7 ms·

A guy I work with did a presentation on this product, he is big into reverse engineering bluetooth devices. I can assure you the toys themselves are just as ins

by orf 10y ago

A guy I work with did a presentation on this product, he is big into reverse engineering bluetooth devices. I can assure you the toys themselves are just as insecure as apparently their infrastructure is. Seeing it light up and say "destroy all humans" was pretty funny, moreso because there is pretty much zero authentication on them so you could do it from anywhere from your mobile, and the mic can turn on and record without any authentication at all. sigh internet of things

0xfeba 10y ago
The "S" in IoT stands for Security.
- salesguy222 10y ago
  Hahaha i spent a good 3 minutes looking for where the S was, until the joke hit me
- jgamman 10y ago
  shouldn't that be 'SH' ?
  - abulman 10y ago
    'Security Hardening'.
    - rudilee 10y ago
      "Security Hamperred Internet of Things"
      - deleted 10y ago
        [deleted]
- Crosseye_Jack 10y ago
  Some of us do give a shit about security. It's just a shame that it feels like we are the exception to the rule.
  - elorant 10y ago
    We do because we realize what the lack of it entails. So will the general public, eventually. And the only way to get there is if more cases like this start happening. It's a shame they have to learn the hard way but there's no other way. That, or we as an industry act up (in ways I can't even fathom).
    - mulmen 10y ago
      The fact that you allude to it suggests you can fathom it in some way. Maybe you don't want to but clearly bad actors can exploit insecure systems and that's especially easy from the inside.
      - elorant 10y ago
        Sure I can, but they're all unrealistic so no point mentioning them. We could for example start boycotting companies that don't take security seriously. But I'm afraid we'd end up with a very, very long list. Publicity can work wonders. You end-up with sensitive data for kids in the wild, possibly in the hands of perverts, nothing could work better than that in raising awareness for the general public. It's harsh, but it fucking works. So we'll stick with it for now, unless someone comes with a better idea.
        jdbernard 10y ago
        The problem is that it generates awareness based on raw emotion, and of course that always leads to rational, measured decision making. /s On the other hand, I don't know any better idea either.
        otakucode 10y ago
        Lawsuits for criminal negligence against the CEOs of the companies themselves would be a damn good start. Their business practices are why these problems happen. They cut every corner they can find, put business school grads in charge of deciding schedules and resource allocation to engineering, and make sure that if an engineer says 'we need more time and testing' that any low-level manager can tell them business goals come first.
- Cyph0n 10y ago
  I took a grad course last semester where one of the groups analyzed a Nest cam and the other analyzed the Mother sensor device. Both were surprisingly quite secure, especially the Mother, which had security features all the way down the stack.
  - nickpsecurity 10y ago
    There's security features then assurance. Features without assurance of correctness are often bypassed. Im curious what was in those you talk about down the stack.
  - AndonAndonov 10y ago
    One of my professors worked on the key exchange protocol [0], used in Nest. When discussing that particular point, he was very complimentary of Google's security practices, especially when it comes to Nest. [0] https://blogs.ncl.ac.uk/security/2015/07/28/j-pake-built-into-google-nest-thermostats/ https://blogs.ncl.ac.uk/security/2015/07/28/j-pake-built-int...
- conradev 10y ago
  I like Apple's approach, where HomeKit certification requires that the device use some form of secure transport to communicate with iOS.
  - Xylakant 10y ago
    Which totally would not have helped in this case: using https would still have left the DB exposed.
    - po 10y ago
      It doesn't help the server side data leak but at least you can't connect to it and make it say 'destroy all humans'
      - Xylakant 10y ago
        That's not necessarily the case. TLS protects the connection, but by default does not provide authentication. I also see a lot of instances where certificate checking has been disabled, so that the client just ignores a MitM attack. So with TLS it would seem more secure at first glance, but given the implementation blunders here I wouldn't expect any real improvement.
        po 10y ago
        Yeah that's true, I'm totally assuming 'competently implemented TLS' when I say it would protect the connection.
walrus01 10y ago
Reading and fully comprehending the full contents and implications of https://twitter.com/internetofshit https://twitter.com/internetofshit should be required for anyone who is thinking about making an IOT type device.
pdjstone 10y ago
I'll be putting out our blog post about this first thing tomorrow (we had it ready to go for next week, but I think now's a good time to add some fuel to the fire). Essentially the toy uses Bluetooth LE very insecurely and it has a speaker and a microphone. Guess what happens next? Edit: Demo of the CloudPets functionality using Web Bluetooth https://github.com/pdjstone/cloudpets-web-bluetooth/ https://github.com/pdjstone/cloudpets-web-bluetooth/
lcw 10y ago
I do agree that lots of IoT products have terrible security, but is having insecure bluetooth or the likes really a terrible thing for most of these types of products? I understand that this leak is related to mongodb... and that is terrible, but mostly referring to your bluetooth example. I mean take bluetooth headphones they are notoriously insecure, but the range in which eavesdropping could take place is pretty small, and for most of us you would just be eavesdropping on our annoying music. Seems reasonable that they save bandwidth on secure transmission of data for higher audio quality. That said I could see an argument the other way, but I'm sure there are more examples where it doesn't seem like a big deal. It would be interesting to hear from someone who thinks I'm dead wrong.
- LeifCarrotson 10y ago
  > Seems reasonable that they save bandwidth on secure transmission of data for higher audio quality. Encrypting a compressed audio stream does not add to the bandwidth, aside from the initial key negotiation. Furthermore, the bandwidth required for audio of a quality that's indiscernible from the original is negligible when compared to the bandwidth of Bluetooth radios. Ridiculously good audio is 320 kbps, and Bluetooth is easily good for 25 Mbps. I suppose you could argue that the battery power used to perform this computation is the limiting factor, but a good embedded DSP used to perform the recording and transmission typically have tiny power requirements and hardware encryption routines that don't significantly change the power requirements of the device, as compared to keeping a blue LED blinking or powering an earbud speaker. No, let's be honest here. The actual limiting factor is engineering time and money that goes into developing these devices as quick and cheaply as possible.
  - lcw 10y ago
    Yea I was thinking the bandwidth limitations would be on the CPU because of data decryption... your points are valid though even with that. It's not a great example. I still think that varying degrees of security are fine with these types of things.
- rodgerd 10y ago
  If your threat model for your Bluetooth keyboard doesn't involve, say, an abusive spouse sniffing traffic to see if you're reaching out for help, your threat model is probably biased in favour of wankery like the NSA and not real threats ordinary people face.
M_Grey 10y ago
Meanwhile police in a murder case are preparing to take Amazon to court for Echo records. On the privacy front, there's just no saving people, but the IoT brings the magic of invading privacy together with furnishing botnets with millions of new bots! We're screwed coming and going, and the vast majority still look at you like a woodland hermit if you suggest that you shouldn't have anything listening to you in your home.
- mulmen 10y ago
  I wonder how much infrastructure is really required to properly support Alexa like capabilities for an individual. Does Amazon really need all of our recordings on their hardware in their data centers? Is it conceivable that we could own that hardware as well? I realize that training data is important and I assume the recorded data gets used for that purpose but does Amazon need to keep it forever? How long do they need it? Can I own and posses the hardware and pass off the learning alone?
  - bostonvaulter2 10y ago
    But even if they say that they're not storing or sending it, how feasible is it to verify that fact?
    - nitrogen 10y ago
      Very feasible -- don't plug it into the Internet.
      - M_Grey 10y ago
        At which point you have a brick with a microphone, and a pretty blue light, right?
        amiller2571 10y ago
        I think the blue lights only show when its connected. You would get pretty red lights

by orf 10y ago

0xfeba 10y ago

The "S" in IoT stands for Security.

salesguy222 10y ago
Hahaha i spent a good 3 minutes looking for where the S was, until the joke hit me
jgamman 10y ago
shouldn't that be 'SH' ?
- abulman 10y ago
  'Security Hardening'.
  - rudilee 10y ago
    "Security Hamperred Internet of Things"
    - deleted 10y ago
      [deleted]
Crosseye_Jack 10y ago
Some of us do give a shit about security. It's just a shame that it feels like we are the exception to the rule.
- elorant 10y ago
  We do because we realize what the lack of it entails. So will the general public, eventually. And the only way to get there is if more cases like this start happening. It's a shame they have to learn the hard way but there's no other way. That, or we as an industry act up (in ways I can't even fathom).
  - mulmen 10y ago
    The fact that you allude to it suggests you can fathom it in some way. Maybe you don't want to but clearly bad actors can exploit insecure systems and that's especially easy from the inside.
    - elorant 10y ago
      Sure I can, but they're all unrealistic so no point mentioning them. We could for example start boycotting companies that don't take security seriously. But I'm afraid we'd end up with a very, very long list. Publicity can work wonders. You end-up with sensitive data for kids in the wild, possibly in the hands of perverts, nothing could work better than that in raising awareness for the general public. It's harsh, but it fucking works. So we'll stick with it for now, unless someone comes with a better idea.
      - jdbernard 10y ago
        The problem is that it generates awareness based on raw emotion, and of course that always leads to rational, measured decision making. /s On the other hand, I don't know any better idea either.
      - otakucode 10y ago
        Lawsuits for criminal negligence against the CEOs of the companies themselves would be a damn good start. Their business practices are why these problems happen. They cut every corner they can find, put business school grads in charge of deciding schedules and resource allocation to engineering, and make sure that if an engineer says 'we need more time and testing' that any low-level manager can tell them business goals come first.
Cyph0n 10y ago
I took a grad course last semester where one of the groups analyzed a Nest cam and the other analyzed the Mother sensor device. Both were surprisingly quite secure, especially the Mother, which had security features all the way down the stack.
- nickpsecurity 10y ago
  There's security features then assurance. Features without assurance of correctness are often bypassed. Im curious what was in those you talk about down the stack.
- AndonAndonov 10y ago
  One of my professors worked on the key exchange protocol [0], used in Nest. When discussing that particular point, he was very complimentary of Google's security practices, especially when it comes to Nest. [0] https://blogs.ncl.ac.uk/security/2015/07/28/j-pake-built-into-google-nest-thermostats/ https://blogs.ncl.ac.uk/security/2015/07/28/j-pake-built-int...
conradev 10y ago
I like Apple's approach, where HomeKit certification requires that the device use some form of secure transport to communicate with iOS.
- Xylakant 10y ago
  Which totally would not have helped in this case: using https would still have left the DB exposed.
  - po 10y ago
    It doesn't help the server side data leak but at least you can't connect to it and make it say 'destroy all humans'
    - Xylakant 10y ago
      That's not necessarily the case. TLS protects the connection, but by default does not provide authentication. I also see a lot of instances where certificate checking has been disabled, so that the client just ignores a MitM attack. So with TLS it would seem more secure at first glance, but given the implementation blunders here I wouldn't expect any real improvement.
      - po 10y ago
        Yeah that's true, I'm totally assuming 'competently implemented TLS' when I say it would protect the connection.

walrus01 10y ago

Reading and fully comprehending the full contents and implications of https://twitter.com/internetofshit https://twitter.com/internetofshit should be required for anyone who is thinking about making an IOT type device.

pdjstone 10y ago

I'll be putting out our blog post about this first thing tomorrow (we had it ready to go for next week, but I think now's a good time to add some fuel to the fire). Essentially the toy uses Bluetooth LE very insecurely and it has a speaker and a microphone. Guess what happens next? Edit: Demo of the CloudPets functionality using Web Bluetooth https://github.com/pdjstone/cloudpets-web-bluetooth/ https://github.com/pdjstone/cloudpets-web-bluetooth/

lcw 10y ago

I do agree that lots of IoT products have terrible security, but is having insecure bluetooth or the likes really a terrible thing for most of these types of products? I understand that this leak is related to mongodb... and that is terrible, but mostly referring to your bluetooth example. I mean take bluetooth headphones they are notoriously insecure, but the range in which eavesdropping could take place is pretty small, and for most of us you would just be eavesdropping on our annoying music. Seems reasonable that they save bandwidth on secure transmission of data for higher audio quality. That said I could see an argument the other way, but I'm sure there are more examples where it doesn't seem like a big deal. It would be interesting to hear from someone who thinks I'm dead wrong.

LeifCarrotson 10y ago
> Seems reasonable that they save bandwidth on secure transmission of data for higher audio quality. Encrypting a compressed audio stream does not add to the bandwidth, aside from the initial key negotiation. Furthermore, the bandwidth required for audio of a quality that's indiscernible from the original is negligible when compared to the bandwidth of Bluetooth radios. Ridiculously good audio is 320 kbps, and Bluetooth is easily good for 25 Mbps. I suppose you could argue that the battery power used to perform this computation is the limiting factor, but a good embedded DSP used to perform the recording and transmission typically have tiny power requirements and hardware encryption routines that don't significantly change the power requirements of the device, as compared to keeping a blue LED blinking or powering an earbud speaker. No, let's be honest here. The actual limiting factor is engineering time and money that goes into developing these devices as quick and cheaply as possible.
- lcw 10y ago
  Yea I was thinking the bandwidth limitations would be on the CPU because of data decryption... your points are valid though even with that. It's not a great example. I still think that varying degrees of security are fine with these types of things.
rodgerd 10y ago
If your threat model for your Bluetooth keyboard doesn't involve, say, an abusive spouse sniffing traffic to see if you're reaching out for help, your threat model is probably biased in favour of wankery like the NSA and not real threats ordinary people face.

M_Grey 10y ago

Meanwhile police in a murder case are preparing to take Amazon to court for Echo records. On the privacy front, there's just no saving people, but the IoT brings the magic of invading privacy together with furnishing botnets with millions of new bots! We're screwed coming and going, and the vast majority still look at you like a woodland hermit if you suggest that you shouldn't have anything listening to you in your home.

mulmen 10y ago
I wonder how much infrastructure is really required to properly support Alexa like capabilities for an individual. Does Amazon really need all of our recordings on their hardware in their data centers? Is it conceivable that we could own that hardware as well? I realize that training data is important and I assume the recorded data gets used for that purpose but does Amazon need to keep it forever? How long do they need it? Can I own and posses the hardware and pass off the learning alone?
- bostonvaulter2 10y ago
  But even if they say that they're not storing or sending it, how feasible is it to verify that fact?
  - nitrogen 10y ago
    Very feasible -- don't plug it into the Internet.
    - M_Grey 10y ago
      At which point you have a brick with a microphone, and a pretty blue light, right?
      - amiller2571 10y ago
        I think the blue lights only show when its connected. You would get pretty red lights