Vulnerabilities / Threats

8/1/2017
03:00 PM
50%
50%

US Senators Propose IoT Security Legislation

A new bill aims to prohibit the production of IoT devices if they can't be patched or have their password changed.

A group of US senators today introduced a bill in Congress that would require Internet of Things (IoT) manufacturers to produce devices that could be patched, have passwords updated, and come to the market without known security vulnerabilities, according to a Reuters report.

The bill also calls for federal agencies to have the freedom to purchase non-compliant IoT devices should this legislation pass, if they get approval from the US Office of Management and Budget, according to Reuters.

The legislation also proposes expanding protection for cybersecurity researchers, when they are attempting to hack IoT devices in search of bugs to report to the manufacturer, the report noted.

The bipartisan group of senators includes Republicans Cory Gardner and Steve Daines, and Democrats Ron Wyden and Mark Warner, according to Reuters.

Read more about the bill here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Christian Bryant
50%
50%
Christian Bryant,
User Rank: Ninja
8/2/2017 | 7:41:20 PM
Expanding Protection for Cybersecurity Researchers
I think this block of text is the best thing to come out of cybersecurity-related legislation in a long time:

"The legislation also proposes expanding protection for cybersecurity researchers, when they are attempting to hack IoT devices in search of bugs to report to the manufacturer, the report noted."

Now we just need to be sure this "protection" is expansive, well-defined and is implemented sooner than later. 

One of the biggest hurdles to keeping cybercriminals off the lawns of the good guys is protection of our black ops "researchers" and Red Teams. 
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
8/2/2017 | 9:00:12 AM
When Congress gets involved.......
Please Senators - stay in your career field and let the professionals do their jobs.  Whenever Congress writes a law it's a joke and when they make a joke, it's a law - said Will Rogers.
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
Mueller Probe Yields Hacking Indictments for 12 Russian Military Officers
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/13/2018
10 Ways to Protect Protocols That Aren't DNS
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/16/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10869
PUBLISHED: 2018-07-19
redhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file accessible by the user running httpd.
CVE-2018-10870
PUBLISHED: 2018-07-19
redhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile. A remote attacker could use this flaw to overwrite any file, potentially gaining remote code execution.
CVE-2018-12959
PUBLISHED: 2018-07-19
The approveAndCall function of a smart contract implementation for Aditus (ADI), an Ethereum ERC20 token, allows attackers to steal assets (e.g., transfer all contract balances into their account).
CVE-2018-14336
PUBLISHED: 2018-07-19
TP-Link WR840N devices allow remote attackers to cause a denial of service (connectivity loss) via a series of packets with random MAC addresses.
CVE-2018-10620
PUBLISHED: 2018-07-19
AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code t...