Slashdot Mirror

← Back to Stories (view on slashdot.org)

Consumer Reports To Consider Cyber Security in Product Reviews (reuters.com)

Posted by msmash on from the changing-landscape dept.

Consumer Reports, an influential U.S. non-profit group that conducts extensive reviews of electronic products, cars, kitchen appliances and other goods, is gearing up to start considering cyber security and privacy safeguards when scoring products. From a report: The group, which issues scores that rank products it reviews, said on Monday it had collaborated with several outside organizations to develop methodologies for studying how easily a product can be hacked and how well customer data is secured. Consumer Reports will gradually implement the new methodologies, starting with test projects that evaluate small numbers of products, Maria Rerecich, the organization's director of electronics testing, said in a phone interview. "This is a complicated area. There is going to be a lot of refinement to get this right," Rerecich said. The effort follows a surge in cyber attacks leveraging easy-to-exploit vulnerabilities in webcams, routers, digital video recorders and other connected devices, which are sometimes collectively referred to as the internet of things.

47 comments

  1. About damn time... by TWX · · Score: 3, Interesting

    ...and really, most products should get terrible marks to start with.

    This is in many ways what IIHS did, that compelled the auto industry to make ever safer cars. The NHTSA crash testing is so hobbied by laws designed to make it ineffective that it took the insurance companies, tired of paying out claims for AD&D to embarrass car makers into making safer cars.

    I have a feeling that if Consumer Reports isn't successful, increasing payouts by insurance companies when breaches occur might be.

    --
    Do not look into laser with remaining eye.
    1. Re:About damn time... by Anonymous Coward · · Score: 0

      What does Advanced Dungeons & Dragons have to do with auto insurance claims?

    2. Re:About damn time... by TWX · · Score: 1

      No one likes getting locked up, and try getting that out of the upholstery after the surprise of seeing a dragon...

      --
      Do not look into laser with remaining eye.
    3. Re:About damn time... by AmiMoJo · · Score: 1

      tired of paying out claims for AD&D to embarrass car makers into making safer cars.

      People were outing AD&D players at car makers to embarrass them into making safer cars?

      Wow. I knew there was some social stigma, but... Wow.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
  2. Don't believe it will help by Anonymous Coward · · Score: 0

    The fact is, people don't care, and can't be bothered to care until the machines rise up and terminate us all.

    1. Re:Don't believe it will help by oh_my_080980980 · · Score: 3, Insightful

      There's a difference between not caring and not being informed. Most people do not know what the risks are. When someone can hack your thermostat, you are going to care!

    2. Re:Don't believe it will help by gnick · · Score: 2

      When someone can hack your thermostat, you are going to care!

      When somebody hacks your thermostat, you are (probably) going to care. Nobody gives a rat's ass until the consequences are tangible.

      --
      He's getting rather old, but he's a good mouse.
    3. Re:Don't believe it will help by Anonymous Coward · · Score: 1

      And that's assuming that they change the settings. If somebody hacks your thermostat, leaves the settings along, and uses it as part of a DDOS attack, there will still likely be zero cares given.

      -gnick

    4. Re:Don't believe it will help by AK+Marc · · Score: 1

      If someone hacks it to make it rise 1 degree a week, it'll be a minor annoyance. If they set it to +100 for 20 seconds then -100 for 20 seconds (or 2 ms each), alternating until your system catches fire and burns down your house, you'll care.

      --
      Learn to love Alaska
    5. Re: Don't believe it will help by fluffernutter · · Score: 1

      I live where water freezes at outside temperatures and I very definitely care if someone can hack my thermostat. Having the pipes all freeze while away for a few days is an insurance claim.

      --
      Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
    6. Re:Don't believe it will help by Anonymous Coward · · Score: 0

      That would be an example of a tangible consequence.

    7. Re: Don't believe it will help by gnick · · Score: 1

      I guess I was too general when I said "nobody gives a rat's ass". I should have said, "A typical user will not give a rat's ass until after there are tangible consequences." Unless there were widespread reports of systems being hacked and damage being done, most users will not bother to secure anything nor care about how easy they are to hack.

      --
      He's getting rather old, but he's a good mouse.
    8. Re: Don't believe it will help by AK+Marc · · Score: 1

      So, nobody will give a rats ass until they hear about it on the news? That's a much lower standard, because if 3 non-typical users are hacked, and make a big stink, it may end up on the news before any typical users are even hacked.

      --
      Learn to love Alaska
    9. Re: Don't believe it will help by gnick · · Score: 1

      Same standard - I may have phrased things badly. When I said "tangible consequences," I didn't mean necessarily directly to the user. Just evidence that there have, indeed, been consequences. Right now, nobody's successfully blamed a fire or freeze on hackers to my knowledge, so "nobody's" doing anything to secure against it.

      --
      He's getting rather old, but he's a good mouse.
    10. Re: Don't believe it will help by Neuronwelder · · Score: 1

      As if fire damage wasn't bad enough. I totally forgot about water damage! Easily done in cold weather by hacking the thermostat to minimum for a few days then putting it on max the next.

  3. Yay! by MobyDisk · · Score: 2

    This is great. I've been promoting the idea that independent test labs such as uL, or standards such as the CE mark, should include product security as well. Having consumer ratings include them could significantly increase awareness of security. We, as tecnhologists and consumers, really need to hit hard against companies selling inherently insecure products. With the rise of botnets, insecure products are no longer just a threat to our own networks, but to national security as well.

    1. Re:Yay! by AK+Marc · · Score: 0

      Yeah, but CR is incompetent hacks that are prone to sensationalize results to drive magazine subscriptions. Anyone else would be better than them.

      --
      Learn to love Alaska
    2. Re:Yay! by AmiMoJo · · Score: 1

      I wonder what the tests will be. Run NMAP perhaps? Check web pages behind log-in screens are not accessible? Look for exploits like unsanitised input?

      Or some kind of meta check, based on previous performance of the manufacturer, frequency of updates etc.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    3. Re:Yay! by MobyDisk · · Score: 1

      Yeah, others have questioned if CR has the skills to do this. I hope they hire some real security people. Your "meta check" concept would be pretty weak, but that is the kind of thing they might do.

  4. Are they qualified? by aaarrrgggh · · Score: 1

    I applaud the effort, but are they really qualified to be doing this, or are they going to limit it to basic "best practices?" I can see picking up that there is an open port, but backdoor accounts, phoning home, etc are equally important.

    1. Re:Are they qualified? by oh_my_080980980 · · Score: 2

      RTFA:

      " ...it had collaborated with several outside organizations to develop methodologies for studying how easily a product can be hacked and how well customer data is secured. "

    2. Re:Are they qualified? by bws111 · · Score: 1

      Here is what they are using as criteria: https://thedigitalstandard.org...

    3. Re:Are they qualified? by uCallHimDrJ0NES · · Score: 1

      Here is what they are using as criteria: https://thedigitalstandard.org...

      No...that's what they are saying they are using as criteria. Knowing where to look something up and understanding it are different things. I don't believe Consumer Reports will be hiring any real security experts to conduct their reviews. They'll do the same thing they've always done--best effort approach using reviewers who know how to meet deadlines for writing review text. If you're an expert in a field, you don't take advice from Consumer Reports. Just look at their reviews for product areas in which you are personally expert, and you will see what I mean. It's nice that they've added a column to their matrices about "Security", but for me, a dot in that column is meaningless.

      --
      Cloudiot: A person who does not see offsite storage as a way to lose control over access to his or her own data.
    4. Re:Are they qualified? by by+(1706743) · · Score: 1

      It's nice that they've added a column to their matrices about "Security", but for me, a dot in that column is meaningless.

      ...but perhaps no dot in that column is cause for huge concern/outright dismissal for even considering the product.

    5. Re:Are they qualified? by Anonymous Coward · · Score: 0

      I also applaud their effort, but I think what they can tell you is, in specific cases where information is available, the particular ways a product is insecure. What you can't conclude is that products not flagged as insecure are necessarily better overall. Designing for security is difficult, so is evaluating a product for security. It takes a lot of effort and technology-specific expertise to spot the possible ways how a design and its implementation may be exploited. I'm not optimistic that the Credit Union can apply the resources and expertise needed to truly evaluate product security.

    6. Re: Are they qualified? by fluffernutter · · Score: 1

      I doubt they would want to risk some big hack where it becomes evident that they missed a glaring hole. Even if they do, it will change shortly after said event happens.

      --
      Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
    7. Re:Are they qualified? by tlhIngan · · Score: 1

      I applaud the effort, but are they really qualified to be doing this, or are they going to limit it to basic "best practices?" I can see picking up that there is an open port, but backdoor accounts, phoning home, etc are equally important.

      They're probably not qualified, in that it's consumer reports.

      They review stuff for the masses - if you're an expert in the field, you already know what to look for and thus they don't contribute anything. However, if you're not already in the know, they test things as "Joe Average" would test them. So some of the tests they do are downright silly, but then again, if the design of the product enables downright silly use, then they'll test it and report on it. They also won't recommend the best if the best is hard to get (e.g., requires going to a store on a Sunday on the 4th day of the lunar rise). They are regular people and going to do regular stuff and visit the stores regular people visit. They aren't going to go into an audio specialty store to get headphones to review - they'll review what you can find at Best Buy.

      Now, they'll probably do basic security checks - does the product work without a password? Does the product make you select a password before you can use it (this eliminates a lot of vulnerabilities relying on default passwords)? Or even at the very least, if you don't have to change the password, is it unique per device? (A few devices come with stickers with the default password that vary by the device). And if so, how unique is it? It's not useful if it's limited to a range of 256 different passwords, after all.

      Backdoors are harder to test, but if they can test for even the basics...

  5. Won't matter by Anonymous Coward · · Score: 0

    It's a nice concept, but Americans are too cheap to bother with security.

    "Oh lookie, this one is insecure, but $5 cheaper. I'll buy the cheap Chinese garbage and then I'll have an extra five-spot to spend on today's supersized lunch."

    1. Re:Won't matter by Anonymous Coward · · Score: 0

      "Then afterwards I'll go home and be a smarmy troll on the interwebs."

    2. Re:Won't matter by GLMDesigns · · Score: 2

      nice stereotype there.

      Anonymous Cowards are all trolls living in their mom's basement.

      --
      If you're scared of your govt then you need to further restrict its powers
      Vote 3rd Party in 2016 and beyond
    3. Re:Won't matter by Anonymous Coward · · Score: 0

      It's not a matter of being too cheap, it's simply a matter of lack of information. But you know, don't let that stop you from being a giant shit stain on planet Earth.

  6. Will they include Manufacturer data access? by mykepredko · · Score: 3, Interesting

    One of the first things I thought of when I read this is how would they rate a Windows 10 PC, Mac or a Chromebook? What about a smartphone or tablet? Even many PCs with Linux already installed would be suspect with different packages that come with the system.

    It's great that they'll rate connected appliances, cars and streaming boxes but that's leaving out the classes of devices which are the biggest risk to consumers data - the systems they handle almost literally 24 hours a day.

    Ironically, CR doing this is a great way of making the great unwashed more aware and concerned about their cyber-security.

    --
    Mimetics Inc. Twitter
    1. Re:Will they include Manufacturer data access? by wiredog · · Score: 1

      Ironically, CR doing this is a great way of making the great unwashed more aware and concerned about their cyber-security.

      How is something doing what it's intended to do in any way ironic?

      --

      Best Slashdot Co
  7. This from the organization... by Anonymous Coward · · Score: 0

    ...that manages to give the VW Golf and VW Jetta distinctly different ratings for what is effectively the same car.

    1. Re:This from the organization... by Anonymous Coward · · Score: 0

      http://www.autotrader.com/car-...

  8. Cyber by xororand · · Score: 2

    Say "cyber" one more time...

    1. Re:Cyber by Anonymous Coward · · Score: 0

      "Security, Motherfucker! Do you use it?"

    2. Re:Cyber by Anonymous Coward · · Score: 0

      Cyber.

  9. now if we can only get by mandark1967 · · Score: 1

    manufacturers to consider cyber security and privacy we'll be good to go.

    --
    Sig Follows: "Suppose you were an idiot. And suppose you were a member of Congress. But I repeat myself." -- Mark Twain
  10. Does it matter? by Anonymous Coward · · Score: 0

    I mean, rampant incompetence of course matters. However you qualified that with '...are they going to limit it to basic "best practices?" '.

    And if they can do just that, already it's a major win. Let's face it, most of these IoT devices suck, they Absolutely Suck Big Time when it comes to security. They don't even measure up to basic best practices.

    If we could get conformance just to that, basic best practices, then the entire IoT field might have a chance. Without that IoT is going to faceplant big time on the reality of malware, bad actors and hacking on the Internet by LOLs, Lu2ers and Haxors.

  11. No no no by JustAnotherOldGuy · · Score: 1

    Consumer Reports has shown REPEATEDLY that they don't know shit about computing, and I'd bet they don't know shit about cyber security either.

    Their articles will contain shit like "use complex passwords", "use an anti-virus program", and "don't click on pop-up ads".

    Fucking ninnies. They're good at hardware testing (usually) for cars and appliances but in the realm of computing they've proved to be dunderheads more times than I can count. Plus, computing is a moving target- the shit they test or advise on will be obsolete before the magazine gets to your mailbox.

    --
    Just cruising through this digital world at 33 1/3 rpm...
  12. Actual Job Posting by Anonymous Coward · · Score: 1

    A copy of the two job descriptions:
    https://jobs-consumers.icims.com/jobs/2778/product-testing---cybersecurity/job?mode=job&iis=Indeed&iisn=Indeed.com&mobile=false&width=1170&height=500&bga=true&needsRedirect=false&jan1offset=-300&jun1offset=-240

    And also an Intern position in IS:
    https://jobs-consumers.icims.com/jobs/2786/2017-summer-intern%2c-information-security/job?mode=job&iis=Indeed&iisn=Indeed.com

    Key Responsibilities:

      Within Privacy, manages complex programs , ensuring appropriate planning, coordination and oversight of test projects related to data privacy and internet security while monitoring timelines and costs.
      Oversees, and approves elements of assigned programs from inception to completion. Responsible for program tactics, proposal development, product testing design, assessment of product and service evaluation methodologies, evaluation of outcomes and ratings as well as documenting reports of results.
      Ensures that data meet established standards for accuracy, repeatability, reproducibility, and dependability.
      Keeps abreast of industry testing standards and market trends, evaluating and providing recommendations to improve existing testing procedures.
      Develops and maintains ratings and model descriptions based on product evaluations.
      Reviews content to ensure the information is technically accurate, defensible, and current.
      Ensures a holistic view of consumer needs is developed, understood and central to the product and services evaluation programs.
      Develops, maintains relationships and coordinates activities with internal and external experts in related fields. Determines how best to utilize relevant internal and external resources.
      Identifies and contracts with appropriate external resources to complete projects as necessary. Responsible for the Request for Proposal (RFP) process to engage resources and negotiates details of various vendor contracts and deliverables. Monitors and tracks work of external vendors to ensure strict adherence to negotiated contracts and protocols.
      Partners with Content Development staff to ensure technical accuracy.
      Drafts test protocols including identifying, updating and iterating methodologies as necessary.
      Oversees the work of assigned project staff; scheduling and monitoring work. Trains and coaches project staff, providing feedback on performance as needed.
      Coordinates with functional manager to enable appropriate availability of resources.
      Performs other related duties as necessary.

  13. New subject for Consumer Reports by Neuronwelder · · Score: 1

    Maybe they should start doing ratings on cyber security?

  14. Wish CR was still "non-profit" by Anonymous Coward · · Score: 1

    But around 2008 they switch to a pay for ratings and it was VERY OBVIOUS. Models that one month rated at the bottom of the list started showing up at the top of the list. Also, you can see models that have very public recorded issues still show up at the top of the list.

    Sorry, but CR is no longer a reliable source for honest non-bias reviews of products.

  15. Demand EOL Dates! by Anonymous Coward · · Score: 0

    Demand EOL Dates!

    I don't plan to buy any google hardware again, because that company and I have very different ideas about when End of Life happens.
    Should a $650 device EOL be 3 yrs? NO! 10 yrs is more like it.

    To combat my issues with this in all electronics, if it doesn't run a user-installable version of a an OS freely available and actively maintained, I don't want it. Basically, that comes down to either Linux or BSD. This mainly applies to:
    * routers
    * smartphones
    * tiny IoT devices
    * Video players
    * Computers

    If the vendor makes it hard to put in a F/LOSS OS, I don't want it. Been burned a few times. It is the only way that I know to get reasonable value for my money.

    Don't know what non-technical people are to do. I have enough issues of my own.

  16. No no no by Anonymous Coward · · Score: 0

    All that I want from Consumer Reports is their statistical data. I've never had much respect for their opinion. They don't have the same priorities as I do. For example, my number one concern for a car is reliability. If the car's not reliable, then it's unacceptable. I don't care if it's got some new gimmick or even if it's fun to drive. First, it has to get me there. Then, we can consider fun.

  17. Consumer Reports has totally screwed this up by Anonymous Coward · · Score: 0

    Consumer Report's approach to this massively complex problem has been a kluster-kludge from the get-go. Their first assumption (that all software systems written for Iot devices will be new) speaks to just how naive and ill-informed they really are.

    An in-depth discussion (very well worth the read fro anyone interested in cyber-security) of the issues with Consumer Reports entry into ratings is available for free at the Certitude Digital website. From their main page on that site, go to the footer links at the bottom of the page and select the link labeled "Blog (from our CTO)". Library". Near the top of the blog is an article entitled "Should Consumer Reports Set Cybersecurity Standards?" (https://certitudedigital.com/reference/public_docs/ShouldConsumerReportsSetTheRules/ShouldConsumerReportsSetTheRules.pdf)

    Alternatively, you can go to F. Scott Deaver's LinkedIn page and look for the "Should Consumer Reports Set Cybersecurity Standards?" topic among his other articles (https://www.linkedin.com/pulse/should-consumer-reports-set-cybersecurity-standards-f-scott-deaver).