• trackcharlie@lemmynsfw.com
    link
    fedilink
    English
    arrow-up
    10
    arrow-down
    2
    ·
    10 个月前

    Nearly all IoT items are developed for idiots, which is interesting because most of them are also made by idiots.

    • GBU_28@lemm.ee
      link
      fedilink
      English
      arrow-up
      9
      ·
      edit-2
      10 个月前

      Iot wrenches are built for blue collar workers to ensure proper tooling of complex parts on production lines

      • towerful@programming.dev
        link
        fedilink
        English
        arrow-up
        8
        ·
        10 个月前

        And to then certify it’s tightened to spec and send that cert to a logging server, for things like aviation

        • agitatedpotato@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          edit-2
          10 个月前

          Why doesn’t the wrench then only have the ability to talk to a local server and that server have internet then? If that were the case the wrench would have no reason to download anything from the Internet, just speak to the local server. Probably wont fix every vulnerability but it can’t be more vulnerable.

          • towerful@programming.dev
            link
            fedilink
            English
            arrow-up
            2
            ·
            10 个月前

            Yup, that would be sensible security practices.

            The wrench has a web UI to program it or monitor it. It also talks a few “standardised” car-manufacturer protocols for recieving and sending instructions/measurements/certifications. And it can send also send stuff to a local history server.

            The majority of the CVEs seem to exist in its onboard webUI system, with a few in the manufacturing protocols.

            But yes, IoT devices should be on an isolated vlan or on pvlans. That should be standard practice.

            Access from wrench->server should be via a firewall that logs connections. And access from management->wrench should be via firewall with logging.
            There is no reason for unauthorized people to have access to the wrenches network, and there is no need for the wrench to communicate with anything other than the local history server.