5 ms·
Completely agree with your points. Every time one of these articles comes out it just fuels the FUD factor for Smart Home from reputable companies. Especially
by supergeek133 9y ago
Completely agree with your points. Every time one of these articles comes out it just fuels the FUD factor for Smart Home from reputable companies.
Especially in the last year or two when many of these articles focus on the physical access exploits of cheaper manufacturers. If someone is going to break into my house just to ransomware my thermostat, or upload new firmware to my Gen 1 Alexa... someone needs to explain to me how there are not more high value targets/things in either of those cases. Even for surveillance purposes.
Hardware is hard. I think many small IoT companies have figured that out, the larger ones have known it for a long time. Security is harder, but that's why it's important to buy from someone reputable (e.g., the "default password" fiasco on cheap DVR wired camera systems)
Disclosure: I work for a large consumer IoT company.
- emiliobumachar 9y agoThink big. The latest and greatest in DDoS is botnets of compromised IoT devices (as of a few months ago, I don't keep current). The nightmare scenario, still theoretical, is to synchronize the activation and deactivation of power-hungry processes to wreck the electric grid.
- andrewflnr 9y agoI'm pretty sure that's going the long way round to wreck the power grid, if it works at all. DOSing critical infrastructure is pretty scary in general, though.
- supergeek133 9y agoYes, by a number of cheap devices with default passwords/firmware holes. Multiple manufacturers, same (or same few) ODMs. The same bad practices repeated over and over.
- emiliobumachar 9y agoI agree that it's unfair to tar the whole field with the blunders of the worst performers. But your comment I was replying to seemed to ask, "what's the worst that can happen?". It's a valid question for physical access attacks, but, once scalable remote exploits get into the picture, the worst that can happen is very bad indeed.
- kevas 9y agoLink: https://www.theregister.co.uk/2017/04/06/stop_us_if_youve_heard_this_cisco_aironet_has_hardcoded_passwords/ https://www.theregister.co.uk/2017/04/06/stop_us_if_youve_he... Just because your big, doesn't mean you get it right.
- dwighttk 9y agomy big?
- supergeek133 9y agoFair point, but it is much less prevalent, no? The other side is that the bigger you are the harder the impact when you screw up.
- CaptSpify 9y agoWhich companies do you consider the reputable ones? I've been looking a little, but I haven't found any.