4 ms·

Maybe it is. But, on the other hand, it's a nice example because it makes you wonder: if companies who've been making webcams are failing so much in security, w

Maybe it is. But, on the other hand, it's a nice example because it makes you wonder: if companies who've been making webcams are failing so much in security, what should we expect from companies making products which aren't related to IT at all? How are the oven-making companies faring, security-wise, in this IoT thing?

Symbiote 11y ago
TLDR: the "authenticate" HTTP call on my heating system is optional, so you can change the temperature without the PIN. For one example, I recently moved into a newly refurbished apartment. It has underfloor heating, with a central control box and remote sensors/controllers in each room. [1] It cost something like €1500-€2500, plus installation, plus the pipes etc. The central control box has an ethernet port and MicroSD slot, which takes a ZIP downloaded from the manufacturer's site. I set this up, and was disappointed to see just how terrible the provided software is. There's no Android app, and the iPhone app costs a further €15 [2]. It has only the most basic functionality: see and change the target temperature in a room, and change which program runs (day/night/off/preset1/2/3). The most-needed thing — to change the preset timings without 100 presses of a 5-button LCD interface — isn't possible. The web interface is the iPhone app implemented as a Java applet making HTTP calls to the server. It's too big to fit on my laptop's screen. There's an 'authenticate' call, but it's optional — the app requires using it, and the call gives the correct pass/fail response, but there's no session handling so there's no need to make this call before reading or changing temperatures. The Java applet at least means it's not easy to do a Google search for the web interface, but I just found this site [3]. There are a few results, but from a long time ago. [1] http://www.billigvvs.dk/Varmesystemer-Gulvvarme-Roth-gulvarme-varianter--Roth-Komplet-Traadloes-Gulvvarmestyring-inkl-Pumpe-4-Kredse-611638.html http://www.billigvvs.dk/Varmesystemer-Gulvvarme-Roth-gulvarm... [2] https://itunes.apple.com/dk/app/roth-touchline/id498448526?mt=8 https://itunes.apple.com/dk/app/roth-touchline/id498448526?m... [3] http://www.base64online.com/hc.php http://www.base64online.com/hc.php

Symbiote 11y ago

TLDR: the "authenticate" HTTP call on my heating system is optional, so you can change the temperature without the PIN. For one example, I recently moved into a newly refurbished apartment. It has underfloor heating, with a central control box and remote sensors/controllers in each room. [1] It cost something like €1500-€2500, plus installation, plus the pipes etc. The central control box has an ethernet port and MicroSD slot, which takes a ZIP downloaded from the manufacturer's site. I set this up, and was disappointed to see just how terrible the provided software is. There's no Android app, and the iPhone app costs a further €15 [2]. It has only the most basic functionality: see and change the target temperature in a room, and change which program runs (day/night/off/preset1/2/3). The most-needed thing — to change the preset timings without 100 presses of a 5-button LCD interface — isn't possible. The web interface is the iPhone app implemented as a Java applet making HTTP calls to the server. It's too big to fit on my laptop's screen. There's an 'authenticate' call, but it's optional — the app requires using it, and the call gives the correct pass/fail response, but there's no session handling so there's no need to make this call before reading or changing temperatures. The Java applet at least means it's not easy to do a Google search for the web interface, but I just found this site [3]. There are a few results, but from a long time ago. [1] http://www.billigvvs.dk/Varmesystemer-Gulvvarme-Roth-gulvarme-varianter--Roth-Komplet-Traadloes-Gulvvarmestyring-inkl-Pumpe-4-Kredse-611638.html http://www.billigvvs.dk/Varmesystemer-Gulvvarme-Roth-gulvarm... [2] https://itunes.apple.com/dk/app/roth-touchline/id498448526?mt=8 https://itunes.apple.com/dk/app/roth-touchline/id498448526?m... [3] http://www.base64online.com/hc.php http://www.base64online.com/hc.php