Quick Cyber Thoughts: Things I Hope to See at CES 2025
The Consumer Electronics Show (CES) has always been a window into the future of technology, setting the stage for the innovations that will shape our lives. As we approach CES 2025, the buzz around advancements in consumer electronics is louder than ever.
2025 is going to be an interesting year from a cybersecurity perspective too, for a reason I don't think anyone expected. So here's what I hope to see from CES.
Table of Contents
Price Competition for Routers
This isn't something I expected to be a thing I would care about.
Then the US government, which has had a pretty dim view of TP-Link's cybersecurity stance and possible ties to the Chinese Communist Party, decided to drop a bombshell. They are considering banning the routers outright:
Investigators at the Commerce, Defense and Justice departments have all opened probes into the company due to its ties to Chinese cyberattacks. These departments are weighing a potential ban on the sale of TP-Link routers, according to a Wall Street Journal article published last week.
TP-Link has become increasingly dominant in the US router market since the pandemic. According to the Journal report, it grew from 20% of total router sales in 2019 to around 65% this year. TP-Link disputed these numbers to CNET, and a separate analysis from the IT platform Lansweeper found that 12% of home routers in the US are TP-Link.
While there have been high-profile cyberattacks involving TP-Link routers, this potential ban is more about the company’s ties to China than specific security issues that have been publicly identified, according to cybersecurity researchers I spoke with.
The investigation comes after a Microsoft report revealed in October that a botnet of hacked SOHO routers—tracked as Quad7, CovertNetwork-1658, or xlogin and operated by Chinese threat actors—is mainly made from TP-Link devices.
"Microsoft tracks a network of compromised small office and home office (SOHO) routers as CovertNetwork-1658. SOHO routers manufactured by TP-Link make up most of this network," the company said.
"Microsoft assesses that multiple Chinese threat actors use the credentials acquired from CovertNetwork-1658 password spray operations to perform computer network exploitation (CNE) activities."
On Monday, the New York Times also reported that the Biden administration will ban China Telecom's last active U.S. operations in response to Chinese state hackers breaching multiple U.S. telecom carriers. The Federal Communications Commission (FCC) revoked China Telecom Americas' license in January 2022 over "significant national security concerns."
The fact that 65% of the market uses TP Link means that if there is a ban on TP-Link routers, especially for home office users in cybersecurity and government, there's going to be massive repercussions.
We're talking about replacing every one of those people having to replace hundreds of dollars worth of hardware, in a relatively small time window, at roughly the same time.
This might end up creating the router equivalent of the GPU shortages of 2021-2022, where every graphics card had its price balloon due to lack of availability, and the only affordable options were ones that barely provided any performance improvements over two generation old models.
To combat this, we need to see manufacturers put out price competitive options, especially in the mesh router category. Those setups are already expensive, but provide major performance benefits for anyone operating out of a proper house, versus an apartment.
It would also be nice to see government, federal or state, provide some kind of financial relief for people forced to replace their entire network setup. This could be in the form of a tax exemption/tax holiday, a rebate for turning in TP-Link hardware, or any sort of cost mitigation strategy for such a transition.
Widely Compatible Free/Cheap Router Operating System
This would be somewhat out of left field, but if an organization/company could release a secure, low cost (free or cheap) router operating system (OS), that might be a massive gamechanger.
The problem with the TP-Link ban is the cost of replacing the hardware. Routers might be affordable, but they're not cheap unless you're going pretty far down the product stack. That's why this ban has massive negative consequences: it's basically penalizing everyone who made a rational financial decision for the behavior of the manufacturer.
But if you don't have to replace the hardware, just software operating the devices, then the costs to the end users drops dramatically.
It might not be the right solution for everyone, especially in government or cybersecurity, but for the average home user, it might fit the bill.
That naturally depends on the OS being easy to upload onto the device, especially for mesh routers, but if someone can do it, it'll be a win for everyone.
CAMM2 Becomes More Widely Implemented
For those of you not familiar, CAMM2 is Compression Attached Memory Modules, a new way of implementing Random Access Memory (RAM). Instead of sticking up out of the motherboard on many systems, it's designed to either directly touch the motherboard, or slightly parallel.
This design has a number of space saving advantages, especially at high capacities, but the big improvements are power efficiency and memory speed. This is due to the overall shorter path that data has to travel to get to and from the memory or CPU.
How does this help cybersecurity? Well, better performance improves everything. This is especially useful for running virtualized software and operating systems. But it can also be a big help when running local AI, as RAM size and speed play a huge part of task execution.
CPUs With Good NPUs At Decent Prices
Local AI, specifically Large Language Models (LLMs) and Small Language Models (SLMs), aren't really seeing broad adoption among the masses.
However, local generative AI has a lot of direct applicability for cybersecurity practioners. First, it's a lot easier and much lower risk to test local AI for vulnerabilities, because they're running on your own hardware, not someone's cloud instance. Second, local AI is pretty good at code generation, which is something a lot of cybersecurity professionals do.
Neural Processing Units (NPUs) are hardware optimized for running the kind of computations associated with LLMs. So far, these units are only proliferating into laptop CPUs, and generally aren't the highest performance, especially at the $1000+ price point that prosumer laptops fit in.
However, AMD is going to release its Strix Halo line of laptop CPUs, with up double the AI performance on NPU (40 TOPS from 20 TOPS of its predecessor), as well as over doubling its GPU core count. Since GPUs are leveraged in a variety of AI tasks, the combination should make running local AI much more performant.
If laptops with these processors can hit the market at $2000 or less for workstation builds, then I think we have a good chance of seeing local AI use proliferate. This would help mitigate a lot of data safety issues created by the use of cloud AI, up to and including poorly trained personnel putting PII into LLM prompts.
Fanless Cooling Solutions
One recent technology trend of interest is the development of fanless cooling for computers. Mostly confined to laptops and other small devices, there's a cybersecurity application that most people would not think of.
While the Frore Airjet, which uses a vibrating membrane to move air, might be vulnerable to a similar exfiltration method in the future, there is a new solution on the market. Ventiva has created a solid state device that uses ionization to move air:
Even if it cannot scale to desktop or server use, Ventiva's solution might be able to eliminate an entire vector of data exfiltration from mobile devices, which are a prime target for threat actors.
Storage Price Per Volume Improvements
Backups are a critical part of cybersecurity, especially if there's a ransomware event that forces you to execute a recovery plan.
The problem is, as you get smaller and smaller in size, you're actually less likely to have backups, for a simple reason. Storage is expensive, and have redundancy, you have to buy multiples of expensive drives to do it properly.
Sadly, we don't live in a reality where Star Trek style solid state, hotswap memory chips with large capacities, lots of longevity, and low cost exist.
With file sizes ballooning, especially for media, the costs of backing up proportionally grow larger. Even cloud based backups, which have theoretical cost savings to offset their availability and control downsides, increase drastically in cost as storage needs increase. And in a bad economy, cutting costs wherever possible is going to be the norm, especially on the individual to small business level.
Good cybersecurity practices start at home. And if we really want people to start getting in the habit of backing up their data, it needs to be as cheap and easy as possible. Right now, $250+ for 14+ TB drives is not viable for a lot of people. Smaller drives for smaller files, like 4TB SSDs, also aren't in a great price spot, at nearly $300 a piece.
Storage capacity improvements are great, but if the costs of deploying a properly configured system for backups doesn't go down for non-enterprise scenarios, then the war against ransomware will never really go anywhere. No or minimal backups means that victims will be incentivized to pay the ransom, with no guarantee that they'll recover their files.
The Unexpected
One of the great things about technology conferences is that you never know what will show up.
Last year, we had a demo of QDEL, a competitor technology to Organic Light Emitting Diodes, randomly make an appearance at CES.
With growing awareness of how important cybersecurity is for the average person, we might see a lot of products and services aimed at the less tech savvy.
What would they be? I don't know! And that's what makes it exciting.
