5 ms·

> If I set min and max temp on a network-enabled thermostat I am not worried that someone will connect and warm (or cool) my home a bit within that range while

by jlg23 9y ago

> If I set min and max temp on a network-enabled thermostat I am not worried that someone will connect and warm (or cool) my home a bit within that range while I am out. Will you say the same after I set min/max temperatures to optimize for high cost and change it back in time so you only notice on your next electricity bill? And how many times are you willing to wake up at 3am in an overheated apartment before you insist that only you should be able to adjust your thermostats? I am sure there are plenty more ways to abuse even simple things like thermostats to make your life hell. And the more devices are deployed in the wild, the more "pranks" will be thought of and executed.

ptero 9y ago
That is a fair question, but I still consider it very low likelihood and pretty low impact. Sure, you can make an involved setup harassing me via my thermostat, but I would be amazed (and amused) if it ever happened to me. I am not a public figure, who would do such a thing? A friend as a prank -- s/he would probably tell me soon enough. An enemy -- it is a really involved way for some sort of hassle -- slashing car tires or breaking windows overnight is just as easy (or easier) and much more painful.
- jlg23 9y ago
  > I am not a public figure, who would do such a thing? Some bored script kiddie that found AutoSploit[1] or similar and gets a kick out of the "numbers of hacked hosts". I am not sure that "I was just collateral damage" is comforting after things happened. [1] https://github.com/NullArray/AutoSploit https://github.com/NullArray/AutoSploit
- 908087 9y ago
  Bored trolls don't care who you are. Slashing tires and breaking windows would require them to leave the house and settle for just a few targets. Automated attacks on IoS devices allow them to cause problems for a large number of people with very little work and an even smaller chance of getting caught.
- zaarn 9y ago
  Last week someone dumped one of their scripts onto my private git server instance and created issues with attempted XSS. Purely due to chance, I was using the mobile browser to inspect these which didn't have a script blocker installed. It has one installed now. You might think "nobody will do this to me" but the internet is filled to the brim with skids who have nothing better to do than scan your router for any open ports (or in a recent case, attempt to scan your IPv6 /64 subnet, though I'm questioning the sanity of that move). If they find anything they will blindly shove their shit into your IoT hardware. Maybe it'll work. Maybe it doesn't. They don't care, they've already spammed the next host. Do not underestimate the probability of someone wanting to ram their script up into your IoT or router.

by jlg23 9y ago

ptero 9y ago

That is a fair question, but I still consider it very low likelihood and pretty low impact. Sure, you can make an involved setup harassing me via my thermostat, but I would be amazed (and amused) if it ever happened to me. I am not a public figure, who would do such a thing? A friend as a prank -- s/he would probably tell me soon enough. An enemy -- it is a really involved way for some sort of hassle -- slashing car tires or breaking windows overnight is just as easy (or easier) and much more painful.

jlg23 9y ago
> I am not a public figure, who would do such a thing? Some bored script kiddie that found AutoSploit[1] or similar and gets a kick out of the "numbers of hacked hosts". I am not sure that "I was just collateral damage" is comforting after things happened. [1] https://github.com/NullArray/AutoSploit https://github.com/NullArray/AutoSploit
908087 9y ago
Bored trolls don't care who you are. Slashing tires and breaking windows would require them to leave the house and settle for just a few targets. Automated attacks on IoS devices allow them to cause problems for a large number of people with very little work and an even smaller chance of getting caught.
zaarn 9y ago
Last week someone dumped one of their scripts onto my private git server instance and created issues with attempted XSS. Purely due to chance, I was using the mobile browser to inspect these which didn't have a script blocker installed. It has one installed now. You might think "nobody will do this to me" but the internet is filled to the brim with skids who have nothing better to do than scan your router for any open ports (or in a recent case, attempt to scan your IPv6 /64 subnet, though I'm questioning the sanity of that move). If they find anything they will blindly shove their shit into your IoT hardware. Maybe it'll work. Maybe it doesn't. They don't care, they've already spammed the next host. Do not underestimate the probability of someone wanting to ram their script up into your IoT or router.