3 ms·

Seems like it would be easy to use these tools to brick all these cameras/dvrs, saving everyone (but their owners) a lot of headache.

by cek 10y ago

Analemma_ 10y ago
This is obviously horribly illegal and unethical, but it does sort of appeal to that same small part of my brain that longs for things like violent proletariat revolution. Imagine if some greyhat security outfit intentionally bricked tens of thousands of these devices. Buyers would be pissed, go to the manufacturer for recompense, possibly to the level of bankruptcy, and there would finally be some incentive for taking IoT security seriously. I'm not saying someone should do it... but I'm not saying someone shouldn't do it.
- user5994461 10y ago
  Which brings the question: Are the manufacturers stupid enough to put the items on the internet AND embed a self-destruct command...
  - MOARDONGZPLZ 10y ago
    I don't think there is a self-destruct command ever from what I've heard. There are plenty of chips with undefined behavior that can be exploited to essentially act as a self-destruct. Failing that I assume there are ways to kill it by overrunning the device's normal mechanisms.
  - i_are_smart 10y ago
    These attacks are showing that's it's trivial to achieve remote-code-execution on many of these devices. So in a way, yes, they do have self-destruct built in. Simple connect to one, and then overwrite the boot partition. Or rm -rf /. Or even just use the firewall to block all inbound and outbound connections (an IP camera isn't very useful if you can't view the feed).
    - Shank 10y ago
      The scarier thought to me is that this many cameras installed in houses, businesses, bedrooms, etc. are being commandeered. That's a huge problem for privacy, let alone being used as botnets on the side.
      - i_are_smart 10y ago
        You are correct. I know there are sites out there that even aggregate camera feeds, although the more ethical ones remove any feeds where there may be privacy concerns. Frankly, I would NEVER install such a device in my house. The engineering on many is (almost?) criminally flawed.
i_are_smart 10y ago
This is something that has occurred to me too. It would also -hopefully- result in large, class action lawsuits against the manufacturers for producing products so insecure that they got mass bricked. I would be all for such... preventative action... if it wouldn't also hurt the consumers. Unfortunately it is the end users that would lose.
bkmartin 10y ago
Could it be deemed an act of self defense if done in the middle of such an attack? We have all these laws where we are allowed (in the US) to shoot somebody and kill them if they invade our home or business. If I am a business owner, why could I not then "kill" the device that is attacking me? Is it any different than killing an attacking dog that belongs to someone else? Interesting thought experiment in the very least...
- deleted 10y ago
  [deleted]

Seems like it would be easy to use these tools to brick all these cameras/dvrs, saving everyone (but their owners) a lot of headache.

by cek 10y ago

Seems like it would be easy to use these tools to brick all these cameras/dvrs, saving everyone (but their owners) a lot of headache.

Analemma_ 10y ago

This is obviously horribly illegal and unethical, but it does sort of appeal to that same small part of my brain that longs for things like violent proletariat revolution. Imagine if some greyhat security outfit intentionally bricked tens of thousands of these devices. Buyers would be pissed, go to the manufacturer for recompense, possibly to the level of bankruptcy, and there would finally be some incentive for taking IoT security seriously. I'm not saying someone should do it... but I'm not saying someone shouldn't do it.

user5994461 10y ago
Which brings the question: Are the manufacturers stupid enough to put the items on the internet AND embed a self-destruct command...
- MOARDONGZPLZ 10y ago
  I don't think there is a self-destruct command ever from what I've heard. There are plenty of chips with undefined behavior that can be exploited to essentially act as a self-destruct. Failing that I assume there are ways to kill it by overrunning the device's normal mechanisms.
- i_are_smart 10y ago
  These attacks are showing that's it's trivial to achieve remote-code-execution on many of these devices. So in a way, yes, they do have self-destruct built in. Simple connect to one, and then overwrite the boot partition. Or rm -rf /. Or even just use the firewall to block all inbound and outbound connections (an IP camera isn't very useful if you can't view the feed).
  - Shank 10y ago
    The scarier thought to me is that this many cameras installed in houses, businesses, bedrooms, etc. are being commandeered. That's a huge problem for privacy, let alone being used as botnets on the side.
    - i_are_smart 10y ago
      You are correct. I know there are sites out there that even aggregate camera feeds, although the more ethical ones remove any feeds where there may be privacy concerns. Frankly, I would NEVER install such a device in my house. The engineering on many is (almost?) criminally flawed.

i_are_smart 10y ago

This is something that has occurred to me too. It would also -hopefully- result in large, class action lawsuits against the manufacturers for producing products so insecure that they got mass bricked. I would be all for such... preventative action... if it wouldn't also hurt the consumers. Unfortunately it is the end users that would lose.

bkmartin 10y ago

Could it be deemed an act of self defense if done in the middle of such an attack? We have all these laws where we are allowed (in the US) to shoot somebody and kill them if they invade our home or business. If I am a business owner, why could I not then "kill" the device that is attacking me? Is it any different than killing an attacking dog that belongs to someone else? Interesting thought experiment in the very least...

deleted 10y ago
[deleted]