5 ms·
The (editorialized) current HN title ("Coffee makers are demanding ransom") implies that this is an in-the-wild attack. It's just another PoC showing that IoT
by tgsovlerkhgsel 6y ago
The (editorialized) current HN title ("Coffee makers are demanding ransom") implies that this is an in-the-wild attack.
It's just another PoC showing that IoT devices tend to have bad security.
In-the-wild ransomware would be interesting news because the same fragmentation that makes it unprofitable to secure devices (too few devices sold of each vendor/model for the vendor to invest serious money in security) makes it unprofitable to attack most devices.
Ransomware is particularly pointless for non-critical devices like a coffee maker. I could see it working e.g. with something controlling heating that isn't easily bypassable (pay us now, or by the time you get a tech out your pipes will be frozen and your house ruined), or something that can otherwise cause harm before the user can disable it (which is likely rare).
With a coffee maker, you can easily unplug the device (preventing it from doing further harm/threatening to burn your house down), put it in a box, and ship it to the vendor to fix it.
- gogopuppygogo 6y agoYou understand the technology. The average person does not. The coffee maker can be programmed to tell the user they have to pay or XYZ will happen. Some will believe them and pay.
- tgsovlerkhgsel 6y agoThe set of people who have that specific coffee machine is pretty small. The set of people who have that specific machine, will be able to send you the money without calling someone more competent first, yet are not smart enough to unplug it, is simply not worth the criminal's time. What would you make "XYZ" to convince a reasonable number of users to pay you, instead of unplugging the machine and optionally removing it from their house through the nearest window?
- netsharc 6y agoI suppose this PoC shows how bad it can be, and you should ask, would a machine from a "major manufacturer" be any better, or how high do you think the chances are that the product manager from that major manufacturer would just look for the cheapest vendor offering IoT, and would be fooled by the sales people saying "Oh yeah, our software is very secure!" (they'll tell him this lie over the Zoom meeting that has "end to end encryption"...). And showing the face of the devil and saying "Gimme money" is an obvious PoC. In 5 years the error message will be "Problem 0xDF. Please contact support at [scammer's number]". And then? Sending a fake repairman with a hefty bill would take too much time, how about a remote "repair" and a repair bill? "We can send someone out to repair it, but that'll 2 weeks. Or we can do it over the Internet in 5 minutes, but it will cost $10, which would you prefer?".
- tgsovlerkhgsel 6y agoSo now the criminal earned $10 each, from maybe 10% of the device owners that they managed to hit. Balance that with the cost of developing the attack, the software, the phone scripts, the infrastructure for handling the calls and money collection, ... Also, how would the attacker collect payment? Bitcoin/gift cards break the conversion rate, and credit card will get killed by chargebacks once the attack becomes well known.
- anigbrowl 6y agoYes, but HN is not for technically naive people. Thus a populist headline style isn't helpful to HN readers.
- arthurcolle 6y agoI just bought a Keurig and the there is no screen to display such a message, so the set of people this would theoretically effect is even smaller than the initial thought experiment...
- m463 6y agoWith keurig the ransom is paid by the coffee pod manufacturers. https://en.wikipedia.org/wiki/Keurig#Legal_and_media_issues https://en.wikipedia.org/wiki/Keurig#Legal_and_media_issues
- mcguire 6y agohttps://www.cpomagazine.com/cyber-security/iot-based-ddos-attacks-are-growing-and-making-use-of-common-vulnerabilities/ https://www.cpomagazine.com/cyber-security/iot-based-ddos-at...
- tgsovlerkhgsel 6y agoDDoS botnets are a lot easier than ransomware. They don't have to communicate with the user and don't need a credible threat. Many devices that simply don't have a realistic ransom threat are usable for those, and the same code can potentially be reused across completely different classes of devices as long as they run the same underlying OS. They also often don't cause problems for the user, so the user - and as a result, the vendor - doesn't have a strong incentive to avoid them.
- m463 6y agoI thought it might be about Keurig, whose coffeemakers don't brew unauthorized coffee.
- lostlogin 6y ago> unauthorized coffee This sounds like good coffee.
- mcnichol 6y agoYou have a heck of a brand-name on your hand....trademark!
- lostlogin 6y agoIt’s in a similar vein to Roasted Addiqtion. “By the hit, by the gram, by the kilo”. It’s a pity they went with the ‘q’ imho. https://roastedaddiqtion.co.nz/ https://roastedaddiqtion.co.nz/
- m463 6y agothis was actually a nod to Cory Doctorow's book: https://craphound.com/unauthorizedbread/ https://craphound.com/unauthorizedbread/
- lostlogin 6y agoOh, thanks. The HN thread when that came out was good (see below). The list of books by the author have such a good collection of covers. https://news.ycombinator.com/item?id=23985140 https://news.ycombinator.com/item?id=23985140
- dang 6y agoWe changed the title to a substring of the title ("Coffee makers are demanding a ransom") to make it less baity but I see how that could be misleading. I've attempted to disambiguate it above. Edit: perhaps a better solution is to change to the original source, pointed out by commenters in this thread. We've changed to that from https://arstechnica.com/information-technology/2020/09/how-a-hacker-turned-a-250-coffee-maker-into-ransom-machine/ https://arstechnica.com/information-technology/2020/09/how-a....
- mcnichol 6y agoCame here to say exactly this...it's still a click-baity title. This really has nothing to do with demanding ransom. You could hack a website leaving a message and claim they could "Demand a ransom". Quite simply this is just the ease of hacking IoT devices which unfortunately is not new and has happened with every industry as it becomes "connected" (cars, homes, etc). I would have clicked if it said merely "IoT /s/Home Devices /Coffee Makers/ easily hacked" but the "ransom" aspect is purely to heighten the fear, arguably even in the article itself. This reminds me of the range-rover when they reported on it as if they had taken over a jeep "in-the-wild" where in reality it was a very controlled scenario and arguably much more sophisticated. Even then it wasn't as sensational as this (just my opinion).
- mindslight 6y agoDemand a ransom of $2 to make coffee first thing in the morning, when people don't want to have their routine interrupted. Repeat rarely so that the victim won't prioritize replacing the machine. Instant subscription-based startup, no hardware dev cost.