5 ms·

This is obviously horribly illegal and unethical, but it does sort of appeal to that same small part of my brain that longs for things like violent proletariat

This is obviously horribly illegal and unethical, but it does sort of appeal to that same small part of my brain that longs for things like violent proletariat revolution. Imagine if some greyhat security outfit intentionally bricked tens of thousands of these devices. Buyers would be pissed, go to the manufacturer for recompense, possibly to the level of bankruptcy, and there would finally be some incentive for taking IoT security seriously. I'm not saying someone should do it... but I'm not saying someone shouldn't do it.

user5994461 10y ago
Which brings the question: Are the manufacturers stupid enough to put the items on the internet AND embed a self-destruct command...
- MOARDONGZPLZ 10y ago
  I don't think there is a self-destruct command ever from what I've heard. There are plenty of chips with undefined behavior that can be exploited to essentially act as a self-destruct. Failing that I assume there are ways to kill it by overrunning the device's normal mechanisms.
- i_are_smart 10y ago
  These attacks are showing that's it's trivial to achieve remote-code-execution on many of these devices. So in a way, yes, they do have self-destruct built in. Simple connect to one, and then overwrite the boot partition. Or rm -rf /. Or even just use the firewall to block all inbound and outbound connections (an IP camera isn't very useful if you can't view the feed).
  - Shank 10y ago
    The scarier thought to me is that this many cameras installed in houses, businesses, bedrooms, etc. are being commandeered. That's a huge problem for privacy, let alone being used as botnets on the side.
    - i_are_smart 10y ago
      You are correct. I know there are sites out there that even aggregate camera feeds, although the more ethical ones remove any feeds where there may be privacy concerns. Frankly, I would NEVER install such a device in my house. The engineering on many is (almost?) criminally flawed.

user5994461 10y ago

Which brings the question: Are the manufacturers stupid enough to put the items on the internet AND embed a self-destruct command...

MOARDONGZPLZ 10y ago
I don't think there is a self-destruct command ever from what I've heard. There are plenty of chips with undefined behavior that can be exploited to essentially act as a self-destruct. Failing that I assume there are ways to kill it by overrunning the device's normal mechanisms.
i_are_smart 10y ago
These attacks are showing that's it's trivial to achieve remote-code-execution on many of these devices. So in a way, yes, they do have self-destruct built in. Simple connect to one, and then overwrite the boot partition. Or rm -rf /. Or even just use the firewall to block all inbound and outbound connections (an IP camera isn't very useful if you can't view the feed).
- Shank 10y ago
  The scarier thought to me is that this many cameras installed in houses, businesses, bedrooms, etc. are being commandeered. That's a huge problem for privacy, let alone being used as botnets on the side.
  - i_are_smart 10y ago
    You are correct. I know there are sites out there that even aggregate camera feeds, although the more ethical ones remove any feeds where there may be privacy concerns. Frankly, I would NEVER install such a device in my house. The engineering on many is (almost?) criminally flawed.