4 ms·

But if someone gets a bulb from your bins that you’ve thrown away because it was defective in some way, and gets access to your WiFi that way, it’s a bit annoyi

But if someone gets a bulb from your bins that you’ve thrown away because it was defective in some way, and gets access to your WiFi that way, it’s a bit annoying.

ce4 8y ago
It's the same with used hard drives: It's your fault if you throw away unshredded/unwiped disks.
- PinguTS 8y ago
  Explain that to Average Joe.
- newaccoutnas 8y ago
  Indeed, but will a non-tecnical user know that. It's been of increasing frequency non-technical users ask for disks to be wiped though, they are aware it contains sensitive information... but a light bulb? Maybe no lightbulb moment for them.
  - ce4 8y ago
    I don't know how to properly address this without wiping. Maybe not use wifi for the bulbs in the first place or not use IoT at all? Consumers will not care about that. Either you trust the lightbulb provider to protect your creds better or don't use it. In my opinion the lifx is reasonably protected and far from being the worst offender here: the attack doesnt work over the air, and depends on physical access to a pre-setup bulb and involves physical labour to access the credentials (needs cutting out the board, removing protecting glue from the board, dumping firmware). This is not really mass-exploitable. Services like wigle will allow to see where the wifi is located though, but the bar for attacking is pretty high. Have a look here for really awfull IoT sec: https://mjg59.dreamwidth.org/40397.html https://mjg59.dreamwidth.org/40397.html
    - newaccoutnas 8y ago
      What are world we live in where we have to put trust in our lightbulb provider
      - jnty 8y ago
        Given that bulbs have always been electrical devices capable of malfunctioning and burning our house down, we have been living in it for decades.
- laputan_machine 8y ago
  Hard drives are designed to store data, it is very explicit that they have data on them. Lightbulbs? Not really. Especially for people who don't work in this field.
  - ce4 8y ago
    People throw away or resell other stuff as well that has Wifi credentials in it (or will have in the future): - sale of used smart TV - thrown out wifi range extenders - used wifi enabled cameras - your smart fridge, toaster, whatever You will not get Google Home Mini / Alexa levels of security with these.
donkeyd 8y ago
How realistic of an attack vector is this though? LED bulbs often last 10 years or more. So either somebody knows you have an insecure light bulb and finds you important enough to regularly check whether you threw it out, or coincidentally, right when you throw out your smart bulb some tech savvy person went dumpster diving, found the bulb and really wanted to access your WiFi. The first scenario seems unrealistic, since people who are important enough to hack tend to also pay attention to the security of their devices and how they dispose of their trash [0]. The second seems unrealistic because the chances of it happening seem slim to none. [0]: https://theoutline.com/post/3994/it-is-weirdly-hard-to-steal-mark-zuckerbergs-trash https://theoutline.com/post/3994/it-is-weirdly-hard-to-steal...
- general8bitso 8y ago
  Dumpster diving no longer exists?

But if someone gets a bulb from your bins that you’ve thrown away because it was defective in some way, and gets access to your WiFi that way, it’s a bit annoying.

ce4 8y ago

It's the same with used hard drives: It's your fault if you throw away unshredded/unwiped disks.

PinguTS 8y ago
Explain that to Average Joe.
newaccoutnas 8y ago
Indeed, but will a non-tecnical user know that. It's been of increasing frequency non-technical users ask for disks to be wiped though, they are aware it contains sensitive information... but a light bulb? Maybe no lightbulb moment for them.
- ce4 8y ago
  I don't know how to properly address this without wiping. Maybe not use wifi for the bulbs in the first place or not use IoT at all? Consumers will not care about that. Either you trust the lightbulb provider to protect your creds better or don't use it. In my opinion the lifx is reasonably protected and far from being the worst offender here: the attack doesnt work over the air, and depends on physical access to a pre-setup bulb and involves physical labour to access the credentials (needs cutting out the board, removing protecting glue from the board, dumping firmware). This is not really mass-exploitable. Services like wigle will allow to see where the wifi is located though, but the bar for attacking is pretty high. Have a look here for really awfull IoT sec: https://mjg59.dreamwidth.org/40397.html https://mjg59.dreamwidth.org/40397.html
  - newaccoutnas 8y ago
    What are world we live in where we have to put trust in our lightbulb provider
    - jnty 8y ago
      Given that bulbs have always been electrical devices capable of malfunctioning and burning our house down, we have been living in it for decades.
laputan_machine 8y ago
Hard drives are designed to store data, it is very explicit that they have data on them. Lightbulbs? Not really. Especially for people who don't work in this field.
- ce4 8y ago
  People throw away or resell other stuff as well that has Wifi credentials in it (or will have in the future): - sale of used smart TV - thrown out wifi range extenders - used wifi enabled cameras - your smart fridge, toaster, whatever You will not get Google Home Mini / Alexa levels of security with these.

donkeyd 8y ago

How realistic of an attack vector is this though? LED bulbs often last 10 years or more. So either somebody knows you have an insecure light bulb and finds you important enough to regularly check whether you threw it out, or coincidentally, right when you throw out your smart bulb some tech savvy person went dumpster diving, found the bulb and really wanted to access your WiFi. The first scenario seems unrealistic, since people who are important enough to hack tend to also pay attention to the security of their devices and how they dispose of their trash [0]. The second seems unrealistic because the chances of it happening seem slim to none. [0]: https://theoutline.com/post/3994/it-is-weirdly-hard-to-steal-mark-zuckerbergs-trash https://theoutline.com/post/3994/it-is-weirdly-hard-to-steal...

general8bitso 8y ago
Dumpster diving no longer exists?