<story><title>The Mirai Botnet Is Proof the Security Industry Is Broken</title><url>https://blog.appcanary.com/2016/mirai-botnet-security-broken.html</url></story><parent_chain><item><author>whack</author><text>That&amp;#x27;s a great point regarding the economics of why IoT manufacturers don&amp;#x27;t invest all that much on security. Here&amp;#x27;s another one. It&amp;#x27;s an externality. Botnet attacks don&amp;#x27;t harm the IoT manufacturers. They don&amp;#x27;t even harm the IoT products or their users. They harm completely innocent bystanders like DNS&amp;#x2F;github.&lt;p&gt;What possible incentive do IoT manufacturers have to invest money on initiatives that bring no benefits to themselves, or their customers? What possible incentive do users have to follow &amp;quot;proper security protocols&amp;quot;, when they can just do something simple&amp;#x2F;convenient, and if something goes wrong, some random internet website pays the price.&lt;p&gt;As idiotic as this sounds, the only non-regulatory solution I can think of is for all potential BotNet victims to collectively &amp;quot;bribe&amp;quot; the IoT companies into following proper security protocols.</text></item><item><author>Analemma_</author><text>I wish more people would talk about the economics of why netsec is such a garbage industry. It&amp;#x27;s a few honest people screaming to be heard above the din of snake-oil salesmen, but there&amp;#x27;s an economic reason that goes beyond &amp;quot;dumb users, incompetent programmers and CTOs who just look and speeds and feeds&amp;quot;. The problem is there&amp;#x27;s weak correlation, or at least very difficult-to-see correlation, between the amount of effort you put in on security and the results you get.&lt;p&gt;You could have no security and just get lucky and never get hacked. Or you could have great security and just get really unlucky and have a determined hacker. Or you could be spending uselessly and still getting lucky, although you (and your vendor!) attribute your good fortune to the product. This kind of information failure makes it really hard to have a functional and efficient market, even when everyone involved is honest.&lt;p&gt;I don&amp;#x27;t have a good solution for this, which I why I hope someone smarter than me brings it up.</text></item></parent_chain><comment><author>redbeard0x0a</author><text>If ISPs turned off your connection if it was found that something on your network is part of an active attack of a botnet until the problem is cleaned up. Now the &amp;#x27;victim&amp;#x27; (I&amp;#x27;d not really say victim because they chose the cheapest webcam online) has to figure out (or hire somebody to) clean up their network.&lt;p&gt;If there are actual consequences for people&amp;#x27;s computers and IoT devices being &amp;#x27;hacked&amp;#x27;, they will start to look for ways to avoid the inconvenience in the future. They might start using better passwords, not installing every toolbar under the sun, demand better products (and accountability) from the companies they purchase items from.&lt;p&gt;tl;dr;&lt;p&gt;The only way to get some of these problems fixed is to introduce some level of pain, somewhere in the system. I say penalize the consumer who decided to buy the cheapest thing online - turn off their Internet connection when an infected device is found.</text></comment>
<story><title>The Mirai Botnet Is Proof the Security Industry Is Broken</title><url>https://blog.appcanary.com/2016/mirai-botnet-security-broken.html</url></story><parent_chain><item><author>whack</author><text>That&amp;#x27;s a great point regarding the economics of why IoT manufacturers don&amp;#x27;t invest all that much on security. Here&amp;#x27;s another one. It&amp;#x27;s an externality. Botnet attacks don&amp;#x27;t harm the IoT manufacturers. They don&amp;#x27;t even harm the IoT products or their users. They harm completely innocent bystanders like DNS&amp;#x2F;github.&lt;p&gt;What possible incentive do IoT manufacturers have to invest money on initiatives that bring no benefits to themselves, or their customers? What possible incentive do users have to follow &amp;quot;proper security protocols&amp;quot;, when they can just do something simple&amp;#x2F;convenient, and if something goes wrong, some random internet website pays the price.&lt;p&gt;As idiotic as this sounds, the only non-regulatory solution I can think of is for all potential BotNet victims to collectively &amp;quot;bribe&amp;quot; the IoT companies into following proper security protocols.</text></item><item><author>Analemma_</author><text>I wish more people would talk about the economics of why netsec is such a garbage industry. It&amp;#x27;s a few honest people screaming to be heard above the din of snake-oil salesmen, but there&amp;#x27;s an economic reason that goes beyond &amp;quot;dumb users, incompetent programmers and CTOs who just look and speeds and feeds&amp;quot;. The problem is there&amp;#x27;s weak correlation, or at least very difficult-to-see correlation, between the amount of effort you put in on security and the results you get.&lt;p&gt;You could have no security and just get lucky and never get hacked. Or you could have great security and just get really unlucky and have a determined hacker. Or you could be spending uselessly and still getting lucky, although you (and your vendor!) attribute your good fortune to the product. This kind of information failure makes it really hard to have a functional and efficient market, even when everyone involved is honest.&lt;p&gt;I don&amp;#x27;t have a good solution for this, which I why I hope someone smarter than me brings it up.</text></item></parent_chain><comment><author>VodkaHaze</author><text>Externalities are usually solved through pigouvian taxes.&lt;p&gt;But since we can&amp;#x27;t really know in advance what product will&amp;#x2F;won&amp;#x27;t be secure (or at least it&amp;#x27;s incredibly difficult in the constantly goalpost moving security industry) the only way I can see this happening is if, say DYN could sue the IoT manufacturers for negligence or something of the like.</text></comment>