10 ms·

Of course smart homes are targets for hackers

97 points by janvdberg 10y ago

blacksmith_tb 10y ago
I am not sure I follow - is the implication that some "creepy" person I met at a bar/cafe/etc. who knows only my first name will somehow exploit $RANDOM_IOT_DEVICE in my home? Even if you allow that they might be able to ID me accurately (say with a phone camera), they'd need to find my IP (which changes regularly, DHCP from my ISP), get through the firewall, and compromise the device. That isn't impossible, but it would make a better subplot for Mr. Robot than something I should spend time worrying about. It seems much more likely IoT devices will be exploited by scripts, running over ranges of IPs, and their "creepy" owners will be thousands of miles away from my home.
- csydas 10y ago
  I think the general concern is both that the IoT devices provide incredibly poor security combined with the general availability of personal information getting tied across the IoT infrastructure. Federated Facebook/G+ logins for IoT devices are just around the corner, if they're not already here, and more and more IoT devices show up on Shodan every day. I will concur the article is a bit of IoT fear mongering combine with general paranoia over the current state of web services, but it's not really like this is much of a stretch for the near future.
- marcoperaza 10y ago
  >they'd need to find my IP (which changes regularly, DHCP from my ISP) You might be surprised at how long you can have the same IP. It can easily go for a year with some ISPs.
  - eveningcoffee 10y ago
    Besides, you just have to hack only a single device to keep logging your current IP address.
- pessimizer 10y ago
  > It seems much more likely IoT devices will be exploited by scripts, running over ranges of IPs, and their "creepy" owners will be thousands of miles away from my home. It seems much more likely that it's not an either/or proposition. Does it seem that unreasonable that someone can go from name to email to spearfishing attempts to ip to firewall exploit to home security camera/refrigerator/every out-of-date piece-of-garbage IoThing in your house if they're specifically trying to get you? That was pretty much each of the 100 stories behind the Fappening. You think a rival startup wouldn't go through the effort, or a creepy neighbor? Isn't that the entire concept behing RATting (minus the easy way in provided by the IoT)? You think it won't be turned into a 1-click app with notifications after each stage is passed?
- s_q_b 10y ago
  Do you have anything in your home that you might wish to keep private? Any texts with loved ones? How about any intimate moments, whispered nothings that you would prefer not be recorded? Oh, you say you have nothing to hide. Do you have a bank account? An investment portfolio? College funds for your kids? A skilled attacker can make all of that vanish. Without many people noticing, the IoT has slowly invaded the average American home. Almost every TV is a Smart TV, internet gateways are smarter, Alexa, Siri, Cortana, light bulbs, door locks, refrigerators, thermostats... With a little effort, an average pen tester could own your system, publish your secrets, steal your life savings, record you with your wife, and brick your iPhone, TV, and furnace just for good measure. It's time to take IoT security seriously. *It actually was on Mr. Robot. There was a subplot wherein Darlene compromises an E-Corp exec's smart home, causes the appliances and security system to malfunction to drive away the occupant, and then uses the place as a hideout.
  - deegles 10y ago
    Even if you literally have nothing valuable to hide, consider that a hacked device on your network could be used for malicious things like DDOS, hosting illegal content, proxies for other attacks, etc etc.
    - deleted 10y ago
      [deleted]
    - yomly 10y ago
      More importantly, consider how much more empowered malicious state-backed entities become. At the moment we can only be surveilled (which is plenty terrifying). What happens when we can be physically influened remotely at scale
- pja 10y ago
  No, the implication is that your abusive partner, or perhaps a stalker, might turn your IoT devices against you & use them to watch you in your own home. It’s easy for people to be completely oblivious to this reality if they have never experienced it themselves or had someone they knew be on the receiving end of this kind of behaviour. It really is not that uncommon.
  - makomk 10y ago
    If your threat model includes an abusive partner, then it has to include physical and authorised access, device replacement, device replacement with completely different hardware... basically, this is woefully insufficient.
- alistproducer2 10y ago
  The author is alluding to taking a person home after a bar.
cakeface 10y ago
This article, like many security articles, shows an unwillingness to reason about security in a non-extreme manner. All aspects of life include risk, internet or IoT security are just one axis of risk that must be weighed when making decisions and, well, living. I find The Wirecutter's advice to be perfectly sound and reasonable.
- mjg59 10y ago
  Most people aren't sufficiently informed to be able to make those decisions in a reasonable way, and having the Wirecutter provide this kind of advice without explaining that there are cases where some people do need to be more paranoid is harming those people. Telling people that everything will be fine when we know that for some people there's a much higher probability that it won't be shouldn't be acceptable.
  - enraged_camel 10y ago
    >>Most people aren't sufficiently informed to be able to make those decisions in a reasonable way Exactly. The vast majority of people aren't aware that their "smart thermostat" can be hacked and used to perform a denial of service attack on websites.
    - anc84 10y ago
      I'd wager that the vast majority of people also does not care the slightest about that. The manufacturer is at fault for that, not the person who bought the device. Unless people themselves get any drawback, why should they care?
      - enraged_camel 10y ago
        Well, it's like how people used to not care about leaving their wifi access points unprotected back in the day. It took several years of news stories of neighbors downloading child porn through those WAPs (and things like that) before people became aware of the risks and password protection became standard practice.
munin 10y ago
How is a consumer supposed to answer any of these questions for themselves?
- mjg59 10y ago
  Ideally anybody reviewing these devices should be getting answers to them.
- clock_tower 10y ago
  Just don't buy smart-house equipment in the first place, if you ask me. Dumb houses are good enough; and unless you're talking about panic buttons to call the police, more connectivity means more vulnerability. (Now, to find a TV that doesn't have a microphone.)
- eveningcoffee 10y ago
  I am afraid that most of them are not even given any option very soon. Try to find a TV without reflective screen these days. It is impossible as nobody is making them even where there is certainly a market for them.
rsync 10y ago
A long, long time ago - before JohnCompanies and rsync.net and Oh By - I was a windows sysadmin. One thing I noticed was, for the most part, the intelligence of a user was inversely correlated to how much shit they had running in their windows system tray. The smarter you were, the fewer little blinking mini-icons you had down in the lower-right corner of the desktop. You didn't need those gimmicks and you understood the value of simplicity in a running system. I wonder how smart homes and smart people correlate ?
- pjc50 10y ago
  Like browser toolbars. I was going to say "at least IoT devices can't driveby install themselves", but I'm sure someone will find a way. Maybe people can have Bonzi Buddy for their thermostat.
  - deegles 10y ago
    It will probably become a selling point for new construction once it gets cheap enough. So it will be more like crapware installed on a new PC, except inside your walls. :)
    - pjc50 10y ago
      Oh god, it's going to have to be on the structural reports. "House is at risk from subsidence and there's Heartbleed in the heating system"
    - tunap 10y ago
      It doesn't have to be crap if it is modular and upgradeable. Executive controller, hardware controllers, sensors and switches need to be serviceable/upgradeable. The paramount feature(or lack of) would be to keep it air gapped. As soon as you connect it to the net, all is lost & you are now a slave to fees from an SaaS that may be gone in a year, security updates and haxor shenanigans. A truly automated system doesnt require your input after roll-out & dialing. Of course, that does mean no cool app to fiddle with.
drcross 10y ago
Can someone fill me in on this IOT hacking phenomenon. Surely the vast majority of devices sit behind a NATted router with a firewall on consumer premises, they don't have dedicated IPv4 addresses and don't touch the internet unless they are requested to (or already have a bad binary on install). How is this hacking happening?
- s_q_b 10y ago
  Generally the devices poke holes in the firewall with UPnP. There are also other vectors (ZeroConf, STUN, CWMP). The problem is that, once past the firewall, many of these devices have weak to no security, e.g. open telnet daemons, root:root default user/password, and other trivial vulnerabilities.
  - rudolf0 10y ago
    The real confusing part is why this didn't happen earlier. Or, more likely, it did happen earlier but the attackers weren't properly weaponizing or "botkilling" / patching the devices?
    - s_q_b 10y ago
      There were some worms spreading through IoT devices, lots of foreshadowing. The Hajime and Mirai worms, combined with the utter lack of response, were a pretty good indication some shit was about to go down. I've been Cassandra yelling into the wind on this one for a while, so there is some schadenfreude involved for me.
- gh02t 10y ago
  Also consider the hubs. To take a well known example, Phillips Hue lightbulbs don't connect to the net directly and don't have any significant computational resources to speak of. They are just an 8-bit Atmel microprocessor with a Zigbee radio to talk to the hub ( https://blog.adafruit.com/2016/06/14/teardown-of-a-philips-hue-led-lightbulb-with-zigbee-and-atmega2564-avr-iot-iotuesday/ https://blog.adafruit.com/2016/06/14/teardown-of-a-philips-h... ). On the other hand, the Hue hub is running a full embedded Linux distro (which has even been rooted, though it requires physical access http://colinoflynn.com/2016/07/getting-root-on-philips-hue-bridge-2-0/ http://colinoflynn.com/2016/07/getting-root-on-philips-hue-b... ). A lot of the "real" smart home gadgets are using this model and they will gleefully punch a hole in you firewall, so it comes down to the security of the hub(s). From what I know, Mirai is mostly hitting stuff that isn't what I think of as IoT - stuff like routers, security cameras and DVRs. Seems like it's being misrepresented, though that's not to say that an attack on something more in line with what I think of as IoT/smart home isn't possible. I have no doubt that tons of refrigerators with Wifi and connected coffee makers are vulnerable. Part of me wonders if Mirai was meant as a grey hat warning since it's just showing what's possible only picking on low hanging fruit ("Mirai" means "future" in Japanese).
upofadown 10y ago
It entirely depends on the thing. If someone hacks my light switch all they can do is turn the light off and on while revealing to me I have a problem I have to fix. Anyone can call my home phone number and turn on my car plug for 4 hours. All they will do is waste a small amount of electricity. If they want to disable my alarm and open my door, well that will be a lot harder, particularly if they want to try to do it remotely. If there is anything that can, say, let someone remotely cause a fire then the problem isn't security. The problem is that you have something under software control that can cause a fire. Chances are that regular faults will burn down the house much more often than "hackers" will. Note that such faults can be caused by things like lighting hitting the power lines somewhere in your city. They don't have to be actual bugs. Of course the "internet of things" is kind of a joke right now. What with the lack of any sort of standardization it is unlikely that the owner will be able to usefully control things much less some remote attacker.
- pdkl95 10y ago
  > If someone hacks my light switch all they can do is turn the light off and on Or maybe they can monitor your light switch without changing its state. That data could be used to estimate when you are home with reasonable accuracy. Or maybe they don't care about you at all and simply use your device in a DDoS or as a relay in an attack on someone else.
  - upofadown 10y ago
    Lights are normally visible from outside the house...
    - pdkl95 10y ago
      So? Observing from the outside would require local observations, which increasingly is tracked (ALPR, CCTV). With a network attack the knowledge can be gained (in bulk!) with a lot less risk. Monitoring many lights (even those not visible from the street) in hundreds of houses without the risk of creating a local data trail is very different than driving by a few houses and observing for yourself. However, that's just one way an insecure device could be abused that uses the data we know is available. I'm sure there are subtle and clever ways to abuse these devices that are still unknown.
sophacles 10y ago
One threat model I think is being missed here: the fact that scanners and geolocation services both exist, makes the job of burglars much simpler in an insecure IOT world. Basically they go to their friendly shodan-alike and get a list of ip running IOT cameras (etc). Then they pipe that list through a geolocation service and grep for their target region. Then they just monitor for good targets, and when they are unoccupied. Much like the big hubub when people pointed out that mentioning vacations on an open facebook feed was burglar bait. Both take away a lot of effort for reconning homes, so they are probably being used to narrow the search for good potential targets.
- duaneb 10y ago
  This is also something visible to white hats: a "good guy" could easily warn people who are a vulnerability to the wider health of the internet. Of course there's zero money in this, so I guess capitalists are up the river.
- fegu 10y ago
  This isn't the threat it is made out to be. Most homes are empty every day when people are at work. It isn't really necessary to perform advanced analysis to find an empty home.
  - freeflight 10y ago
    Most homes, but not all homes, especially with home offices being an actual thing that's becoming more popular. I doubt many burglars want the risk of running into somebody during their "heist", so they will stake out possible targets. Staking out a target used to be time-consuming and a bit risky, because the burglar needed to be on location for quite some time to conduct surveillance themselves, in person. Now they can stake out multiple targets at the same time, from anywhere they want, with all the anonymity the Internets allow for.
    - trprog 10y ago
      While the addition of anonymity would certainly be appreciated by would-be burglars you seem to be leaving out a small detail. It is trivially easy for a burglar to determine if someone is home. They can just walk up to the front door, knock and see if anyone answers. If someone is there ask for a glass of water, ask if they have accepted Jesus, ask if Steve lives there or whatever other BS excuse they have ready before simply moving on to another prospect. If no one comes to the door then the home is very likely empty and they can proceed. This has the added benefit for the burglar that anyone seeing them enter the property will assume they have good reason to be there. After all they marched straight up to the front door and rang the doorbell which is what non-thieves do so its less suspicious if they then go around the side of the house when no one answers.
chx 10y ago
Let me grab this occasion to ask: WTF is going on in general? I readily presume most people have a wifi router with these iot devices and while obviously those are not the best security wise (I presume again most don't run pfsense or openwrt) but still they are there, NATting away happily. How would a baby monitor appear on the open web...? I can't imagine the average user setting them up in DMZ or port forward or ... what is happening here? I am obviously missing some primarily home networking oriented protocol probably because I am configuring my own routers and I am simply unaware of some feature of the factory firmware that allows traffic inwards.
- userbinator 10y ago
  I don't use those products, but I can imagine many of them automatically doing port forwards (https://en.wikipedia.org/wiki/Universal_Plug_and_Play#NAT_traversal https://en.wikipedia.org/wiki/Universal_Plug_and_Play#NAT_tr... ) and possibly even automatically registering in a dynamic DNS service, all for the "convenience" of the "I don't know what a port is and I don't want to know" user.
  - chx 10y ago
    > Many routers and firewalls expose themselves as Internet Gateway Devices, allowing any local UPnP control point to perform a variety of actions, including retrieving the external IP address of the device, enumerate existing port mappings, and add or remove port mappings. Are you bloody kidding me? Why do you even have a firewall, rudimentary as it is, then?
    - geococcyxc 10y ago
      Not all home routers are allowing this by default. I don't have any hard numbers to offer, but my feeling is that only very old and today's very crappy ones do.
    - closeparen 10y ago
      UPnP comes from the view that NAT is an unfortunate artifact of residential ISPs only giving out one IPv4 address per household, not a crucial security strategy. If you really think of your NATing router as a security device, turn off UPnP. Though I'm not sure how much good that will do, as any device can still phone home or reverse tunnel.
yabatopia 10y ago
The author poses some interesting questions, but unfortunately doesn't provide really useful answers. How is the avarage consumer going to find out the security reputation of a vendor of smart home devices? How to find a reputable vendor for such or such device like a baby monitor, security cam, smart lightning or wifi repeater? In an easy way and easy to comprehend? Is there a website to check to security of smart home devices, or a list of reputable vendors? That would be a first step.

97 points by janvdberg 10y ago

I am not sure I follow - is the implication that some "creepy" person I met at a bar/cafe/etc. who knows only my first name will somehow exploit $RANDOM_IOT_DEVICE in my home? Even if you allow that they might be able to ID me accurately (say with a phone camera), they'd need to find my IP (which changes regularly, DHCP from my ISP), get through the firewall, and compromise the device. That isn't impossible, but it would make a better subplot for Mr. Robot than something I should spend time worrying about. It seems much more likely IoT devices will be exploited by scripts, running over ranges of IPs, and their "creepy" owners will be thousands of miles away from my home.

csydas 10y ago
I think the general concern is both that the IoT devices provide incredibly poor security combined with the general availability of personal information getting tied across the IoT infrastructure. Federated Facebook/G+ logins for IoT devices are just around the corner, if they're not already here, and more and more IoT devices show up on Shodan every day. I will concur the article is a bit of IoT fear mongering combine with general paranoia over the current state of web services, but it's not really like this is much of a stretch for the near future.
marcoperaza 10y ago
>they'd need to find my IP (which changes regularly, DHCP from my ISP) You might be surprised at how long you can have the same IP. It can easily go for a year with some ISPs.
- eveningcoffee 10y ago
  Besides, you just have to hack only a single device to keep logging your current IP address.
pessimizer 10y ago
> It seems much more likely IoT devices will be exploited by scripts, running over ranges of IPs, and their "creepy" owners will be thousands of miles away from my home. It seems much more likely that it's not an either/or proposition. Does it seem that unreasonable that someone can go from name to email to spearfishing attempts to ip to firewall exploit to home security camera/refrigerator/every out-of-date piece-of-garbage IoThing in your house if they're specifically trying to get you? That was pretty much each of the 100 stories behind the Fappening. You think a rival startup wouldn't go through the effort, or a creepy neighbor? Isn't that the entire concept behing RATting (minus the easy way in provided by the IoT)? You think it won't be turned into a 1-click app with notifications after each stage is passed?
s_q_b 10y ago
Do you have anything in your home that you might wish to keep private? Any texts with loved ones? How about any intimate moments, whispered nothings that you would prefer not be recorded? Oh, you say you have nothing to hide. Do you have a bank account? An investment portfolio? College funds for your kids? A skilled attacker can make all of that vanish. Without many people noticing, the IoT has slowly invaded the average American home. Almost every TV is a Smart TV, internet gateways are smarter, Alexa, Siri, Cortana, light bulbs, door locks, refrigerators, thermostats... With a little effort, an average pen tester could own your system, publish your secrets, steal your life savings, record you with your wife, and brick your iPhone, TV, and furnace just for good measure. It's time to take IoT security seriously. *It actually was on Mr. Robot. There was a subplot wherein Darlene compromises an E-Corp exec's smart home, causes the appliances and security system to malfunction to drive away the occupant, and then uses the place as a hideout.
- deegles 10y ago
  Even if you literally have nothing valuable to hide, consider that a hacked device on your network could be used for malicious things like DDOS, hosting illegal content, proxies for other attacks, etc etc.
  - deleted 10y ago
    [deleted]
  - yomly 10y ago
    More importantly, consider how much more empowered malicious state-backed entities become. At the moment we can only be surveilled (which is plenty terrifying). What happens when we can be physically influened remotely at scale
pja 10y ago
No, the implication is that your abusive partner, or perhaps a stalker, might turn your IoT devices against you & use them to watch you in your own home. It’s easy for people to be completely oblivious to this reality if they have never experienced it themselves or had someone they knew be on the receiving end of this kind of behaviour. It really is not that uncommon.
- makomk 10y ago
  If your threat model includes an abusive partner, then it has to include physical and authorised access, device replacement, device replacement with completely different hardware... basically, this is woefully insufficient.
alistproducer2 10y ago
The author is alluding to taking a person home after a bar.

cakeface 10y ago

This article, like many security articles, shows an unwillingness to reason about security in a non-extreme manner. All aspects of life include risk, internet or IoT security are just one axis of risk that must be weighed when making decisions and, well, living. I find The Wirecutter's advice to be perfectly sound and reasonable.

mjg59 10y ago
Most people aren't sufficiently informed to be able to make those decisions in a reasonable way, and having the Wirecutter provide this kind of advice without explaining that there are cases where some people do need to be more paranoid is harming those people. Telling people that everything will be fine when we know that for some people there's a much higher probability that it won't be shouldn't be acceptable.
- enraged_camel 10y ago
  >>Most people aren't sufficiently informed to be able to make those decisions in a reasonable way Exactly. The vast majority of people aren't aware that their "smart thermostat" can be hacked and used to perform a denial of service attack on websites.
  - anc84 10y ago
    I'd wager that the vast majority of people also does not care the slightest about that. The manufacturer is at fault for that, not the person who bought the device. Unless people themselves get any drawback, why should they care?
    - enraged_camel 10y ago
      Well, it's like how people used to not care about leaving their wifi access points unprotected back in the day. It took several years of news stories of neighbors downloading child porn through those WAPs (and things like that) before people became aware of the risks and password protection became standard practice.

munin 10y ago

How is a consumer supposed to answer any of these questions for themselves?

mjg59 10y ago
Ideally anybody reviewing these devices should be getting answers to them.
clock_tower 10y ago
Just don't buy smart-house equipment in the first place, if you ask me. Dumb houses are good enough; and unless you're talking about panic buttons to call the police, more connectivity means more vulnerability. (Now, to find a TV that doesn't have a microphone.)
eveningcoffee 10y ago
I am afraid that most of them are not even given any option very soon. Try to find a TV without reflective screen these days. It is impossible as nobody is making them even where there is certainly a market for them.

rsync 10y ago

A long, long time ago - before JohnCompanies and rsync.net and Oh By - I was a windows sysadmin. One thing I noticed was, for the most part, the intelligence of a user was inversely correlated to how much shit they had running in their windows system tray. The smarter you were, the fewer little blinking mini-icons you had down in the lower-right corner of the desktop. You didn't need those gimmicks and you understood the value of simplicity in a running system. I wonder how smart homes and smart people correlate ?

pjc50 10y ago
Like browser toolbars. I was going to say "at least IoT devices can't driveby install themselves", but I'm sure someone will find a way. Maybe people can have Bonzi Buddy for their thermostat.
- deegles 10y ago
  It will probably become a selling point for new construction once it gets cheap enough. So it will be more like crapware installed on a new PC, except inside your walls. :)
  - pjc50 10y ago
    Oh god, it's going to have to be on the structural reports. "House is at risk from subsidence and there's Heartbleed in the heating system"
  - tunap 10y ago
    It doesn't have to be crap if it is modular and upgradeable. Executive controller, hardware controllers, sensors and switches need to be serviceable/upgradeable. The paramount feature(or lack of) would be to keep it air gapped. As soon as you connect it to the net, all is lost & you are now a slave to fees from an SaaS that may be gone in a year, security updates and haxor shenanigans. A truly automated system doesnt require your input after roll-out & dialing. Of course, that does mean no cool app to fiddle with.

drcross 10y ago

Can someone fill me in on this IOT hacking phenomenon. Surely the vast majority of devices sit behind a NATted router with a firewall on consumer premises, they don't have dedicated IPv4 addresses and don't touch the internet unless they are requested to (or already have a bad binary on install). How is this hacking happening?

s_q_b 10y ago
Generally the devices poke holes in the firewall with UPnP. There are also other vectors (ZeroConf, STUN, CWMP). The problem is that, once past the firewall, many of these devices have weak to no security, e.g. open telnet daemons, root:root default user/password, and other trivial vulnerabilities.
- rudolf0 10y ago
  The real confusing part is why this didn't happen earlier. Or, more likely, it did happen earlier but the attackers weren't properly weaponizing or "botkilling" / patching the devices?
  - s_q_b 10y ago
    There were some worms spreading through IoT devices, lots of foreshadowing. The Hajime and Mirai worms, combined with the utter lack of response, were a pretty good indication some shit was about to go down. I've been Cassandra yelling into the wind on this one for a while, so there is some schadenfreude involved for me.
gh02t 10y ago
Also consider the hubs. To take a well known example, Phillips Hue lightbulbs don't connect to the net directly and don't have any significant computational resources to speak of. They are just an 8-bit Atmel microprocessor with a Zigbee radio to talk to the hub ( https://blog.adafruit.com/2016/06/14/teardown-of-a-philips-hue-led-lightbulb-with-zigbee-and-atmega2564-avr-iot-iotuesday/ https://blog.adafruit.com/2016/06/14/teardown-of-a-philips-h... ). On the other hand, the Hue hub is running a full embedded Linux distro (which has even been rooted, though it requires physical access http://colinoflynn.com/2016/07/getting-root-on-philips-hue-bridge-2-0/ http://colinoflynn.com/2016/07/getting-root-on-philips-hue-b... ). A lot of the "real" smart home gadgets are using this model and they will gleefully punch a hole in you firewall, so it comes down to the security of the hub(s). From what I know, Mirai is mostly hitting stuff that isn't what I think of as IoT - stuff like routers, security cameras and DVRs. Seems like it's being misrepresented, though that's not to say that an attack on something more in line with what I think of as IoT/smart home isn't possible. I have no doubt that tons of refrigerators with Wifi and connected coffee makers are vulnerable. Part of me wonders if Mirai was meant as a grey hat warning since it's just showing what's possible only picking on low hanging fruit ("Mirai" means "future" in Japanese).

upofadown 10y ago

It entirely depends on the thing. If someone hacks my light switch all they can do is turn the light off and on while revealing to me I have a problem I have to fix. Anyone can call my home phone number and turn on my car plug for 4 hours. All they will do is waste a small amount of electricity. If they want to disable my alarm and open my door, well that will be a lot harder, particularly if they want to try to do it remotely. If there is anything that can, say, let someone remotely cause a fire then the problem isn't security. The problem is that you have something under software control that can cause a fire. Chances are that regular faults will burn down the house much more often than "hackers" will. Note that such faults can be caused by things like lighting hitting the power lines somewhere in your city. They don't have to be actual bugs. Of course the "internet of things" is kind of a joke right now. What with the lack of any sort of standardization it is unlikely that the owner will be able to usefully control things much less some remote attacker.

pdkl95 10y ago
> If someone hacks my light switch all they can do is turn the light off and on Or maybe they can monitor your light switch without changing its state. That data could be used to estimate when you are home with reasonable accuracy. Or maybe they don't care about you at all and simply use your device in a DDoS or as a relay in an attack on someone else.
- upofadown 10y ago
  Lights are normally visible from outside the house...
  - pdkl95 10y ago
    So? Observing from the outside would require local observations, which increasingly is tracked (ALPR, CCTV). With a network attack the knowledge can be gained (in bulk!) with a lot less risk. Monitoring many lights (even those not visible from the street) in hundreds of houses without the risk of creating a local data trail is very different than driving by a few houses and observing for yourself. However, that's just one way an insecure device could be abused that uses the data we know is available. I'm sure there are subtle and clever ways to abuse these devices that are still unknown.

sophacles 10y ago

One threat model I think is being missed here: the fact that scanners and geolocation services both exist, makes the job of burglars much simpler in an insecure IOT world. Basically they go to their friendly shodan-alike and get a list of ip running IOT cameras (etc). Then they pipe that list through a geolocation service and grep for their target region. Then they just monitor for good targets, and when they are unoccupied. Much like the big hubub when people pointed out that mentioning vacations on an open facebook feed was burglar bait. Both take away a lot of effort for reconning homes, so they are probably being used to narrow the search for good potential targets.

duaneb 10y ago
This is also something visible to white hats: a "good guy" could easily warn people who are a vulnerability to the wider health of the internet. Of course there's zero money in this, so I guess capitalists are up the river.
fegu 10y ago
This isn't the threat it is made out to be. Most homes are empty every day when people are at work. It isn't really necessary to perform advanced analysis to find an empty home.
- freeflight 10y ago
  Most homes, but not all homes, especially with home offices being an actual thing that's becoming more popular. I doubt many burglars want the risk of running into somebody during their "heist", so they will stake out possible targets. Staking out a target used to be time-consuming and a bit risky, because the burglar needed to be on location for quite some time to conduct surveillance themselves, in person. Now they can stake out multiple targets at the same time, from anywhere they want, with all the anonymity the Internets allow for.
  - trprog 10y ago
    While the addition of anonymity would certainly be appreciated by would-be burglars you seem to be leaving out a small detail. It is trivially easy for a burglar to determine if someone is home. They can just walk up to the front door, knock and see if anyone answers. If someone is there ask for a glass of water, ask if they have accepted Jesus, ask if Steve lives there or whatever other BS excuse they have ready before simply moving on to another prospect. If no one comes to the door then the home is very likely empty and they can proceed. This has the added benefit for the burglar that anyone seeing them enter the property will assume they have good reason to be there. After all they marched straight up to the front door and rang the doorbell which is what non-thieves do so its less suspicious if they then go around the side of the house when no one answers.

chx 10y ago

Let me grab this occasion to ask: WTF is going on in general? I readily presume most people have a wifi router with these iot devices and while obviously those are not the best security wise (I presume again most don't run pfsense or openwrt) but still they are there, NATting away happily. How would a baby monitor appear on the open web...? I can't imagine the average user setting them up in DMZ or port forward or ... what is happening here? I am obviously missing some primarily home networking oriented protocol probably because I am configuring my own routers and I am simply unaware of some feature of the factory firmware that allows traffic inwards.

userbinator 10y ago
I don't use those products, but I can imagine many of them automatically doing port forwards (https://en.wikipedia.org/wiki/Universal_Plug_and_Play#NAT_traversal https://en.wikipedia.org/wiki/Universal_Plug_and_Play#NAT_tr... ) and possibly even automatically registering in a dynamic DNS service, all for the "convenience" of the "I don't know what a port is and I don't want to know" user.
- chx 10y ago
  > Many routers and firewalls expose themselves as Internet Gateway Devices, allowing any local UPnP control point to perform a variety of actions, including retrieving the external IP address of the device, enumerate existing port mappings, and add or remove port mappings. Are you bloody kidding me? Why do you even have a firewall, rudimentary as it is, then?
  - geococcyxc 10y ago
    Not all home routers are allowing this by default. I don't have any hard numbers to offer, but my feeling is that only very old and today's very crappy ones do.
  - closeparen 10y ago
    UPnP comes from the view that NAT is an unfortunate artifact of residential ISPs only giving out one IPv4 address per household, not a crucial security strategy. If you really think of your NATing router as a security device, turn off UPnP. Though I'm not sure how much good that will do, as any device can still phone home or reverse tunnel.

yabatopia 10y ago

The author poses some interesting questions, but unfortunately doesn't provide really useful answers. How is the avarage consumer going to find out the security reputation of a vendor of smart home devices? How to find a reputable vendor for such or such device like a baby monitor, security cam, smart lightning or wifi repeater? In an easy way and easy to comprehend? Is there a website to check to security of smart home devices, or a list of reputable vendors? That would be a first step.