8 ms·

So what's the concern here; that when someone gets unfettered access to your local network they can reboot your Google Home? Ya know what else they can do? Play

by pkulak 8y ago

So what's the concern here; that when someone gets unfettered access to your local network they can reboot your Google Home? Ya know what else they can do? Play Rick Astley on your Sonos speakers while printing 1000 pages of porn from every printer, casting Rick Astley music videos to every TV, getting Comcast to forward you piracy warnings and deleting all your Redis tables and Elastic Search indexes.

throwaway2048 8y ago
Ah the old saw, just don't let the bad guys on your network, or execute code on your computer, or visit their websites, or be in contact with them in any way. This is _clearly_ the user's fault yes.
- pkulak 8y ago
  The mere fact that more security is possible isn't a security vulnerability.
jchw 8y ago
I have occasionally had people in my complex accidentally print on my HP printer. It seems there's some wireless printing feature that is enabled by default and can be authenticated without needing physical access. The state of security for home networking devices could certainly be better. You forgot one though, they might also be able to delete your MongoDB collections :)
- gerdesj 8y ago
  Point your browser at it and switch off the bits you do not need. Ideally, switch off the wifi altogether if you can use ethernet.
  - jchw 8y ago
    It is definitely not a WiFi printer. It is (was) connected to my machine via USB and it definitely didn't have my WiFi credentials. I would investigate further, but I've not had the printer plugged in for a while now.
    - Namidairo 8y ago
      They have a feature where it spins up it's own access point so that phones and the such can connect and print directly, so your wifi credentials wouldn't be required.
      - jchw 8y ago
        Yeah, that's exactly what I'm guessing is happening. That said, I don't really know how to disable it. I may be a software engineer, but printers are another realm for me, a dark one with a weird Turing complete programming language at the core and numerous protocols ranging from moderately confusing to batshit insane to interface with these pieces of crap. OK, so printers aren't that mysterious. I can operate a CUPS server and whatnot. But I just can't muster enough concern to figure out how to access the network settings on my printer, and I'd be willing to wager I either need to boot into Windows, connect it to LAN, or both, to actually do this.
        brokenmachine 8y ago
        I bet it's crap enough to have the Administration settings available on that wifi network it creates, either totally open or probably some default password. I would certainly be having a good look at those settings if that thing was connected to my network.
        rebuilder 8y ago
        Wrap it in foil!
        xinau 8y ago
        As a friend of mine once said. "There are only two difficult things in IT, no. 1 is printer's and no. 2 is WiFi.
        TeMPOraL 8y ago
        Printers are hellspawn. Wi-Fi isn't that difficult. Bluetooth, on the other hand...
- btgeekboy 8y ago
  AppleTV has a similar "feature." Drove me nuts trying to find what was leaking in/out of my firewall - turns out that crap wasn't even going through it.
- dibstern 8y ago
  I hear that MongoDB is just deleting complete databases automatically, so you don’t even have to press a button!
bitwize 8y ago
In 2002 or so I had a dream. I was touring the new, modern, internet-connected home. Decor could be changed with the touch of a button because most of the home's surfaces (walls, cupboard fronts, etc.) were OLED displays that could display any texture or color of the user's choosing. As I was touring this home of the future, there was a hack of the smarthome servers. And then it appeared--goatse. Goatse everywhere. On every wall, every cupboard front, every countertop, scaled to cover the entire surface, was goatse. It was horrible. So much for the home of the future. Now you know why I distrust smarthome technology.
- Theodores 8y ago
  I have had a similar dream before, but with a couple of key differences: Given that most houses in most Western capital cities now cost millions and given that you can buy LCD panels for approximately the same price as bricks (for the same wall area) I do wonder why millionaires still stick with bricks. You could build a steel framed building and make all the walls, floors and ceilings from LCD panels saving yourself from having to have lights, pictures and regular TVs. With a few solar panels on the roof the electricity bill should be affordable too. My imagination for this extended to having live scenes from the seaside to have an immersive view of sunnier climes. Your imagination went to goatse though, maybe your fears and browsing habits informed your dreams differently to mine.
gerdesj 8y ago
My Redis and ES boxes have ufw on them and are on their own VLAN and need passwords etc. The Sonos are on another VLAN (SEWER - 802.1q tag 13) I don't have access to any RA music t home. I was traumatised enough by the eighties thank you 8)
vvanders 8y ago
In my mind it's a pretty gross violation of the principal of least privilege[1]. All it takes is one bad IoT device on your local LAN to exfiltrate/pivot over to the Hub. Some of the data that's dumped is things like "noise levels" which borders on sensitive PII information. Not to mention any vulnerabilities in these services that aren't understood yet. For all those reasons and more the IoT stuff on my local network goes into a VLAN that only gets to see the gateway and nothing else. No local UDP, TCP or the like, the Ubiquiti gear I picked up a while back makes it pretty trivial to setup. [1] https://en.wikipedia.org/wiki/Principle_of_least_privilege https://en.wikipedia.org/wiki/Principle_of_least_privilege
- adtac 8y ago
  This is all because of the current madness to have all devices connected each other. Completely connected "smart" things and network isolation/security: choose one.
  - superflyguy 8y ago
    If the devices I care about are secure (laptop, phone etc) then I shouldn't have to care about other devices, whether they're on my home network or not. I'm in no way a security/network export and I'm sure the people who came up with the current specs were smart people doing their best but it always seems a bit shit to me. I can send death packets to any device even if I'm not attached to the network and they're just honoured? Really? Was all this stuff created in a time when nobody actually considered bad people?
    - TeMPOraL 8y ago
      > Was all this stuff created in a time when nobody actually considered bad people? Yes. The Internet was designed in times where the primary worries were a) nuclear attacks causing major disruptions in the infrastructure, and b) pranksters. You can see that in the design of protocols, which assume all actors are participating in good faith. A lot of pieces of the Internet we still use were created for research community, where the default assumption was that everyone is acting benevolent (and if someone wasn't, they could be found and punished quickly through out-of-band means). I don't think anyone back then could ever imagine the amount of clueless, careless and evil people the commercialization of the Internet would bring to the network. Tangentially, this is also why we're stuck with programming in environments subpar compared to what we had in the 70s. The level of control people had over their OS and software also implied total lack of security.
hyperpape 8y ago
I actually get this perspective, as the endpoints listed here aren’t super sensitive (notifications do seem worth protecting). However, I’d still prefer to see security by default. With the current scenario, we have to track whether new, more sensitive features are introduced and whether or not they’ll introduce more security. As far as the local network, I think it can be assumed it’s insecure if you’re using any IoT devices. If not, then you might be able to trust it.
- rdiddly 8y ago
  Sounded like the GP was making the case that it's a bigger deal, not a smaller one. Or at least I would find it so.
vageli 8y ago
Defense in depth is a thing. Relying on "perimeter" security is a surefire way to get owned. Your attack surface is much larger than your perimeter.
bscphil 8y ago
Speaking of rebooting vulnerabilities, I'm reminded of the CSRF vulnerability in the popular Motorola SB6141 modem. Not only can, say, a embedded resource in a forum reboot your modem, it can also request reprovisioning, which can take you offline for up to half an hour. It's been fixed, at least by my local TWC, but I wonder if all ISPs have rolled out the firmware update. https://www.securityforrealpeople.com/2016/04/arris-motorola-surfboard-modem.html https://www.securityforrealpeople.com/2016/04/arris-motorola...
- lbeltrame 8y ago
  For the record, a popular ISP in my country designed its own router, which uses shell commands to compute the password hash, without even attempting to sanitize input[1]. If you have access to the login page (and until recently, it was also available via WAN) you could do all fancy tricks by putting the right commands in the password field, including bricking the equipment itself. [1] https://github.com/Nimayer/fastgate-toolkit/wiki/Get-a-root-shell-(SSH)#how-it-works https://github.com/Nimayer/fastgate-toolkit/wiki/Get-a-root-... People tried to contact the ISP and got no response back, of course.
  - pythonaut_16 8y ago
    Well of course not, all of the ISP's routers were already bricked.
NamTaf 8y ago
It's not what the concern is here, it's that this is becoming the norm for all IoT devices, and it is inevitable that in time said devices with comparable security will have access to more privileged, sensitive information. The principle of least privilege, as a sibling pointed out, is important here because it sets the expectations of what a secure IoT device looks like. If we don't nip it in the bud now, this sort of lax security will become prolific even when more important information is at stake. Google should be leading the pack on 'the right way' to do security on IoT. They know better.
minitech 8y ago
> Ya know what else they can do? Play Rick Astley on your Sonos speakers while printing 1000 pages of porn from every printer, casting Rick Astley music videos to every TV, getting Comcast to forward you piracy warnings and deleting all your Redis tables and Elastic Search indexes. If they can do that (minus the piracy warnings) without further interaction/firewalls being turned off, that’s an indication of more problems, not an indication that whatever the article is about isn’t a problem. You act like people getting on an average home network is unthinkable, but it happens all the time with visitors, weak passwords, broken wireless protocols….
amelius 8y ago
You forgot: access your webcams, your photos and videos.
solatic 8y ago
I'm inclined to agree with you. Home security is not on the same level as enterprise security. What do people expect? That you're going to have IAM so that only you can reboot your router remotely and not your kids or your dinner guests? I mean, it's not like Google couldn't do it, it's just horrendously expensive for little benefit. And then we'll get people griping that Google forces you and your kids to all get Google accounts just to use your home network.
- skywhopper 8y ago
  Security if these devices is very important. If even vendors like Google leave things this open, the risk is very real that these devices will be hacked and harnessed by criminals to make DDoS attacks, to use as proxies for criminal activity, to mine cryptocurrency using your electricity, to listen to and record activity in your home, to serve as jumping points to access your private data stored on open shared storage, or to steal your credentials to your bank. If we don’t push back against runaway lazy IoT security all of this will become commonplace very soon, and your lack of care about security in trivially pointless devices like Google Home will be horrendously expensive to you for very little benefit.
  - 908087 8y ago
    We're already well past the point of lazy IoT security becoming the norm.
_pmf_ 8y ago
> printing 1000 pages of porn from every printer No, because Windows domain group membership is required (your uninformed amateur setup might be different). > deleting all your Redis tables and Elastic Search indexes Don't you think that development tools that are used by (supposed) professionals have different requirements regarding out-of-the-box default behavior than a consumer product?
- mavhc 8y ago
  You'd think so, but they're making the same mistake as well. Not building in authentication by default is crazy no matter where it is
pdonis 8y ago
This is not an argument for adding a Google Hub to the mix. It's an argument for not having devices on your network that will accept unauthenticated commands from any other device. Would you have your laptop or desktop computer on your home network allow unauthenticated telnet instead of SSH?

by pkulak 8y ago

throwaway2048 8y ago

Ah the old saw, just don't let the bad guys on your network, or execute code on your computer, or visit their websites, or be in contact with them in any way. This is _clearly_ the user's fault yes.

pkulak 8y ago
The mere fact that more security is possible isn't a security vulnerability.

jchw 8y ago

I have occasionally had people in my complex accidentally print on my HP printer. It seems there's some wireless printing feature that is enabled by default and can be authenticated without needing physical access. The state of security for home networking devices could certainly be better. You forgot one though, they might also be able to delete your MongoDB collections :)

gerdesj 8y ago
Point your browser at it and switch off the bits you do not need. Ideally, switch off the wifi altogether if you can use ethernet.
- jchw 8y ago
  It is definitely not a WiFi printer. It is (was) connected to my machine via USB and it definitely didn't have my WiFi credentials. I would investigate further, but I've not had the printer plugged in for a while now.
  - Namidairo 8y ago
    They have a feature where it spins up it's own access point so that phones and the such can connect and print directly, so your wifi credentials wouldn't be required.
    - jchw 8y ago
      Yeah, that's exactly what I'm guessing is happening. That said, I don't really know how to disable it. I may be a software engineer, but printers are another realm for me, a dark one with a weird Turing complete programming language at the core and numerous protocols ranging from moderately confusing to batshit insane to interface with these pieces of crap. OK, so printers aren't that mysterious. I can operate a CUPS server and whatnot. But I just can't muster enough concern to figure out how to access the network settings on my printer, and I'd be willing to wager I either need to boot into Windows, connect it to LAN, or both, to actually do this.
      - brokenmachine 8y ago
        I bet it's crap enough to have the Administration settings available on that wifi network it creates, either totally open or probably some default password. I would certainly be having a good look at those settings if that thing was connected to my network.
      - rebuilder 8y ago
        Wrap it in foil!
      - xinau 8y ago
        As a friend of mine once said. "There are only two difficult things in IT, no. 1 is printer's and no. 2 is WiFi.
        TeMPOraL 8y ago
        Printers are hellspawn. Wi-Fi isn't that difficult. Bluetooth, on the other hand...
btgeekboy 8y ago
AppleTV has a similar "feature." Drove me nuts trying to find what was leaking in/out of my firewall - turns out that crap wasn't even going through it.
dibstern 8y ago
I hear that MongoDB is just deleting complete databases automatically, so you don’t even have to press a button!

bitwize 8y ago

In 2002 or so I had a dream. I was touring the new, modern, internet-connected home. Decor could be changed with the touch of a button because most of the home's surfaces (walls, cupboard fronts, etc.) were OLED displays that could display any texture or color of the user's choosing. As I was touring this home of the future, there was a hack of the smarthome servers. And then it appeared--goatse. Goatse everywhere. On every wall, every cupboard front, every countertop, scaled to cover the entire surface, was goatse. It was horrible. So much for the home of the future. Now you know why I distrust smarthome technology.

Theodores 8y ago
I have had a similar dream before, but with a couple of key differences: Given that most houses in most Western capital cities now cost millions and given that you can buy LCD panels for approximately the same price as bricks (for the same wall area) I do wonder why millionaires still stick with bricks. You could build a steel framed building and make all the walls, floors and ceilings from LCD panels saving yourself from having to have lights, pictures and regular TVs. With a few solar panels on the roof the electricity bill should be affordable too. My imagination for this extended to having live scenes from the seaside to have an immersive view of sunnier climes. Your imagination went to goatse though, maybe your fears and browsing habits informed your dreams differently to mine.

gerdesj 8y ago

My Redis and ES boxes have ufw on them and are on their own VLAN and need passwords etc. The Sonos are on another VLAN (SEWER - 802.1q tag 13) I don't have access to any RA music t home. I was traumatised enough by the eighties thank you 8)

vvanders 8y ago

In my mind it's a pretty gross violation of the principal of least privilege[1]. All it takes is one bad IoT device on your local LAN to exfiltrate/pivot over to the Hub. Some of the data that's dumped is things like "noise levels" which borders on sensitive PII information. Not to mention any vulnerabilities in these services that aren't understood yet. For all those reasons and more the IoT stuff on my local network goes into a VLAN that only gets to see the gateway and nothing else. No local UDP, TCP or the like, the Ubiquiti gear I picked up a while back makes it pretty trivial to setup. [1] https://en.wikipedia.org/wiki/Principle_of_least_privilege https://en.wikipedia.org/wiki/Principle_of_least_privilege

adtac 8y ago
This is all because of the current madness to have all devices connected each other. Completely connected "smart" things and network isolation/security: choose one.
- superflyguy 8y ago
  If the devices I care about are secure (laptop, phone etc) then I shouldn't have to care about other devices, whether they're on my home network or not. I'm in no way a security/network export and I'm sure the people who came up with the current specs were smart people doing their best but it always seems a bit shit to me. I can send death packets to any device even if I'm not attached to the network and they're just honoured? Really? Was all this stuff created in a time when nobody actually considered bad people?
  - TeMPOraL 8y ago
    > Was all this stuff created in a time when nobody actually considered bad people? Yes. The Internet was designed in times where the primary worries were a) nuclear attacks causing major disruptions in the infrastructure, and b) pranksters. You can see that in the design of protocols, which assume all actors are participating in good faith. A lot of pieces of the Internet we still use were created for research community, where the default assumption was that everyone is acting benevolent (and if someone wasn't, they could be found and punished quickly through out-of-band means). I don't think anyone back then could ever imagine the amount of clueless, careless and evil people the commercialization of the Internet would bring to the network. Tangentially, this is also why we're stuck with programming in environments subpar compared to what we had in the 70s. The level of control people had over their OS and software also implied total lack of security.

hyperpape 8y ago

I actually get this perspective, as the endpoints listed here aren’t super sensitive (notifications do seem worth protecting). However, I’d still prefer to see security by default. With the current scenario, we have to track whether new, more sensitive features are introduced and whether or not they’ll introduce more security. As far as the local network, I think it can be assumed it’s insecure if you’re using any IoT devices. If not, then you might be able to trust it.

rdiddly 8y ago
Sounded like the GP was making the case that it's a bigger deal, not a smaller one. Or at least I would find it so.

vageli 8y ago

Defense in depth is a thing. Relying on "perimeter" security is a surefire way to get owned. Your attack surface is much larger than your perimeter.

bscphil 8y ago

Speaking of rebooting vulnerabilities, I'm reminded of the CSRF vulnerability in the popular Motorola SB6141 modem. Not only can, say, a embedded resource in a forum reboot your modem, it can also request reprovisioning, which can take you offline for up to half an hour. It's been fixed, at least by my local TWC, but I wonder if all ISPs have rolled out the firmware update. https://www.securityforrealpeople.com/2016/04/arris-motorola-surfboard-modem.html https://www.securityforrealpeople.com/2016/04/arris-motorola...

lbeltrame 8y ago
For the record, a popular ISP in my country designed its own router, which uses shell commands to compute the password hash, without even attempting to sanitize input[1]. If you have access to the login page (and until recently, it was also available via WAN) you could do all fancy tricks by putting the right commands in the password field, including bricking the equipment itself. [1] https://github.com/Nimayer/fastgate-toolkit/wiki/Get-a-root-shell-(SSH)#how-it-works https://github.com/Nimayer/fastgate-toolkit/wiki/Get-a-root-... People tried to contact the ISP and got no response back, of course.
- pythonaut_16 8y ago
  Well of course not, all of the ISP's routers were already bricked.

NamTaf 8y ago

It's not what the concern is here, it's that this is becoming the norm for all IoT devices, and it is inevitable that in time said devices with comparable security will have access to more privileged, sensitive information. The principle of least privilege, as a sibling pointed out, is important here because it sets the expectations of what a secure IoT device looks like. If we don't nip it in the bud now, this sort of lax security will become prolific even when more important information is at stake. Google should be leading the pack on 'the right way' to do security on IoT. They know better.

minitech 8y ago

> Ya know what else they can do? Play Rick Astley on your Sonos speakers while printing 1000 pages of porn from every printer, casting Rick Astley music videos to every TV, getting Comcast to forward you piracy warnings and deleting all your Redis tables and Elastic Search indexes. If they can do that (minus the piracy warnings) without further interaction/firewalls being turned off, that’s an indication of more problems, not an indication that whatever the article is about isn’t a problem. You act like people getting on an average home network is unthinkable, but it happens all the time with visitors, weak passwords, broken wireless protocols….

amelius 8y ago

You forgot: access your webcams, your photos and videos.

solatic 8y ago

I'm inclined to agree with you. Home security is not on the same level as enterprise security. What do people expect? That you're going to have IAM so that only you can reboot your router remotely and not your kids or your dinner guests? I mean, it's not like Google couldn't do it, it's just horrendously expensive for little benefit. And then we'll get people griping that Google forces you and your kids to all get Google accounts just to use your home network.

skywhopper 8y ago
Security if these devices is very important. If even vendors like Google leave things this open, the risk is very real that these devices will be hacked and harnessed by criminals to make DDoS attacks, to use as proxies for criminal activity, to mine cryptocurrency using your electricity, to listen to and record activity in your home, to serve as jumping points to access your private data stored on open shared storage, or to steal your credentials to your bank. If we don’t push back against runaway lazy IoT security all of this will become commonplace very soon, and your lack of care about security in trivially pointless devices like Google Home will be horrendously expensive to you for very little benefit.
- 908087 8y ago
  We're already well past the point of lazy IoT security becoming the norm.

_pmf_ 8y ago

> printing 1000 pages of porn from every printer No, because Windows domain group membership is required (your uninformed amateur setup might be different). > deleting all your Redis tables and Elastic Search indexes Don't you think that development tools that are used by (supposed) professionals have different requirements regarding out-of-the-box default behavior than a consumer product?

mavhc 8y ago
You'd think so, but they're making the same mistake as well. Not building in authentication by default is crazy no matter where it is

pdonis 8y ago

This is not an argument for adding a Google Hub to the mix. It's an argument for not having devices on your network that will accept unauthenticated commands from any other device. Would you have your laptop or desktop computer on your home network allow unauthenticated telnet instead of SSH?