5 ms·

IoT goes nuclear: creating a ZigBee chain reaction

41 points by kushti 9y ago

FrozenVoid 9y ago
Sounds like we already living in some cyberpunk dystopia. Except for people who don't buy "smart devices" of course.
- pulse7 9y ago
  It's getting harder every day not-to-buy "smart devices"... Try buying plain TV (without YouTube and Internet), try buying non-smart phone...
  - adrianN 9y ago
    Buying non-smart phones is very easy. Plain TVs are also readily available.
  - eriknstr 9y ago
    > Try buying plain TV (without YouTube and Internet) If you leave the smart-TV without a network connection it'll be mostly like a plain TV. > try buying non-smart phone There are some feature phone Nokia models available, I use one such. The thing I miss the most about having a smartphone is GPS and a map app. For everything else except mobile internet, which I can do without, that a smartphone would give me I have an iPod touch.
    - digi_owl 9y ago
      Not sure if it still works, but i swear my old SE featurephone had maps fetched straight from Google.
  - kbart 9y ago
    "Try buying plain TV (without YouTube and Internet), try buying non-smart phone..." Disable data connection for both and you have "dumb" counterparts. Of course, you still pay for unnecessary features, but it's the price to pay if you value your privacy.
    - farzadb82 9y ago
      If only it were that simple. Unless you've physically removed or disconnected the wireless interface, there's still a chance that a firmware vulnerability could lead to your TV being hacked via a remote and/or side-channel attack similar to what was demonstrated in the article.
nothis 9y ago
So I was reading the headline a little more literal and got cold shivers from imagining that IoT crap spreading to actual nuclear plants. Still scary as hell.
- adrianN 9y ago
  Don't google IIoT.
erdemozg 9y ago
People don't bother to update even their home router's firmware. IoT ecosystem will be one of the biggest holes in cyber security and a heaven for black-hat hackers.
- digi_owl 9y ago
  1. shit brick easily. 2. vendors mix feature changes/removals and security updates. 3, better the devil you know...
- Freak_NL 9y ago
  Economically vendors have little to no incentive to fix this mess either, so it will haunt us for some time to come. Introducing a slew of devices that all need security updates into each household that falls for them doesn't seem all that clever. A light bulb that can change its brightness and colour shouldn't be smart; it should be dumb as a brick and expose only those parameters that can sensibly and safely be set by a user — kind of like a normal light bulb does.
- kbart 9y ago
  "IoT ecosystem will be one of the biggest holes in cyber security and a heaven for black-hat hackers." I think you meant "is" here.
  - erdemozg 9y ago
    Haha, I was in dilemma. But since most people are not aware of it, I chose the future tense. But you are right, it is already.
merricksb 9y ago
The paper was heavily discussed here 7 months ago: https://news.ycombinator.com/item?id=12893793 https://news.ycombinator.com/item?id=12893793 (309, 98 comments)
synctext 9y ago
tl;dr: OTA firmware update was hacked. "Correlation Power Analysis (CPA) attack against the CCM encryption mode used to encrypt and verify firmware updates" Fascinating work. Working direct .PDF: https://pdfs.semanticscholar.org/b457/e4b95a70f8d1726ba70885ee10c13e43330b.pdf https://pdfs.semanticscholar.org/b457/e4b95a70f8d1726ba70885...
deleted 9y ago
[deleted]
leeoniya 9y ago
does anyone know a good Zigbee-capable smoke/co alarm listener that can be hooked up to send alert emails without relying on third-party servers? i was looking at openHAB and their Zigbee support is meh it seems :(
DavidKarlas 9y ago
Putting Touchlink in Zigbee was big mistake imo... It helps(a bit) with user friendliness but throws AES security of Zigbee out the window... I hope IKEA removes Touchlink in future: https://www1.cs.fau.de/content/zigbee-security-research https://www1.cs.fau.de/content/zigbee-security-research Specially since IKEA uses power on-off pattern to reset bulbs https://www.youtube.com/watch?v=mJm9YpPrGzk https://www.youtube.com/watch?v=mJm9YpPrGzk
deleted 9y ago
[deleted]
louithethrid 9y ago
I should order some simple MOSFATS and other basic components in large numbers, get a mobile booth - an large sign reading: Doest thy hardware has't the beshrew? Software demonic exoc'rzisms and beshrew removal! The doct'r is in.

41 points by kushti 9y ago

FrozenVoid 9y ago

Sounds like we already living in some cyberpunk dystopia. Except for people who don't buy "smart devices" of course.

pulse7 9y ago
It's getting harder every day not-to-buy "smart devices"... Try buying plain TV (without YouTube and Internet), try buying non-smart phone...
- adrianN 9y ago
  Buying non-smart phones is very easy. Plain TVs are also readily available.
- eriknstr 9y ago
  > Try buying plain TV (without YouTube and Internet) If you leave the smart-TV without a network connection it'll be mostly like a plain TV. > try buying non-smart phone There are some feature phone Nokia models available, I use one such. The thing I miss the most about having a smartphone is GPS and a map app. For everything else except mobile internet, which I can do without, that a smartphone would give me I have an iPod touch.
  - digi_owl 9y ago
    Not sure if it still works, but i swear my old SE featurephone had maps fetched straight from Google.
- kbart 9y ago
  "Try buying plain TV (without YouTube and Internet), try buying non-smart phone..." Disable data connection for both and you have "dumb" counterparts. Of course, you still pay for unnecessary features, but it's the price to pay if you value your privacy.
  - farzadb82 9y ago
    If only it were that simple. Unless you've physically removed or disconnected the wireless interface, there's still a chance that a firmware vulnerability could lead to your TV being hacked via a remote and/or side-channel attack similar to what was demonstrated in the article.

nothis 9y ago

So I was reading the headline a little more literal and got cold shivers from imagining that IoT crap spreading to actual nuclear plants. Still scary as hell.

adrianN 9y ago
Don't google IIoT.

erdemozg 9y ago

People don't bother to update even their home router's firmware. IoT ecosystem will be one of the biggest holes in cyber security and a heaven for black-hat hackers.

digi_owl 9y ago
1. shit brick easily. 2. vendors mix feature changes/removals and security updates. 3, better the devil you know...
Freak_NL 9y ago
Economically vendors have little to no incentive to fix this mess either, so it will haunt us for some time to come. Introducing a slew of devices that all need security updates into each household that falls for them doesn't seem all that clever. A light bulb that can change its brightness and colour shouldn't be smart; it should be dumb as a brick and expose only those parameters that can sensibly and safely be set by a user — kind of like a normal light bulb does.
kbart 9y ago
"IoT ecosystem will be one of the biggest holes in cyber security and a heaven for black-hat hackers." I think you meant "is" here.
- erdemozg 9y ago
  Haha, I was in dilemma. But since most people are not aware of it, I chose the future tense. But you are right, it is already.

merricksb 9y ago

The paper was heavily discussed here 7 months ago: https://news.ycombinator.com/item?id=12893793 https://news.ycombinator.com/item?id=12893793 (309, 98 comments)

synctext 9y ago

tl;dr: OTA firmware update was hacked. "Correlation Power Analysis (CPA) attack against the CCM encryption mode used to encrypt and verify firmware updates" Fascinating work. Working direct .PDF: https://pdfs.semanticscholar.org/b457/e4b95a70f8d1726ba70885ee10c13e43330b.pdf https://pdfs.semanticscholar.org/b457/e4b95a70f8d1726ba70885...

deleted 9y ago

[deleted]

leeoniya 9y ago

does anyone know a good Zigbee-capable smoke/co alarm listener that can be hooked up to send alert emails without relying on third-party servers? i was looking at openHAB and their Zigbee support is meh it seems :(

DavidKarlas 9y ago

Putting Touchlink in Zigbee was big mistake imo... It helps(a bit) with user friendliness but throws AES security of Zigbee out the window... I hope IKEA removes Touchlink in future: https://www1.cs.fau.de/content/zigbee-security-research https://www1.cs.fau.de/content/zigbee-security-research Specially since IKEA uses power on-off pattern to reset bulbs https://www.youtube.com/watch?v=mJm9YpPrGzk https://www.youtube.com/watch?v=mJm9YpPrGzk

deleted 9y ago

[deleted]

louithethrid 9y ago

I should order some simple MOSFATS and other basic components in large numbers, get a mobile booth - an large sign reading: Doest thy hardware has't the beshrew? Software demonic exoc'rzisms and beshrew removal! The doct'r is in.