[Mud] a place MUD would have helped --- US security cameras

[Michael Richardson <[e-mail]>]

btw: I don't think it's actually fair to single-out cameras from a single
     country. I haven't read the Act (nor am I likely to), but it imagine
     if it had used positive language like, "the country of origin and
     the manufacturing firm MUST be easily identifiable on packaging
     and via firmware provided information, such as RFC8520"

{I am taking everything Bloomberg writes with a medium sized grain of salt,
after the spy chip story.}

https://www.bloomberg.com/news/articles/2019-07-10/banned-chinese-security-cameras-are-almost-impossible-to-remove says:

   But thousands of the devices are still in place and chances are most won’t
   be removed before the Aug. 13 deadline. A complex web of supply chain
   logistics and licensing agreements make it almost impossible to know
   whether a security camera is actually made in China or contains components
   that would violate U.S. rules.  

   The National Defense Authorization Act, or NDAA, which outlines the budget
   and spending for the Defense Department each year, included an amendment
   for fiscal 2019 that would ensure federal agencies do not purchase
   Chinese-made surveillance cameras. The amendment singles out Zhejiang
   Dahua Technology Co. and Hangzhou Hikvision Digital Technology Co., both
   of which have raised security concerns with the U.S. government and
   surveillance industry.

   ...

I wrote on the IoTSF basecamp in the thread about this:

   It's amazing, but hardly surprising.  The lack of comprehension of among
   the (US) supply chain of the risks of relabelling has been going on for
   decades.  Swapping internal components (even moving to completely
   different CPUs) without changing the label on the outside is something
   that many US based suppliers of equipment including Cisco/Linksys, Nortel,
   Polycom, Belkin, etc. have done repeatedly to the frustration of their
   customers who want to do simple things like just upgrade firmware
   regularly. 

   If Honeywell doesn't know what they sold, then they can hardly be expected
   to comply to needs to issue CVEs, etc. which suggests that both the customer
   and the supplier had no plans at all to ever think about firmware updates to the
   devices.  Were I in charge, I'd be firing/demoting people in the *government*
   who did this procurement, and not just cancelling contracts but going for
   breach of contract.   

  Let me suggest some ways in which this could have been prevented. (You'll
  hardly be surprised at my self-promotion, but I'm working in this area for
  a reason...)  Two key and usefully intertwined technologies: had RFC8520
  (MUD) been required for the cameras, then the MUD URL presented by the
  *firmware* might have sliced through all relabelling BS, and would
  identified the product relatively well.

  If a proper onboarding system had been used that transferred ownership
  control to the legal owner, then that could   have resulted in a clear
  IDevID reference to the manufacturer, and through the onboarding process, an 
  actual inventory of devices.  The "BRSKI"
  (draft-ietf-anima-bootstrapping-keyinfra) system that I'm a key author of 
  is one such system; there were two talks at last year's IoTSF on BRSKI.
  BRSKI is one of the better ways to pass the MUD URL on.   

  Firmware attestation is also important, not because it detects malicious
  firmware like was shipped by Dahua (honestly, how is that not a death
  sentence for the company?) , but because it forces the manufacturer of the
  firmware to identify itself. 

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [