4 ms·

Yet another article that went out and found the shadiest cheapest worst IoT devices and extrapolates in headlines that the entire ecosystem is that bad. Where'

Yet another article that went out and found the shadiest cheapest worst IoT devices and extrapolates in headlines that the entire ecosystem is that bad. Where's the analysis of Nest? Where's the pentesting of SmartThings? Where's the article about how they tried 12 different ways to get into another reputable brand? Don't think for a second that I'm saying anyone should get a pass, they shouldn't, but this to me seems like the equivalent of reviewing $3 luggage locks and talking about how insecure they are, then concluding that all locks are insecure and you shouldn't use them... I will say that this article is better than most at keeping the criticism specific to these devices (except for the headlines), but they don't name the devices, so the analysis isn't doing any good (I still have no idea which device it is, and therefore can't protect myself by not buying it...)

ckastner 9y ago
> Don't think for a second that I'm saying anyone should get a pass, they shouldn't, but this to me seems like the equivalent of reviewing $3 luggage locks and talking about how insecure they are, then concluding that all locks are insecure and you shouldn't use them... No, the article shows that $3 luggage locks exist, and then provides sound general advice on how to avoid those.
- supergeek133 9y ago
  "IoT hack: how to break a smart home… again" This is not a reasonable headline if you believe that is all the article is trying to get across.
  - ckastner 9y ago
    It may be a bit ambiguous, but a reasonable interpretation exists (it's about a home, not all homes). Regardless, the headline may be poorly chosen, but the interpretation "the entire ecosystem is that bad" is not supported by the article. Lastly, what's the point discussing luggage security when we can't talk about the $3 luggage locks? How else are we supposed to get rid of them?
- Klathmon 9y ago
  Except their advice wouldn't even stop the attacks they outlined. > Always change the default password. Instead use a strict and complex one. Don’t forget to update it regularly. Good advice, but it won't stop the password from being sent over HTTP. > Don’t share serial numbers, IP addresses and other sensitive information regarding your smart devices on social networks Again, good advice, but it won't stop the device from storing WiFi credentials after a hard reset. > Be aware and always check the latest information on discovered IoT vulnerabilities. I wish I could, but they haven't named a single device that anyone can watch out for, nor have they shared any way that the average user can check for these vulnerabilities.
  - ckastner 9y ago
    Those three points are explicitly meant to be "for users". Your counterarguments address implementation issues, but the advice given to implementors is consistent with your arguments: "No less important is that vendors should improve and enhance their security approach to ensure their devices are adequately protected and, as a result, their users [...]"
    - Klathmon 9y ago
      >Those three points are explicitly meant to be "for users". But my point is that their article explicitly shows that those 3 points are pointless for users. A user's only defense against the attacks show in the article is to not buy or stop using those devices. And until security researchers are willing to let users know if their devices are insecure, it's only going to get worse. It's strangely analogous to "abstinence" as a form of birth control. Telling people who want IoT devices to just not use them isn't a valid answer. Show them good examples of well designed devices, point out the worst offenders by name and explicitly, and show what users can do to research and avoid devices like them. Talking about how your serial might be used as a form of authentication, and to keep up to date on IoT vulnerabilities that they themself won't publish doesn't do anyone any good.
      - ckastner 9y ago
        > But my point is that their article explicitly shows that those 3 points are pointless for users. It's pointless with that device. The 3 points are general advice, and changing a default password, for example, is definitely sound advice. > Telling people who want IoT devices to just not use them isn't a valid answer Where are you getting this from? There's an entire section in the article ("Get Ready") with suggestions on how to securely use IoT devices. There's no mention of not using them. > and show what users can do to research and avoid devices like them. That is the entire point of the article.
supergeek133 9y ago
Completely agree with your points. Every time one of these articles comes out it just fuels the FUD factor for Smart Home from reputable companies. Especially in the last year or two when many of these articles focus on the physical access exploits of cheaper manufacturers. If someone is going to break into my house just to ransomware my thermostat, or upload new firmware to my Gen 1 Alexa... someone needs to explain to me how there are not more high value targets/things in either of those cases. Even for surveillance purposes. Hardware is hard. I think many small IoT companies have figured that out, the larger ones have known it for a long time. Security is harder, but that's why it's important to buy from someone reputable (e.g., the "default password" fiasco on cheap DVR wired camera systems) Disclosure: I work for a large consumer IoT company.
- emiliobumachar 9y ago
  Think big. The latest and greatest in DDoS is botnets of compromised IoT devices (as of a few months ago, I don't keep current). The nightmare scenario, still theoretical, is to synchronize the activation and deactivation of power-hungry processes to wreck the electric grid.
  - andrewflnr 9y ago
    I'm pretty sure that's going the long way round to wreck the power grid, if it works at all. DOSing critical infrastructure is pretty scary in general, though.
  - supergeek133 9y ago
    Yes, by a number of cheap devices with default passwords/firmware holes. Multiple manufacturers, same (or same few) ODMs. The same bad practices repeated over and over.
    - emiliobumachar 9y ago
      I agree that it's unfair to tar the whole field with the blunders of the worst performers. But your comment I was replying to seemed to ask, "what's the worst that can happen?". It's a valid question for physical access attacks, but, once scalable remote exploits get into the picture, the worst that can happen is very bad indeed.
akx 9y ago
The names of the devices are practically in the clear in the article. First in the picture of the PCB, there's an obscured "Z?p?Box", and googling rather quickly yields the Zipato ZipaBox -- and oh hey, the logo on the PCB matches the one on the site: https://www.zipato.com/product/zipabox https://www.zipato.com/product/zipabox Re the light bulb, you can see the strings "mi-img" and "yeelight", so it's pretty definitely a Xiaomi Yeelight, maybe this one: https://www.gearbest.com/smart-lighting/pp_361555.html https://www.gearbest.com/smart-lighting/pp_361555.html The Zipabox retails for 199 EUR, Yeelights are ~15 EUR a pop on Gearbest... Definitely not the cheapest, shadiest and worst IoT devices.
- Klathmon 9y ago
  Then they should name and shame! I'd argue that xiaomi isn't a trustworthy brand by a long shot, there are plenty of examples of these kinds of issues with their stuff, and if more researchers would point out why a specific device is bad, and provide options that do it better, they might be incentivized to improve it, or at least people will be warned to not buy them. Zipabox does seem like a good product at a very quick first glance of their website, and I do rescind my "shadiest and worst IoT devices" comment for them, but it still annoys the hell out of me that they release this research but don't provide a way (without a bunch of searching like you had to do) for me to check if i'm vulnerable!
  - astura 9y ago
    >We reported all the information about the discovered vulnerabilities to the vendor, which are now being fixed. The are waiting for the fix to come out first, I presume.
    - dgacmu 9y ago
      That may well be what they're thinking they're doing, but when it's trivial to identify the machine with a bit of work, they're just disclosing early in a clumsy and obfuscated way.
tzhenghao 9y ago
I agree. I think IoT definitely gets a bad name because of poor security practices and design decisions made by a few bad actors. The title could've been worded better in warning people to avoid certain products, than to paint the whole ecosystem badly.
- dsfyu404ed 9y ago
  >I agree. I think IoT definitely gets a bad name because of poor security practices and design decisions made by a few bad actors. No, it gets a bad name because it moves all the legacy code security problems common in heavy industry into a consumer environment where it is much easier to justify not allocating resources to manage those problems. Stable, mature, well done, IoT is basically nonexistent. There is no boring Toyota Corrolla running Debian stable in IoT. All you can find are Teslas running Gentoo nightly cross compiled from a $30 Android 2.2 tablet. Anything partially obstructing a lane and a few 18-wheelers will bear the scars. IoT is going to be a security mess for the foreseeable future. Something that actually harms the companies employing the people writing the spaghetti needs to happen before the ball gets rolling to solve things. Operating systems, networking protocols, serving web content, etc, etc all used to be the wild west at one time too. The problem in IoT is that right now the spaghetti authors are responsible for a huge part of the stack, not just the spaghetti and the sauce. When many IoT projects are reinventing a bunch of wheels it's no surprise that a few of them are square and not very secure. As IoT matures more and more things will be abstracted and the spaghetti that makes your blender smarter than everyone else will run in nice little padded cells where it can't hurt anything. I expect that eventually most of IoT will be running on a handful of platforms built around a mostly common core stack similar to Linux today (most of IoT uses Linux so they'll probably copy that architecture). There will be plenty of stupid stuff that goes down between now and when IoT starts to mature though.
kevin_nisbet 9y ago
While I agree with the sentiment about the $3 luggage locks, I think it's still important to discuss that the $3 luggage lock doesn't work (especially if it's advertised to work). Some users might have the expectation that it does work. On the more expensive devices, while I have a limited sample, my short career in IOT security has shown me that your $100-$300 devices have pretty serious security implications. And I think there are a couple reasons why this is the case: Atleast some (most?) of these products are being built by average developers with average exposure to security, so like other areas of tech, should be just as vulnerable as everything else. IOT is a young industry, so you don't have the same set of best practices and common code that you can leverage. Ever wanted to encrypt sensor data, on a cpu that's designed to operate for a year on a coin battery? Turns out you can't just run openssl and TLS to secure that low power wireless connection. And that sensor might be the one telling you're security system to trigger. Hardware is a super competitive market, so when it turns out you're basically selling every unit at a loss to try and gain market share, it doesn't leave a huge amount of room to invest in security best practices vs. get it done and shipped. You know that wireless sensor that detects when you're home and changes you're settings, well it's basically broadcasting to the neighbourhood whether you're home or not. It's a theoretical problem (every problem is until it isn't), that someone could use that against you, so do we worry about that, or do we worry about optimizing our code so that the battery doesn't have to be changed every month. Please keep in mind, I have limited exposure, but in my experience working on this, I think unless companies can prove they're actively investing in security (and not just saying they care about security), we should be suspicious. I can see why the industry as a whole could be failing to protect it's consumers, and probably deserves a poor reputation for security. And because you don't hear some researcher talking about product x, doesn't mean that product doesn't have abysmal security. A friend of mine keeps telling me, in her experience security researchers on average are cheap, so they're not going to look at the $300 lock, when there is a $3 alternative to pick apart.

ckastner 9y ago

> Don't think for a second that I'm saying anyone should get a pass, they shouldn't, but this to me seems like the equivalent of reviewing $3 luggage locks and talking about how insecure they are, then concluding that all locks are insecure and you shouldn't use them... No, the article shows that $3 luggage locks exist, and then provides sound general advice on how to avoid those.

supergeek133 9y ago
"IoT hack: how to break a smart home… again" This is not a reasonable headline if you believe that is all the article is trying to get across.
- ckastner 9y ago
  It may be a bit ambiguous, but a reasonable interpretation exists (it's about a home, not all homes). Regardless, the headline may be poorly chosen, but the interpretation "the entire ecosystem is that bad" is not supported by the article. Lastly, what's the point discussing luggage security when we can't talk about the $3 luggage locks? How else are we supposed to get rid of them?
Klathmon 9y ago
Except their advice wouldn't even stop the attacks they outlined. > Always change the default password. Instead use a strict and complex one. Don’t forget to update it regularly. Good advice, but it won't stop the password from being sent over HTTP. > Don’t share serial numbers, IP addresses and other sensitive information regarding your smart devices on social networks Again, good advice, but it won't stop the device from storing WiFi credentials after a hard reset. > Be aware and always check the latest information on discovered IoT vulnerabilities. I wish I could, but they haven't named a single device that anyone can watch out for, nor have they shared any way that the average user can check for these vulnerabilities.
- ckastner 9y ago
  Those three points are explicitly meant to be "for users". Your counterarguments address implementation issues, but the advice given to implementors is consistent with your arguments: "No less important is that vendors should improve and enhance their security approach to ensure their devices are adequately protected and, as a result, their users [...]"
  - Klathmon 9y ago
    >Those three points are explicitly meant to be "for users". But my point is that their article explicitly shows that those 3 points are pointless for users. A user's only defense against the attacks show in the article is to not buy or stop using those devices. And until security researchers are willing to let users know if their devices are insecure, it's only going to get worse. It's strangely analogous to "abstinence" as a form of birth control. Telling people who want IoT devices to just not use them isn't a valid answer. Show them good examples of well designed devices, point out the worst offenders by name and explicitly, and show what users can do to research and avoid devices like them. Talking about how your serial might be used as a form of authentication, and to keep up to date on IoT vulnerabilities that they themself won't publish doesn't do anyone any good.
    - ckastner 9y ago
      > But my point is that their article explicitly shows that those 3 points are pointless for users. It's pointless with that device. The 3 points are general advice, and changing a default password, for example, is definitely sound advice. > Telling people who want IoT devices to just not use them isn't a valid answer Where are you getting this from? There's an entire section in the article ("Get Ready") with suggestions on how to securely use IoT devices. There's no mention of not using them. > and show what users can do to research and avoid devices like them. That is the entire point of the article.

supergeek133 9y ago

Completely agree with your points. Every time one of these articles comes out it just fuels the FUD factor for Smart Home from reputable companies. Especially in the last year or two when many of these articles focus on the physical access exploits of cheaper manufacturers. If someone is going to break into my house just to ransomware my thermostat, or upload new firmware to my Gen 1 Alexa... someone needs to explain to me how there are not more high value targets/things in either of those cases. Even for surveillance purposes. Hardware is hard. I think many small IoT companies have figured that out, the larger ones have known it for a long time. Security is harder, but that's why it's important to buy from someone reputable (e.g., the "default password" fiasco on cheap DVR wired camera systems) Disclosure: I work for a large consumer IoT company.

emiliobumachar 9y ago
Think big. The latest and greatest in DDoS is botnets of compromised IoT devices (as of a few months ago, I don't keep current). The nightmare scenario, still theoretical, is to synchronize the activation and deactivation of power-hungry processes to wreck the electric grid.
- andrewflnr 9y ago
  I'm pretty sure that's going the long way round to wreck the power grid, if it works at all. DOSing critical infrastructure is pretty scary in general, though.
- supergeek133 9y ago
  Yes, by a number of cheap devices with default passwords/firmware holes. Multiple manufacturers, same (or same few) ODMs. The same bad practices repeated over and over.
  - emiliobumachar 9y ago
    I agree that it's unfair to tar the whole field with the blunders of the worst performers. But your comment I was replying to seemed to ask, "what's the worst that can happen?". It's a valid question for physical access attacks, but, once scalable remote exploits get into the picture, the worst that can happen is very bad indeed.

akx 9y ago

The names of the devices are practically in the clear in the article. First in the picture of the PCB, there's an obscured "Z?p?Box", and googling rather quickly yields the Zipato ZipaBox -- and oh hey, the logo on the PCB matches the one on the site: https://www.zipato.com/product/zipabox https://www.zipato.com/product/zipabox Re the light bulb, you can see the strings "mi-img" and "yeelight", so it's pretty definitely a Xiaomi Yeelight, maybe this one: https://www.gearbest.com/smart-lighting/pp_361555.html https://www.gearbest.com/smart-lighting/pp_361555.html The Zipabox retails for 199 EUR, Yeelights are ~15 EUR a pop on Gearbest... Definitely not the cheapest, shadiest and worst IoT devices.

Klathmon 9y ago
Then they should name and shame! I'd argue that xiaomi isn't a trustworthy brand by a long shot, there are plenty of examples of these kinds of issues with their stuff, and if more researchers would point out why a specific device is bad, and provide options that do it better, they might be incentivized to improve it, or at least people will be warned to not buy them. Zipabox does seem like a good product at a very quick first glance of their website, and I do rescind my "shadiest and worst IoT devices" comment for them, but it still annoys the hell out of me that they release this research but don't provide a way (without a bunch of searching like you had to do) for me to check if i'm vulnerable!
- astura 9y ago
  >We reported all the information about the discovered vulnerabilities to the vendor, which are now being fixed. The are waiting for the fix to come out first, I presume.
  - dgacmu 9y ago
    That may well be what they're thinking they're doing, but when it's trivial to identify the machine with a bit of work, they're just disclosing early in a clumsy and obfuscated way.

tzhenghao 9y ago

I agree. I think IoT definitely gets a bad name because of poor security practices and design decisions made by a few bad actors. The title could've been worded better in warning people to avoid certain products, than to paint the whole ecosystem badly.

dsfyu404ed 9y ago
>I agree. I think IoT definitely gets a bad name because of poor security practices and design decisions made by a few bad actors. No, it gets a bad name because it moves all the legacy code security problems common in heavy industry into a consumer environment where it is much easier to justify not allocating resources to manage those problems. Stable, mature, well done, IoT is basically nonexistent. There is no boring Toyota Corrolla running Debian stable in IoT. All you can find are Teslas running Gentoo nightly cross compiled from a $30 Android 2.2 tablet. Anything partially obstructing a lane and a few 18-wheelers will bear the scars. IoT is going to be a security mess for the foreseeable future. Something that actually harms the companies employing the people writing the spaghetti needs to happen before the ball gets rolling to solve things. Operating systems, networking protocols, serving web content, etc, etc all used to be the wild west at one time too. The problem in IoT is that right now the spaghetti authors are responsible for a huge part of the stack, not just the spaghetti and the sauce. When many IoT projects are reinventing a bunch of wheels it's no surprise that a few of them are square and not very secure. As IoT matures more and more things will be abstracted and the spaghetti that makes your blender smarter than everyone else will run in nice little padded cells where it can't hurt anything. I expect that eventually most of IoT will be running on a handful of platforms built around a mostly common core stack similar to Linux today (most of IoT uses Linux so they'll probably copy that architecture). There will be plenty of stupid stuff that goes down between now and when IoT starts to mature though.

kevin_nisbet 9y ago

While I agree with the sentiment about the $3 luggage locks, I think it's still important to discuss that the $3 luggage lock doesn't work (especially if it's advertised to work). Some users might have the expectation that it does work. On the more expensive devices, while I have a limited sample, my short career in IOT security has shown me that your $100-$300 devices have pretty serious security implications. And I think there are a couple reasons why this is the case: Atleast some (most?) of these products are being built by average developers with average exposure to security, so like other areas of tech, should be just as vulnerable as everything else. IOT is a young industry, so you don't have the same set of best practices and common code that you can leverage. Ever wanted to encrypt sensor data, on a cpu that's designed to operate for a year on a coin battery? Turns out you can't just run openssl and TLS to secure that low power wireless connection. And that sensor might be the one telling you're security system to trigger. Hardware is a super competitive market, so when it turns out you're basically selling every unit at a loss to try and gain market share, it doesn't leave a huge amount of room to invest in security best practices vs. get it done and shipped. You know that wireless sensor that detects when you're home and changes you're settings, well it's basically broadcasting to the neighbourhood whether you're home or not. It's a theoretical problem (every problem is until it isn't), that someone could use that against you, so do we worry about that, or do we worry about optimizing our code so that the battery doesn't have to be changed every month. Please keep in mind, I have limited exposure, but in my experience working on this, I think unless companies can prove they're actively investing in security (and not just saying they care about security), we should be suspicious. I can see why the industry as a whole could be failing to protect it's consumers, and probably deserves a poor reputation for security. And because you don't hear some researcher talking about product x, doesn't mean that product doesn't have abysmal security. A friend of mine keeps telling me, in her experience security researchers on average are cheap, so they're not going to look at the $300 lock, when there is a $3 alternative to pick apart.