How BLE/ Mesh networks (IE your light bulbs) can spy on you - Page 1
Forum section: electronics / general

author: Beamin
author_rank: Super Contributor
timestamp: July 06, 2021, 10:16:17 pm
content: https://youtu.be/-tIK3Fk-bLAThey can use blueTooth to send traffic 1/2 mile then another 1/2 mile and the FCC doesn't know/care about this.I thought it was bad enough how comcast will use your bandwidth you pay for to support their xfinity network.

author: ataradov
author_rank: Super Contributor
timestamp: July 06, 2021, 10:38:34 pm
content: This is some next level paranoia. What would your light bulb be sending about you exactly? Why would FCC care as long and devices pass certification?Also, Comcast bandwidth consumption by others does not count against your bill.

author: james_s
author_rank: Super Contributor
timestamp: July 06, 2021, 10:47:46 pm
content: What exactly are my light bulbs going to know about me? Whether or not the light is on? Out of all the things to concern myself with, this is pretty low on my list.

author: TimFox
author_rank: Super Contributor
timestamp: July 06, 2021, 10:56:12 pm
content: The drug police used to check for excessive power draw at night, looking for marijuana cultivation under artificial light.

author: ataradov
author_rank: Super Contributor
timestamp: July 06, 2021, 11:06:36 pm
content: Quote from: TimFox on July 06, 2021, 10:56:12 pmWhat this has to do with anything? You can get this information from the power supplier. You don't need BLE fro that, you already have monthly electricity bills.

author: TimFox
author_rank: Super Contributor
timestamp: July 06, 2021, 11:13:18 pm
content: My electric bill doesn't include time-of-day information. Some do, now that "smart meters" are popular.

author: ataradov
author_rank: Super Contributor
timestamp: July 06, 2021, 11:25:21 pm
content: If your consumption is generally higher that similar homes around, you will be at least a suspect. There is no need for time of day information.

author: TimFox
author_rank: Super Contributor
timestamp: July 06, 2021, 11:31:20 pm
content: Every clue helps. Fifteen or so years ago, a house on my block was busted while I was out of country, so I didn’t read all the details.An example of unintended consequences of monitoring data: modern tire pressure monitors require information transfer across a rotating boundary, and then to the car’s computer. Since no one else cares about your tire pressure data, the RF link used to go to a general purpose input port on the computer, thus providing a back door into your car useable for theft.

author: ataradov
author_rank: Super Contributor
timestamp: July 06, 2021, 11:53:31 pm
content: How exactly can you use TPM data for car theft?

author: TimFox
author_rank: Super Contributor
timestamp: July 07, 2021, 01:07:15 am
content: You send something else by RF to the unencrypted general-purpose input to the computer. I believe this hole was patched when it became known.

author: ataradov
author_rank: Super Contributor
timestamp: July 07, 2021, 01:11:27 am
content: You are sending pressure data. That's all. There is no hole. If your computer can be taken over by sending incorrect data, then it is the firmware flaw, encryption is not relevant here.

author: eti
author_rank: Super Contributor
timestamp: July 07, 2021, 01:15:34 am
content: A wise old friend of mine, once said"Look, once you've connected to the internet for the first time, ALL your privacy and anonymity has gone; if you believe otherwise, you're delusional, just forget about it and get on with it."Far too many "theories" and "debates" consume FAR too much time, all of which product nothing except paranoia and arguments. Life is WAY too short for that junk."Any fool can speculate, most of them do".

author: TimFox
author_rank: Super Contributor
timestamp: July 07, 2021, 02:43:36 am
content: Quote from: ataradov on July 07, 2021, 01:11:27 amWhen sending innocuous pressure data, the coder may well neglect the security of the connection. This firmware flaw needed to be fixed once it was discovered.

author: NiHaoMike
author_rank: Super Contributor
timestamp: July 07, 2021, 03:15:28 am
content: Quote from: ataradov on July 06, 2021, 11:53:31 pmYou could spoof a flat tire to get the driver to stop, then robbing them is much easier. Granted, it's not that helpful when lightly rear ending them would be far easier and just as effective. (I saw a post on Facebook warning about that a few years back.)

author: james_s
author_rank: Super Contributor
timestamp: July 07, 2021, 03:20:45 am
content: Quote from: TimFox on July 06, 2021, 11:13:18 pmThey don't need time of day information, they go by the overall consumption, often far higher than normal for a house of that size, it's the reason growers would often seek out houses with electric resistance heat to rent for their grow operations. I believe they also used thermal cameras looking for heat signatures that suggest a grow operation, such as specific rooms that are much warmer than the rest of the house.

author: james_s
author_rank: Super Contributor
timestamp: July 07, 2021, 03:22:51 am
content: Quote from: NiHaoMike on July 07, 2021, 03:15:28 amIf my car was still handling reasonably ok I would continue driving until I came to a safe place to stop and check it. I think it would be obvious that something is going on though if the pressure suddenly dropped without the obvious effect of a blowout though.

author: ataradov
author_rank: Super Contributor
timestamp: July 07, 2021, 03:38:17 am
content: Quote from: TimFox on July 07, 2021, 02:43:36 amBut the coder may also misinterpret the encrypted data. Coding errors have nothing to do with any of this.It is perfectly fine to send tire pressure monitor data in the open.

author: ataradov
author_rank: Super Contributor
timestamp: July 07, 2021, 03:42:45 am
content: Quote from: NiHaoMike on July 07, 2021, 03:15:28 amYes sure, I'm not against encrypting the data. It is just not as huge of a security hole as some try to portray it.In any case, TPMs have used security for many years now, so the issue is pretty much solved.

author: TimFox
author_rank: Super Contributor
timestamp: July 07, 2021, 03:43:44 am
content: I agree that the TPM monitor safety problem has probably been solved, but it is an historical example of unexpected consequences of putting data out there.I'm not complaining aboutsendingmy tire pressure information in the open for all to read.I'm concerned about the path into the computer not being secure, so that malefactors can enter bad stuff into the computer.This has been documented, and presumably fixed as the technology matured.I do complain about the attitude that since the information is innocuous, we don't have to be careful about how it is handled.

author: Mazo
author_rank: Regular Contributor
timestamp: July 07, 2021, 02:07:53 pm
content: Fella working in the IoT sector atm here,the company produces smart everything(including bulbs) that are cloud connected.Yes we know when your smart bulb is on,how much electricity you are consuming and whatever info our devices harvest and bonus they can be manipulated remotely.The world still turns.About the network "hopping" that is possible,yes it is even going to be a feature in the future so that your smart sensor on the other end of the yard gets that Wi-Fi signal which is otherwise lacking there using other smart devices as "extender".If this bothers you,buy "dumb" lamps.AFAIK nobody is interested in that kind of info

author: TimFox
author_rank: Super Contributor
timestamp: July 07, 2021, 03:41:18 pm
content: In the US, the police (for good or ill) are already interested in the data from your smart doorbell.https://www.washingtonpost.com/technology/2021/03/02/ring-camera-fears/

author: ataradov
author_rank: Super Contributor
timestamp: July 07, 2021, 03:57:15 pm
content: But before that the police were interested in dumb CCTV security cameras. This is a standard procedure, when a crime happens, they go to all the places that may have the camera and request the footage.The only difference is that in case of CCTV you are the one giving consent, but in case of a cloud connected device, you have potentially given away that right to the cloud operator. It is still not legally clear.And again, there is nothing inherently wrong with the technology, we just need to clarify the laws on how it is handled.

author: TimFox
author_rank: Super Contributor
timestamp: July 07, 2021, 04:09:53 pm
content: I agree that laws need to be clarified for new technology. Thereafter, we are back to the classic question "Quis custodiet ipsos custodes?" If the stuff is in the cloud or on the air, it is difficult to control custody.

author: Rick Law
author_rank: Super Contributor
timestamp: July 07, 2021, 07:10:33 pm
content: Quote from: Beamin on July 06, 2021, 10:16:17 pmQuote from: ataradov on July 06, 2021, 10:38:34 pmWhile it may not directly affect the bill, but it costs in other ways. The coaxis cable that came into your house can carry only so much, and you do pay for the electricity that powers the modem and such.All three consumer-class ISP's (Optima, Fios, and Comcast/xfinity) in my area pushes their one-box solution: that one box does cable-modem, firewall/router, and WiFi AP (access point). You no longer directly control these. You go into their website to modify your WiFi AP and or your router settings.If you use those one-box solution they are pushing... In Optima's case, they use a lone UBEE box doing DOCSIS 3.1, firewall, router, and WiFi. Following the UBEE user manual (from the UBEE site), I can ping the box, but the device displays an error when I tried to http into it. I know that IP is right since I can ping it, but I can't http into it. The optima-provided UBEE has the local web setup pages locked out. You must use Optima's site to get to your account page where you can edit some settings in the UBEE box. For router - only port forwarding and nothing else I could find. You can't do much with your WiFi AP either beyond changing the SSID and WAP password. The cable-ISP company has control all the way down to and including your WiFi AP. To add insult to injury, they also sell a "WiFi management service" you can add to your plan (at least comcast/xfinity do, not sure about Optima).All three consumer-ISPs in my area (Fios, Optima, Xfinity/Comcast) has "nation wide WiFi" service you can add to your plan - to access WiFi everywhere they have a presence. You may well be logging onto a UBEE box / Verizon-G3100 like device in someone's business location or home. The owner/renter of the UBEE box pays a rental fee and pays the electricity to power that box while merely just getting just a virtual AP in his/her home. Other "nation wide WiFi" usermaywell be logged into another virtual AP that is in that same box. I don't know if the ISP actually would go that far to have you fund their service, but what they deployed certainly can go that far.I know in theory those boxes can go as high as 2.5Gb/s. Many older buildings has RG59 instead of RG6, possibly with a splitter or two already before getting into your location. 2.5Gb/s would be pushing the luck. What if the box is in your house/business while the dozen people in the coffee shop next door all happen to logon using their "nation wide WiFi" also from your cable company?I am not a generous person when it comes to bandwidth and electrical bill. I use xFinity/comcast, with my own cable modem into my own firewall/router with my own WiFi AP. So I know at least the cable that comes into my house carry only my traffic - as long as I stay away from the "Amazon Sidewalk" types of things.

author: james_s
author_rank: Super Contributor
timestamp: July 07, 2021, 08:07:35 pm
content: Quote from: TimFox on July 07, 2021, 03:41:18 pmI'm more than happy to provide the police with any security footage I have in the event of a crime and the same is true of many of my neighbors. It may be one reason there is so little crime in my neighborhood, a large number of people have security cameras that record everything that goes on in their view.

author: TimFox
author_rank: Super Contributor
timestamp: July 07, 2021, 10:03:18 pm
content: Yes, the "good" probably outweighs the "ill" for most users.I have heard of divorce attorneys subpoenaing the information to see who visits the user, but catching porch thieves and other miscreants is a good thing.

author: Rick Law
author_rank: Super Contributor
timestamp: July 08, 2021, 02:03:00 am
content: Quote from: TimFox on July 07, 2021, 10:03:18 pmI failed to see the "good" in having unlimited ability to monitor and intrude into another person's life.1984 is here, just a few decades late but a few orders of magnitude more intrusive. The Stasi would have been envious of our technological accomplishments.

author: SiliconWizard
author_rank: Super Contributor
timestamp: July 08, 2021, 06:48:05 pm
content: Quote from: Rick Law on July 08, 2021, 02:03:00 amSame opinion.I fail to see how the good really outweighs the bad. I think that's really something we all need to seriously ponder on. Claiming it's mostly all good, without really giving it much thought, is what makes it so easy to get us to a place we won't want to be - but it'll be too late.But dedicated wireless access, while they pose issues of their own, is not nearly as bad as internet connection. (Granted, often "connected" devices have both anyway...)Seriously. For light bulbs, having a remote can be handy - although absolutely not indispensable - but having them connected to the internet? Fuck no. Why would I want to go through Google servers (for instance with all the Google home crap), and have them log everything I do with my freaking bulbs, just to switch them off and on or change colors? Have we sunk that low?

author: james_s
author_rank: Super Contributor
timestamp: July 09, 2021, 07:49:15 am
content: I'm monitoring my own property with my cameras along with a small portion of the public sidewalk that is in the edge of the frame, it isn't intruding into anyone's life or watching what they do, the only people who ever end up being recorded by them are people who enter onto my property. Even then the only time I ever watch the footage is when something gives me reason to. I don't see anything bad about it.

author: TimFox
author_rank: Super Contributor
timestamp: July 09, 2021, 01:30:42 pm
content: Of course you have the right to monitor your own property.The modern questions that arise are when you allow (with or without your knowledge and explicit permission) that information to be available to others through the cloud or other routes.

author: james_s
author_rank: Super Contributor
timestamp: July 13, 2021, 05:44:25 am
content: Well I can't speak for everyone but it darn will had better only be with my explicit permission that somebody accesses the video. I'm happy to provide it to the police or a neighbor if they ask, but that is assuming there has been some kind of incident they're investigating. I've never had them stop by uninvited and ask to view my footage for no reason and would not expect that to ever happen.

author: TimFox
author_rank: Super Contributor
timestamp: July 13, 2021, 01:44:08 pm
content: My point is relevant when the data or video leave your property into the cloud, or wherever it is technically possible to retrieve it without asking your permission.