News The Great IOT FAIL - Page 1
Forum section: electronics / general

author: C
author_rank: Super Contributor
timestamp: August 09, 2016, 03:29:20 pm
content: Your 'Smart' Thermostat Is Now Vulnerable To Ransomwarehttps://www.techdirt.com/articles/20160808/07042735180/your-smart-thermostat-is-now-vulnerable-to-ransomware.shtml

author: bitslice
author_rank: Frequent Contributor
timestamp: August 09, 2016, 03:45:56 pm
content: Requires physical access, so not that worrying.However spoofing their severs and firmware update signing code is maybe possible, allowing remote hacking.All these home automation systems need to drop the requirement for a cloud control system, because as soon as that goes, all you have left in a large investment in dead electronics. And any uncontrolled comms through a firewall is open to hacking.

author: setq
author_rank: Frequent Contributor
timestamp: August 09, 2016, 03:53:41 pm
content: Quote from: bitslice on August 09, 2016, 03:45:56 pmThat's just what they want. Then you can buy more useless things to surround yourself with.

author: nuno
author_rank: Frequent Contributor
timestamp: August 09, 2016, 05:33:02 pm
content: IoT will not "fail"... already too many big ones on the band wagon, pushing it.

author: System Error Message
author_rank: Frequent Contributor
timestamp: August 09, 2016, 06:04:34 pm
content: the risk is too great. The cloud requirement is one of the main issues with IoT. The fact that it requires cloud to function is what makes it costly and vulnerable not to mention privacy issues. Can you really trust the company will not give your information to others?Its most likely that the large investment is fueled by this information gathering.

author: nuno
author_rank: Frequent Contributor
timestamp: August 09, 2016, 06:51:47 pm
content: Most people don't really care about the "privacy issues".

author: C
author_rank: Super Contributor
timestamp: August 09, 2016, 07:21:19 pm
content: When you look at a network device, there is a lot of failure points.When you open a connection from the Internet to the IOT device, you have opened an additional attack hole.When you add a need for a server on the Internet be it cloud or not, the attack area just increased.Your WIFI increases the attach hole even more.Do you have a firewall between each WIFI device?An IOT device needs a perfect IP stack with each packet verified before use.A firewall that limits even the verified packets before use.The basic attack is sending a packet that causes a lot of work on CPU and network preventing normal operation.The second attack is sending a invalid packet.What is the chance of this on an IOT device when the huge players still find bugs in their software.

author: rdl
author_rank: Super Contributor
timestamp: August 09, 2016, 08:02:50 pm
content: I thought the whole IoT thing was mostly dead in the water. Other than stupid gullible consumers, who would waste money on that kind of useless crap?

author: SL4P
author_rank: Super Contributor
timestamp: August 09, 2016, 10:08:46 pm
content: Quote from: rdl on August 09, 2016, 08:02:50 pmThe IoT and 'cloud' concept is legitimate, but it's the greedy compulsory subscription model (often hidden behind the initial purchase) that shoots itself in the foot.Paying for a ubiquitous service, or to store/forwardyour own dataseems pretty short sighted.

author: Red Squirrel
author_rank: Super Contributor
timestamp: August 09, 2016, 11:06:49 pm
content: This is why I coded my own thermostat system and any home automation stuff in general. I don't trust any of this consumer IOT stuff. Problem is most of it requires to call home to a "cloud" server. That leaves it open to hacks, and also makes it reliant on that service being operational.

author: Brumby
author_rank: Unknown
timestamp: August 09, 2016, 11:36:16 pm
content: I've never felt comfortable with the security of the cloud concept.You have to give ultimate trust to something you can't even examine.

author: Buriedcode
author_rank: Super Contributor
timestamp: August 10, 2016, 01:09:40 am
content: Ahh the IOT. Whilst the silly idea's and poorly executed ones grab the headlines, I suspect many more things will be integrated - just not in the way that tech magazines think (using laymens terms 'its connected to the internet, the cloud! therefore its better!). It kind of makes sense to use an already existing wireless network to control various appliances, your WIFI, but of course in order to make a business for it, subscription to a service is what brings in the money. A reasonably tech savvy person could 'attach' applicance to their wireless network, the ESP8266 and raspberry pi have made that relatively simple, but those don't have to be connected to the internet.. unless you want to be able to control it from anywhere.Of course many have poor security, they're meant to be as cheap as possible for profits and in some cases low power, so embedded firewalls and full stacks get stripped out. I don't really see how this can be dangerous unless the device controls something critical (like a car, gas fire etc..). Could an attack retrieve specific information about the local network, and perhaps even the computers within that network? maybe, but unlikely. Annoying? yes, but I'm sure customers realise this, I always saw 'nest' as more of a novelty for those who like to be able to say they are 'gadget freaks' rather than born out of necessity.As for privacy, we willingly give up personal information every day for convenience. Every time you purchase something with a credit card, or use a store card, it is recorded. We happily click 'accept' to many agreements on websites that openly specify that they will share information you give it, as well as your browser version and IP. The real paranoid folk see this as a real threat, and maybe I'm in the minority but.. its just the price we pay for convenience. There are some positives to this: tightly focused marketing, competitive pricing on products you purchase and a huge pool of data for algorithms to work on. The downside of that is we end up with endless analyses of rather mundane, or wacky, trends. It also allows services like voice recognition to improve and actually become viable.That particular article was, like so many, a bit scare mongering. Granted, users *pay* for the service and shouldn't have to know how it works but should at least be aware that sometimes things go wrong; generally the more complicated it is, the less reliable. The more internet services we become tethered to, the more likely it is that things won't always run smoothly. That is what consumers sohuld be warned of, if they don't have the wherewithal to to realise it for themselves.

author: SL4P
author_rank: Super Contributor
timestamp: August 10, 2016, 01:16:28 am
content: Great post.I agree with 100% of your points - and don't imagine for a second that your 'separate' logins and email accounts aren't cross-referenced somewhere.Your privacy and individualism left the room a long time ago.You can encrypt your content, but the end points will always be known.

author: Red Squirrel
author_rank: Super Contributor
timestamp: August 10, 2016, 01:18:09 am
content: Personally I prefer to use wired for as much stuff as possible. Though I use wireless as a main access to the main controller server. Ex: my thermostat system is all wired, but I can still access the server through wireless, and VPN. Main thing with my system, and if I was to redesign it as something sold commercially, is that it's self hosted and self reliant. Remote access is done the same way as anything else, VPN. No need to punch a new hole in the firewall or rely on a 3rd party relay server. Though it's not a bad idea to have that as an option as it's easier to setup than VPN for non techies, but it should be an option and not mandatory.

author: Muxr
author_rank: Super Contributor
timestamp: August 10, 2016, 01:29:57 am
content: I try to avoid cloud based services as much as possible, but I finally gave in 6 months ago with my thermostat.. I have one of those ecobees.. they are really awesome. But I am keeping my dumb thermostat just in case.

author: System Error Message
author_rank: Frequent Contributor
timestamp: August 10, 2016, 10:21:49 am
content: watching mr robot, first episode of 2nd season they hacked a "smart" home and disguised as the tech company so they could get the resident out and use her place including its internet for hacking purposes. Currently IoT is just that vulnerable that something like it can happen.