7 ms·
Hacking industrial vehicles from the internet
- tt44 11y agoIs it really even considered hacking if there is no security at all?
- lowglow 11y agoI'd say hacking is a lot about discovery, manipulation, and exploitation, but not necessarily fundamentally about security alone.
- tt44 11y agoSeems to just be using the device in its intended manner, but perhaps it wasn't "intended" for random people on the internet to be accessing an open telnet service on the default port on a system connected directly to the public internet.
- jacquesm 11y agoThe way this usually happens is someone decides to create a device, in order to be able to access it and program it they give it an embedded controller listening to some port on a local area network. Next up someone installs a gateway that starts to assign NAT'd or public IPs to devices and boom suddenly that box is now wide open to whoever stumbles upon the IP. This has caused a whole raft of problems with embedded systems that were built before people were more security conscious. The real problem is that the end users are more often than not totally unaware that their stuff is exposed to the world until something bad happens.
- malka 11y agoGiven the Aaron Swartz case, I would say yes.
- brokenWindows 11y agoThe knee-jerk, canned response from most parties erring on the side of Law & Order claims: Even if the door is wide left open, crossing the threshold is still trespassing, if you don't belong on the property. This is why burglars are typically charged with breaking AND entering. Unlawful entry is still a crime one can commit, without breaking open, or otherwise circumventing pro-active security measures. When it comes to the idea of "hacking" we often find our words fail to describe activities with precision. The nuanced distinction some tend to draw between "hacking" and "cracking" is mostly relegated to specialized jargon, community slang, and pedantry. Laymen often do not distinguish between the two.
- erikpukinskis 11y agoI can't find any reference to "unlawful entry" in the law books. There is a Kurt Russell film by that name though. Trespassing is an actual crime, but it does not fit your description, at least in California. Here, you must have an intent to interfere with the owner's property for it to be considered trespassing. If I enter your open door because I want to invite you to a party, or use your restroom, or hang out with your cats and play video games until you come home I have not committed any crime. Well maybe you could get me for stealing water and electricity, but the entry is not a crime. "Breaking and entering" is also not a crime in California. However, if you actually steal something that is burglary, which is a crime, and does not require forced entry.
- mkagenius 11y agoOr if you heard a baby crying inside and the door is unlocked.
- argonaut 11y agoIs it really rape if she didn't resist (but said no)?
- kriro 11y agoA lot of this insecure IoT/vehicle etc. like stuff reminds me a bit of the early days of phreaking. Discovering "secret numbers", using open conference lines and the like. I think mere discovery is in the spirit of hacking since I'd define it as "curious exploration".
- jacquesm 11y agoIs this supposed to be a poster example of irresponsible disclosure?
- dfc 11y agoWhat was "disclosed"? The page simply demonstrates some of the remote administrative features of these units.
- chatmasta 11y agoYeah, you really have to wonder if this guy even exists or is just an alias. Because how could anyone be this openly reckless?
- tcdent 11y agoThe people that produce blatantly poor products like this are the only ones to blame.
- jacquesm 11y agoAbsolutely, unfortunately it is their customers that will end up with the fall-out.
- b1449835 11y agoYou know it's kind of ironic. How is the customer even supposed to know how insecure these systems are without blog posts like this one so they can avoid bad companies?
- cm2187 11y agoActually, unless the customers are as incompetent as the makers of these devices, they should have asked themselves how come they could configure their device with no authentication, and if they could, who else could. This is not really a bug, this an unfit design.
- 11y ago
- andrewchambers 11y agoI think the companies that make this junk need to be held accountable or else it will keep happening.
- mirimir 11y agoRight, this is what class tort actions are for.
- majcherek128 11y agoNo! It's the companies who buys and USE this crap, even when they are configuring the devices and see that they cannot protect them, that needs to be held accountable. It's like buying a bus with broken brakes, and still use it as public transportation. Nothing wrong with buying the bus.
- andrewchambers 11y agoIts like a company selling a bus with broken brakes, not telling the customer it is broken and then the customer either knowingly or unknowingly use it after working that out for themselves.
- Vintila 11y agoAt least their product page doesn't have some marketing wank about their security. In fact it has no mention of security whatsoever, which is apt because it doesn't seem to have any!
- mirimir 11y agoThere's nothing "new" at http://www.mobile-devices.com/news-and-prs/ http://www.mobile-devices.com/news-and-prs/, either.
- nekinie 11y agoThis is reckless for the manufactures and operators involved, the manor this information was released was also reckless. Poor show all round.
- 31reasons 11y agoJust like FDA we need public or private organization that certify all IoT devices for their internet security level.
- wereHamster 11y ago> I.P. address That's a novel way to abbreviate Internet Protocol address.
- niij 11y agoI'll bite. What's the problem with his abbreviation?
- wereHamster 11y agoDid I say there was a problem? I just said novel. As in: From Old French novel (“new, fresh, recent, recently made or done, strange, rare”) (modern nouvel), from Latin novellus (“new, fresh, young, modern”), diminutive of novus (“new”). More towards the meaning of strange, rare rather than young, modern. Google automatically corrects "I.P. address" to "IP address", so I can't easily say how much more widespread the second spelling is. But I bet is a lot more.
- miahi 11y agoThere is a way to secure this kind of devices. The mobile data providers can offer VPN services for customer devices, so they could be "hidden" from the Internet an the network level, without changing their configuration.