IEEE Consumer Electronics Magazine - October 2015 - 138

CEA Insights

Quality 2.0-A New Threat,
a Bigger Challenge
By Mike Bergman

oes this scenario sound familiar? Management is concerned
about product quality. Issues are
reported regularly. There is no
consistency or pattern; the root causes
appear to be from many sources. The
solution starts with a C-level commitment to quality and involves retraining
staff and retooling procedures.
Industry veterans will recognize the
above scenario as a 1980s-era problem.
American companies had a reputation for
less-than-stellar quality products. Philip B.
Crosby wrote Quality Is Free: The Art of
Making Quality Certain (McGraw-Hill,
1979) to explain the solution.
I received a copy of Quality Is Free
from my employer at my first job; the
book was required reading. We had
department-level quality circles and
posters in the office break room and on
the factory floor. The idea that quality
was a company-wide responsibility was
ingrained in us by my employer, and I
saw the same message in consumer
advertising from major U.S. brands.
Decades later, the quality of consumer electronics (CE) products from
mature companies is extremely high.
Companies have integrated tools and
processes like root cause analysis, kaizen, design for quality, supplier quality
assurance and supplier quality control.
Quality is a solved problem, right?
Not quite. More than 35 years after
Quality Is Free, we as an industry have a
clear need to up our security game. While
Digital Object Identifier 10.1109/MCE.2015.2463434
Date of publication: 29 October 2015

138 IEEE ConsumEr ElECtronICs magazInE

the CE industry has been busy innovating, so-called "bad actors" have been
busy looking for exploits and building
tools to aggregate those exploits. These
exploits are the modern equivalent to the
1980s-era quality challenges.

SOMETHING EVIL
THIS WAY COMES
There is, available on the Internet, a growing body of work for those who seek to
penetrate systems. Within the security
industry, the players at one point were
split between hackers and crackers.

While the CE industry has
been busy innovating,
so-called "bad actors"
have been busy looking
for exploits and building
tools to aggregate those
exploits.
"Cracker" as a term is falling out of usage
but serves a purpose here. A "hacker" is a
programmer who is generally operating
ethically. "Ethically" is defined within the
industry as complying with certain rules.
Ethical or "white hat" hackers follow a
"first, do no harm" philosophy. They
respect boundaries and document their
work. When they find a vulnerability, they
inform the company that holds the subject
technology, giving them a reasonable time
to make and publish a fix before publishing the details.

october 2015

Contrast that with the "cracker." The
term "cracker" specifically implies
"anything goes," including-maybe
especially including-penetrating systems for financial gain. We can thank
crackers for ransomware, hacks of
major retailers, release of personal
information, and so on. Crackers take
advantage of the enormous body of free
and open-source tools that are available
to attack specific points in a network.
In this group we can include individuals acting alone, small teams, organized
crime, and military groups of full
nation-states.
Because of this huge mass of tools,
many systems are compromised and
many more are vulnerable. It is difficult
to convey just how capable crackers have
become. There are even hardware devices
available to monitor radio protocols such
as Bluetooth and Wi-Fi, on well-known
e-commerce websites, for less than the
cost of dinner and a movie. Combine
such a monitor device with free opensource cracking tools, and the cracker is
getting into systems for a trivial cost.
This does not even take into account the
professional "bot" and ransomware toolkits available from Eastern European
sources for the equivalent of a few hundred U.S. dollars.
Products may be vulnerable to these
tools and other techniques in a variety
of ways. Every day there is another
story of cracked devices, cracked web
apps to control devices, and cracked
smartphones controlling devices. Protecting the CE industry, and our customers, is now required of all of us.

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - October 2015