4 ms·

Pfft... disconnect the thermostat and take it back to the store and get a new one. If their security is so asinine that it can be hacked with ransomware, they s

Pfft... disconnect the thermostat and take it back to the store and get a new one. If their security is so asinine that it can be hacked with ransomware, they should damn well cover it under warranty. 1 bitcoin indeed. Put your old mercury switch back in place until you have the time to go and replace it. At least with your thermostat, you're not losing all your work... ...and it's simple to disconnect and reconnect yourself with 2 or 3 wires. In fact, I'd wager with a single wire and a little (and I do mean only a little) know how and a copy of the factory firmware you can recover it using the exact same process as you unbrick a router in just a few minutes. Though, you should probably close the other holes in your network first. Chances are, if your thermostat has been hacked, they're in your network and it's only a matter of time before your computers suffer the same treatment.

tdkl 10y ago
> If their security is so asinine that it can be hacked with ransomware, they should damn well cover it under warranty. Don't worry, this will be covered by some EULA, when connecting the device, where the owner is solely responsible for these things.
- iRobbery 10y ago
  But not all EULAs are enforceable and certainly not in all countries.
  - CaptSpify 10y ago
    But they can add a crazy amount of friction for a lot of people
nbadg 10y ago
> ...and it's simple to disconnect and reconnect yourself with 2 or 3 wires. This "sort of" works for now, depending on where you live, what season, whether or not you keep junked tech, etc. But it strikes me, not only as dismissive and condescending, but also particularly short-sighted. I can imagine, 20 or 30 years ago, someone saying something similar about a car: "a bug in your ECU is keeping your car from starting? That's your problem for having bought a car running off of a computer!" Fast-forward to today. It simply isn't possible to buy a car without an ECU. The thing is, the changes that brought ECUs to cars are exactly the kinds of changes that are bringing computers into thermostats. In a surprisingly short amount of time, we're going to be living in a world where it simply isn't possible for most people to find a thermostat without a computer. When people feel their agency and autonomy is being compromised with new technology, a common sentiment to echo in the tech world is "if you don't like it, don't use it". But the plain fact of the matter is that in many cases, IoT being an emergent but prototypical example, non-participation simply isn't an option.
- dsfyu404ed 10y ago
  Consumers don't choose a thermostat the same way they choose a vehicle. If you design a thermostat with bad code that becomes non functional your brand isn't irrevocably tarnished for decades. GM still doesn't sell many passenger cars with diesel engines and the consensus on its cylinder deactivation tech is that it's better than 4-6-8 but hard on rings.
- balabaster 10y ago
  This is called planning for disaster. Do you know how many companies come to a grinding halt when their electronic credit card processing system has problems because they all threw out their carbon slips and imprinters? I'm always pleasantly surprised when I go into a store whose electronic systems are down and they keep on ticking because they planned for this... and how long ago was the last time you saw this? I'd forgotten carbon slips even existed until I saw them used in a store a couple of months ago. So call it dismissive, call it what you want. I call it having a backup plan. Also: > I can imagine, 20 or 30 years ago, someone saying something similar about a car: "a bug in your ECU is keeping your car from starting? That's your problem for having bought a car running off of a computer!" Forget 20-30 years ago, farmers are having this exact problem with John Deere right now, and they're concluding exactly this - it's their problem for having brought a tractor that relies on a computer, so they're buying up antique pre-ECU tractors so they're not beholden to these major corporations that "give them a license to use a tractor" for as long as the software works... and they have zero right to fix it if it breaks. So next time you consider throwing out an old technology, just because there's something newer and better, perhaps consider putting it in a box for a time when it might be put to good use - a time such as this, and don't forget to put the installation instructions with it, because guaranteed you can never find them when you need them :P
cybergibbons 10y ago
I did the work on this. It wasn't really meant to be a practical attack. It was largely because there has been speculation around this for the last few years, so we thought we'd actually do it. It's largely to raise awareness that IoT security is poor and we don't have the control to do much about it.
- ganoushoreilly 10y ago
  The IOT village was pretty good this year, did you guys manage to exploit the fridge you were working on?
  - cybergibbons 10y ago
    No, unfortunately not. We had to do it all black box as it was on sale or return, so couldn't inspect the firmware to find vulns. It was runnign Tizen, which makes things a lot harder than Android. We did get some minor vulns on the LG air conditioner.
- balabaster 10y ago
  Kudos to you guys. The lack of security around these devices is laughable. This hack alone should show people that throwing out their old non-smart technology is still premature. Well done for raising the profile of this in the media.
tunap 10y ago
Potentially bad advice: when you short the wires you just fried your transformer or worse. edit: spelling
- balabaster 10y ago
  Er what? You're kidding right? "Don't do anything yourself in case you break something"? It's exactly this mentality that companies bank on to keep you replacing worthless crap with more worthless crap. Get an instruction manual and a screwdriver and become a bit more self sufficient. Your future self will thank you for it.
  - tunap 10y ago
    We're not talking about a disposable, your HVAC system has a significantly large price tag. As you contend, doing is learning and self-sufficiency is a virtue, I agree with the sentiment wholeheartedly and practice on systems whose complexity I understand(and/or I've broken and learned through cost & attrition). The potential I speak of is costs; blower motors, controller boards, micro controllers and transformers can be replaced when your common shorts another wire or the previous installer/service guy decided not to wire according to specs due to broken wire(s), retrofit anomolies, myriad of other reasons. Of course, we learn by doing, choose your lessons accordingly.
falcolas 10y ago
> and it's simple to disconnect and reconnect yourself with 2 or 3 wires Not always. I helped debug some issues with our HVAC at our last office, and all of the thermostats were connected to the HVAC system via an ad-hoc wifi network. There was pin-based authentication, but it was easily googlable. I can only see this kind of control becoming more common as HVAC manufacturers start looking at this as a way to impose DMCA restrictions over furnace installation, maintenance, and 3rd party controls. John Deere is paving the way here.

tdkl 10y ago

> If their security is so asinine that it can be hacked with ransomware, they should damn well cover it under warranty. Don't worry, this will be covered by some EULA, when connecting the device, where the owner is solely responsible for these things.

iRobbery 10y ago
But not all EULAs are enforceable and certainly not in all countries.
- CaptSpify 10y ago
  But they can add a crazy amount of friction for a lot of people

nbadg 10y ago

> ...and it's simple to disconnect and reconnect yourself with 2 or 3 wires. This "sort of" works for now, depending on where you live, what season, whether or not you keep junked tech, etc. But it strikes me, not only as dismissive and condescending, but also particularly short-sighted. I can imagine, 20 or 30 years ago, someone saying something similar about a car: "a bug in your ECU is keeping your car from starting? That's your problem for having bought a car running off of a computer!" Fast-forward to today. It simply isn't possible to buy a car without an ECU. The thing is, the changes that brought ECUs to cars are exactly the kinds of changes that are bringing computers into thermostats. In a surprisingly short amount of time, we're going to be living in a world where it simply isn't possible for most people to find a thermostat without a computer. When people feel their agency and autonomy is being compromised with new technology, a common sentiment to echo in the tech world is "if you don't like it, don't use it". But the plain fact of the matter is that in many cases, IoT being an emergent but prototypical example, non-participation simply isn't an option.

dsfyu404ed 10y ago
Consumers don't choose a thermostat the same way they choose a vehicle. If you design a thermostat with bad code that becomes non functional your brand isn't irrevocably tarnished for decades. GM still doesn't sell many passenger cars with diesel engines and the consensus on its cylinder deactivation tech is that it's better than 4-6-8 but hard on rings.
balabaster 10y ago
This is called planning for disaster. Do you know how many companies come to a grinding halt when their electronic credit card processing system has problems because they all threw out their carbon slips and imprinters? I'm always pleasantly surprised when I go into a store whose electronic systems are down and they keep on ticking because they planned for this... and how long ago was the last time you saw this? I'd forgotten carbon slips even existed until I saw them used in a store a couple of months ago. So call it dismissive, call it what you want. I call it having a backup plan. Also: > I can imagine, 20 or 30 years ago, someone saying something similar about a car: "a bug in your ECU is keeping your car from starting? That's your problem for having bought a car running off of a computer!" Forget 20-30 years ago, farmers are having this exact problem with John Deere right now, and they're concluding exactly this - it's their problem for having brought a tractor that relies on a computer, so they're buying up antique pre-ECU tractors so they're not beholden to these major corporations that "give them a license to use a tractor" for as long as the software works... and they have zero right to fix it if it breaks. So next time you consider throwing out an old technology, just because there's something newer and better, perhaps consider putting it in a box for a time when it might be put to good use - a time such as this, and don't forget to put the installation instructions with it, because guaranteed you can never find them when you need them :P

cybergibbons 10y ago

I did the work on this. It wasn't really meant to be a practical attack. It was largely because there has been speculation around this for the last few years, so we thought we'd actually do it. It's largely to raise awareness that IoT security is poor and we don't have the control to do much about it.

ganoushoreilly 10y ago
The IOT village was pretty good this year, did you guys manage to exploit the fridge you were working on?
- cybergibbons 10y ago
  No, unfortunately not. We had to do it all black box as it was on sale or return, so couldn't inspect the firmware to find vulns. It was runnign Tizen, which makes things a lot harder than Android. We did get some minor vulns on the LG air conditioner.
balabaster 10y ago
Kudos to you guys. The lack of security around these devices is laughable. This hack alone should show people that throwing out their old non-smart technology is still premature. Well done for raising the profile of this in the media.

tunap 10y ago

Potentially bad advice: when you short the wires you just fried your transformer or worse. edit: spelling

balabaster 10y ago
Er what? You're kidding right? "Don't do anything yourself in case you break something"? It's exactly this mentality that companies bank on to keep you replacing worthless crap with more worthless crap. Get an instruction manual and a screwdriver and become a bit more self sufficient. Your future self will thank you for it.
- tunap 10y ago
  We're not talking about a disposable, your HVAC system has a significantly large price tag. As you contend, doing is learning and self-sufficiency is a virtue, I agree with the sentiment wholeheartedly and practice on systems whose complexity I understand(and/or I've broken and learned through cost & attrition). The potential I speak of is costs; blower motors, controller boards, micro controllers and transformers can be replaced when your common shorts another wire or the previous installer/service guy decided not to wire according to specs due to broken wire(s), retrofit anomolies, myriad of other reasons. Of course, we learn by doing, choose your lessons accordingly.

falcolas 10y ago

> and it's simple to disconnect and reconnect yourself with 2 or 3 wires Not always. I helped debug some issues with our HVAC at our last office, and all of the thermostats were connected to the HVAC system via an ad-hoc wifi network. There was pin-based authentication, but it was easily googlable. I can only see this kind of control becoming more common as HVAC manufacturers start looking at this as a way to impose DMCA restrictions over furnace installation, maintenance, and 3rd party controls. John Deere is paving the way here.