos are encrypted", and still left the thing glaring open.

Then, of course, it's also a matter of ciphers and modes, authentication, key generation, transmission and storage, etc etc.

Feels like encrypted storage and transmission features alone require a full whole label, like the FCC's broadband facts label, or FDA's nutritional facts label, which outlines what data exists in the system, where the data is stored, how it's encrypted, how it's authenticated, and so on.

Which is probably not happening until cryptography 101 becomes a part of general school curriculum and layman people start to understand the basics. Without people asking real questions and refusing to purchase products from sloppy engineering companies (aka voting with their wallets*), companies will always wave it away with tried-and-proven "military-grade security" bullshit.

___

*) That is, if there's even a competition. When no one does things right (because consumers don't know and thus don't ask for it), there's nothing to pick from.

another question: how does this work with open-source technology? Banana Pi for example is often considered an IOT.

Can we add that it's self-repairable domestically?

Some questions already answered in article - from gov't responsible NIST and FCC and from industry agreed to participate deputies from large companies, so now they will gather meetings and will create some documents.

So now, any interested subject (any human or entity, even "group of hackers") could ask to responsible. Or could talk with deputies, as their contacts should appear soon.

Seems to me that this would wholesale rule out projects like the ESP32 open WiFi driver. Or rather, in order to comply, espressif would have to retool their chips to make "unauthorized" aceess to the raw radio hardware impossible. Sort of how cellular modems are now.

Seems reasonable from the FCC's perspective, but I'm not sure how I'd feel about it.

Yeah, nowadays i try to buy many things that are "not smart" in order to avoid what you experienced with the smart scale. That being said, i wonder if what you're asking for is more on the warranty side, rather than security/promise side? To clarify, i am 100% in agreement with you that after a company stops supporting a product, they should open source it (which could create a secondary ecosystem of techs who offer services to support said open source software if a person is not inclined to manage the OSS themselves, etc.)...However, technically wouldn't a company's "promise" to support software be more like a warranty? And in that case, whatever gov. agency who oversees warranties would need to nudge business to comply...nevertheless both this cybermark, a warranty on software lifecycle, and other things are the LEAST that shoild exist nowadays.

In Germany we had something like this from the TUEV Süd, where they certified online shops and online banking websites for their security.

Suffice it to say, but the keywords are a google dork for finding easy to hack pentesting victims.

Now the BSI (German institute for cybersecurity, similar to CISA) also started to push out certifications for the BSI Grundschutz, which is an absolute meaningless certificate and literally tests the absolute bare minimum things.

The problem here is that there is no market, this cyber security crisis cannot be solved economically, because customers want a certificate without having to do further work. So they'll get it at whatever auditor that accepts their money.

This is how it's done, even for ISO 27001 and SOC2 certifications. Nobody gives a damn if a single working student has 20+ role descriptions laying on their table. Findings are always ignored and never corrected.

Cyber security policies and their effects over time need to be measurable first before there can be certification processes.

Additionally there needs to be legislation that cannot be interpreted. Things like "reasonably modern" cannot be used as a law text because it doesn't mean anything, and instead standardized practices have to be made mandatory requirements. Preferably by a committee that is not self controlling, maybe even something like the EFF, FSF, OWASP or Linux foundation.

> I know there's no government program that could actually ensure a device is secure

Well, there's SELinux, TOR

Laser safety glasses in Amazon are so fake anyone could come up with a conspiracy theory about some country trying to blind the population of another.

[flagged]

NIST isn't a bunch of dummies that don't know this. The requirements posed are not micromanagement of device design; some address your concern exactly... like a requirement that developers provide contact information to report vulnerabilities and that devices makers just can't ignore authentication entirely.

But this is IoT stuff we're talking about here, not Lenovo/Cisco... but ReoLink/PETLIBRO/eufy/roborock/FOSCAM/Ring/iRobot/etc. Security (or the lack of it) in the IoT world is a whole different ball game. It isn't uncommon for IoT devices to be EOL on release date, or just lack authentication or encryption entirely.

Picking and choosing companies like that could work if it could somehow remain apolitical. This registry can work despite the tendency for these things to become political.

What you’ve described is maybe more possible if provided by a Consumer Reports-style org that consumers could subscribe to.

When I buy technology today, I'm 10X more worried about the manufacturer deliberately changing, killing or nerfing the product after I bought it, than I am worried about hackers compromising it. This goes for connected hardware, IOT devices, and software.

https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8425.pdf

Yep, pretty basic stuff, like 'require authentication', 'support software updates', etc

> 2) Who is inspecting the code, both server-side and device-side?

UL is administering the program and they're going to come up with the requirements

> UL Solutions will work with stakeholders to make recommendations to the FCC on a number of important program details, like applicable technical standards and testing procedures, post-market surveillance requirements, the product registry, and a consumer education campaign.

https://www.ul.com/insights/us-cyber-trust-mark

Here are requirements if you follow the China-bad politics:

1) Don’t be select Chinese products

2) Be select American products

It’s not reaaaally 3d chess, but a relatively crude misnomer for the “Made in America” stamp or “Its American and definitely not Chinese”.

The security practices are probably the same across products, it’s just the wrong time wrong presidency for China.

Good questions. As I understand, they spent months to decide who will be responsible and who will pay (and how much). Announce happen after budget passed Parliament, so now could make manning table and hire people for next steps.

They describe it as being like EnergyStar which suggests they'll have a consumer accessible registry as described here:

https://www.ul.com/news/ul-solutions-named-lead-administrato...

> UL Solutions will also work with the FCC and program stakeholders to develop a national registry of certified products that consumers can access via QR code on the label. The registry will have more detailed information about each product. Additionally, UL Solutions will serve as liaison between the FCC and other CLAs, as well as other key stakeholders. [emphasis added]

and here:

https://www.fcc.gov/CyberTrustMark

> The logo will be accompanied by a QR code that consumers can scan, linking to a registry of information with easy-to-understand details about the security of the product, such as the support period for the product and whether software patches and security updates are automatic.

This doesn't block full-blown counterfeit products (recreating certified devices including the label), but does address non-compliant devices trying to pose as compliant.

You have to have rules before you can enforce them...

It looks like part of the label [1] will include a QR or link to a public registry, so in theory you can easily confirm the device has actually been certified.

[1] https://docs.fcc.gov/public/attachments/FCC-23-65A1.pdf point 42

The vendor is supposed to check I think. Not that that makes sense in a comingling inventory world.

> What's to stop the bad actors from just printing the logo on their gear anyways?

This is federal offense, like document falsification.

So if somebody will be caught on doing it - could go to jail.

Underwriters Laboratories, UL. Look at the back of pretty much any mains powered device and you'll see their mark. They were founded 130 years ago, and test and warrant devices (typically high voltage) to be safe. Security is a new thing for them, but they're well suited to provide the services.