Ransomware Spreading onto Smart TVs, Is a Pain to Fix
Personally, I&#x27;m wary of ideas like software engineers facing unlimited personal liability like hardware engineers, because computer science just hasn&#x27;t advanced to a point where we can say with confidence that any non-trivial piece of code works correctly (or even define what that means).<p>However, I do think there needs to be some serious financial penalties for companies like LG, Samsung, D-Link, etc., who ship flagrantly insecure firmware that in many cases is uneccessary, is almost never supported for anything like the realistic lifetime of the device, and where it is clear to anyone with industry expertise that they have demonstrated a negligent lack of basic competency.<p>For example, back in 2007 it <i>might</i> have been acceptable to store passwords as salted MD5. Nowadays, not good enough. Any hardware made competently then might have used a salted MD5 password store. Fine. But really, patches should be provided for at leat 10 years and those patches should bring firmware into line with the current state of the art. Thus I think it would be reasonable to sue a hardware manufacturer for a device made in 2007, still in service in 2017, which cannot be updated to have better password security than salted MD5.<p>It of course goes without saying that things like default passwords (admin:admin etc) should be considered outright unacceptable in any network-enabled consumer device.<p>Obviously we can&#x27;t hold device manufacturers liable forever, nor can we expect NSA-proof levels of security, but I think it is reasonable to hold all hardware to a standard of &quot;basic competency&quot; for at least 10 years from the date of manufacture. The standard warranty period of 1-2 years is not sufficient.<p>There is at the moment a serious risk&#x2F;reward imbalance where it makes financial sense to ship &quot;features&quot; (even if nobody asked for them) at the expense of security, because the subsequent issues are someone else&#x27;s problem. This is bad for device owners and bad for society as a whole, since compromised devices are commonly used for DDOS attacks, sharing child porn, etc.<p>If device manufacturers knew there were serious financial consequences and that all features must be kept secure for 10+ years, they would certainly be more interested in making things modular and reducing potential attack surface areas than they are now.