3 ms·
The names of the devices are practically in the clear in the article. First in the picture of the PCB, there's an obscured "Z?p?Box", and googling rather quickl
by akx 9y ago
The names of the devices are practically in the clear in the article. First in the picture of the PCB, there's an obscured "Z?p?Box", and googling rather quickly yields the Zipato ZipaBox -- and oh hey, the logo on the PCB matches the one on the site: https://www.zipato.com/product/zipabox https://www.zipato.com/product/zipabox
Re the light bulb, you can see the strings "mi-img" and "yeelight", so it's pretty definitely a Xiaomi Yeelight, maybe this one: https://www.gearbest.com/smart-lighting/pp_361555.html https://www.gearbest.com/smart-lighting/pp_361555.html
The Zipabox retails for 199 EUR, Yeelights are ~15 EUR a pop on Gearbest... Definitely not the cheapest, shadiest and worst IoT devices.
- Klathmon 9y agoThen they should name and shame! I'd argue that xiaomi isn't a trustworthy brand by a long shot, there are plenty of examples of these kinds of issues with their stuff, and if more researchers would point out why a specific device is bad, and provide options that do it better, they might be incentivized to improve it, or at least people will be warned to not buy them. Zipabox does seem like a good product at a very quick first glance of their website, and I do rescind my "shadiest and worst IoT devices" comment for them, but it still annoys the hell out of me that they release this research but don't provide a way (without a bunch of searching like you had to do) for me to check if i'm vulnerable!
- astura 9y ago>We reported all the information about the discovered vulnerabilities to the vendor, which are now being fixed. The are waiting for the fix to come out first, I presume.
- dgacmu 9y agoThat may well be what they're thinking they're doing, but when it's trivial to identify the machine with a bit of work, they're just disclosing early in a clumsy and obfuscated way.