5 ms·

There was a link on HN(?) a few days back about a guy that was testing some LED Light Bulb. Those light bulb are a bit clever as they need to plug into your wi

by gutnor 11y ago

There was a link on HN(?) a few days back about a guy that was testing some LED Light Bulb. Those light bulb are a bit clever as they need to plug into your wifi for remote control. He discovered that the plug was creating a new wifi network, with hardcoded simple password and security setting such that it exposed you internal network to an external attacker. I can't remember if it was calling home, but surely a future version will. So yeah, you will eventually end up with something connected, light bulbs are connected now !

SixSigma 11y ago
I don't know about the HN link but here's the article in question : https://mjg59.dreamwidth.org/40397.html https://mjg59.dreamwidth.org/40397.html And the list of things it does : So, in summary: it's a device that infringes my copyright, gives you root access in response to trivial credentials, has access control that depends entirely on nobody ever looking at the packets, is sufficiently poorly implemented that you can crash both it and the bulbs, has a cloud access protocol that has no security whatsoever and also acts as an easy mechanism for people to circumvent your network security.
- at-fates-hands 11y ago
  I'm not paranoid or a conspiracy nut, but I can see where people would jump to the conclusion this is being done purposefully by the government to extend its blanket surveillance of the population. I may not be able to hack your iphone, but if I can get on your network through a rather easy means, it will give me access to what the information I really want and then correlate it with the rest of the information they can get from the carriers. I would imagine this is exactly the sort of soft target the NSA looks for.
  - davidhowlett 11y ago
    Hanlon's razor: "never attribute to malice that which is adequately explained by stupidity"
    - taneq 11y ago
      Clark's Law: Any sufficiently advanced incompetence is indistinguishable from malice.
  - darpa_escapee 11y ago
    Incompetence is convenient to state actors, hence why there is a panic that people are waking up to its consequences and will end up using encryption competently. I wouldn't say it is at all intentional.
  - deleted 11y ago
    [deleted]
  - NoMoreNicksLeft 11y ago
    I wish it were being done by the government. If only it was some supervillain using mind control, slowly acquiring all these weird and ubiquitous credentials so they could spy on me... While that would be bad, there's a way to fix this. We can expose the supervillain, fix the problem, and TA-DA! everything's good again. What I actually suspect is that the typical person is just dumb enough (and hey, I'm not doing the superiority complex thing here, pretty sure it applies to me too) to let this happen accidentally. We don't need to be manipulated or brainwashed or tricked. We'll do this because Amazon will list the bad device 2 cents cheaper, and the companies making the good stuff anticipate this and don't bother to make the 2-cents-more-expensive-but-better one. It helps that people are oblivious to how damning metadata is. One could easily foresee being able to tell who is adulterous just by when the front door opens and closes, for instance.
    - CamperBob2 11y ago
      It helps that people are oblivious to how damning metadata is. One could easily foresee being able to tell who is adulterous just by when the front door opens and closes, for instance. And in some other parts of the world, far removed from TV cameras and annoying privacy advocates, that's basically how we decide who gets a drone strike. Metadata is really, really important... otherwise the government wouldn't be interested in collecting it.
  - Phlarp 11y ago
    This is really just silly, anybody working "on the ground" so to speak with technology understands there is no need for malice here. I would agree with the narrative that so far in the digital age the elephant in the room (NSA) has purposefully withheld security related information based on the calculus that "it's worth having insecure things floating around, so long as it's mostly just us that is capable of hacking them at scale"-- that math is rapidly changing now, hopefully their policies and objectives will shift with it.
- uxp 11y ago
  @mjg59, on Twitter and his blog there, is an amusing, if not depressing, feed to follow. He has poor impulse control for purchasing internet-enabled devices and investigating how terrible they are.

by gutnor 11y ago

SixSigma 11y ago

I don't know about the HN link but here's the article in question : https://mjg59.dreamwidth.org/40397.html https://mjg59.dreamwidth.org/40397.html And the list of things it does : So, in summary: it's a device that infringes my copyright, gives you root access in response to trivial credentials, has access control that depends entirely on nobody ever looking at the packets, is sufficiently poorly implemented that you can crash both it and the bulbs, has a cloud access protocol that has no security whatsoever and also acts as an easy mechanism for people to circumvent your network security.

at-fates-hands 11y ago
I'm not paranoid or a conspiracy nut, but I can see where people would jump to the conclusion this is being done purposefully by the government to extend its blanket surveillance of the population. I may not be able to hack your iphone, but if I can get on your network through a rather easy means, it will give me access to what the information I really want and then correlate it with the rest of the information they can get from the carriers. I would imagine this is exactly the sort of soft target the NSA looks for.
- davidhowlett 11y ago
  Hanlon's razor: "never attribute to malice that which is adequately explained by stupidity"
  - taneq 11y ago
    Clark's Law: Any sufficiently advanced incompetence is indistinguishable from malice.
- darpa_escapee 11y ago
  Incompetence is convenient to state actors, hence why there is a panic that people are waking up to its consequences and will end up using encryption competently. I wouldn't say it is at all intentional.
- deleted 11y ago
  [deleted]
- NoMoreNicksLeft 11y ago
  I wish it were being done by the government. If only it was some supervillain using mind control, slowly acquiring all these weird and ubiquitous credentials so they could spy on me... While that would be bad, there's a way to fix this. We can expose the supervillain, fix the problem, and TA-DA! everything's good again. What I actually suspect is that the typical person is just dumb enough (and hey, I'm not doing the superiority complex thing here, pretty sure it applies to me too) to let this happen accidentally. We don't need to be manipulated or brainwashed or tricked. We'll do this because Amazon will list the bad device 2 cents cheaper, and the companies making the good stuff anticipate this and don't bother to make the 2-cents-more-expensive-but-better one. It helps that people are oblivious to how damning metadata is. One could easily foresee being able to tell who is adulterous just by when the front door opens and closes, for instance.
  - CamperBob2 11y ago
    It helps that people are oblivious to how damning metadata is. One could easily foresee being able to tell who is adulterous just by when the front door opens and closes, for instance. And in some other parts of the world, far removed from TV cameras and annoying privacy advocates, that's basically how we decide who gets a drone strike. Metadata is really, really important... otherwise the government wouldn't be interested in collecting it.
- Phlarp 11y ago
  This is really just silly, anybody working "on the ground" so to speak with technology understands there is no need for malice here. I would agree with the narrative that so far in the digital age the elephant in the room (NSA) has purposefully withheld security related information based on the calculus that "it's worth having insecure things floating around, so long as it's mostly just us that is capable of hacking them at scale"-- that math is rapidly changing now, hopefully their policies and objectives will shift with it.
uxp 11y ago
@mjg59, on Twitter and his blog there, is an amusing, if not depressing, feed to follow. He has poor impulse control for purchasing internet-enabled devices and investigating how terrible they are.