23 ms·

The S in IoT is for Security

565 points by rauhl 6y ago

1cvmask 6y ago
This is a great article explaining the need for open standards and non-proprietary approaches to IoT just like we have in the digital world. Vendor lock-in is a real issue for security and non-dependancy as well.
beckingz 6y ago
Good overview of how to hack a specific internet connected lamp to avoid installing the manufacturer's app.
sebastien_b 6y ago
Pretty sure that title was coined by Steve Gibson on his Security Now! podcast[1] (at least that's where I've first/only heard it). [1]https://www.grc.com/sn/sn-586.htm https://www.grc.com/sn/sn-586.htm
- monocasa 6y ago
  I've heard/said it before that point.
- ullevaal 6y ago
  > Pretty sure that title was coined by Steve Gibson on his Security Now! podcast In your source he explicitly says he does not know who the originator is. > I don't know who the originator was because I saw it coming from several different sources over the past week. But I just love this. I mean, I liked the acronym IDIOT, I-D-I-O-T, which of course stands for I Don't Internet of Things. But I think even better is this slogan: "The 'S' in IOT Is for Security."
  - sebastien_b 6y ago
    Good point - I missed that.
- driverdan 6y ago
  That style joke predates IoT. "The [letter] in [acronym that doesn't contain letter] stands for [punchline]"
schnable 6y ago
> A brief search returned the web API URL path that returns a JSON structure A brief search of what?
- johanbcn 6y ago
  Yeah, I'm wondering the same, since he refused to use the app at all, so no sniffing packets either.
- durnygbur 6y ago
  of lamp endpoints I presume!
- sigmonsays 6y ago
  i took it as a google search, which made me laugh at how much I read before i got to the point. I enjoyed reading this post actually but there is very little meat to what actually happened.
  - crescentfresh 6y ago
    Agreed, talking about how he discovered this API is what I would have wanted to read. He said the only opened port was 8xxx and it was a dead-end, so what port was this API running on then? How did he discover it without sniffing packets from the app? various, etc
    - bellyfullofbac 6y ago
      And if the browser "404'd", that means there's actually a web server listening (different to connection refused/timed out error messages). So was it a 404 or something else but you don't understand HTTP so you just called it 404? From the writing my impression is this is a guy flexing his "I know tech" muscles. Calling it "pwn"? Talking about his Librem phone/desktop? Well done 1337 hacker! /s
      - adolph 6y ago
        Put signature and stated use case appears to match the Elgato Key Lights API. https://www.elgato.com/en/key-light https://www.elgato.com/en/key-light https://www.npmjs.com/package/elgato-light-api https://www.npmjs.com/package/elgato-light-api
z3ncyberpunk 6y ago
Poignant way show show how there is no security in IoT
djcooley 6y ago
Chipset developers like Silicon Labs* are developing very advanced but approachable security capabilities into their latest products (secure boot, secure debug, physical protection (DPA countermeasure, anti-tamper), key management, key storage, crypto engine, etc.)*. The tools are there now to address this, and this should go a long way toward actually securing the application, the data, the IP, and overall simplify lifecycle management. * - disclaimer, I am an employee * - https://www.silabs.com/security https://www.silabs.com/security
- tpolzer 6y ago
  The issue here isn't hardware capabilities, it's that vendors like to make their gadgets centrally connected for convenience and analytics and then on top often don't care about hygiene (e.g. no crypto at all).
- TheRealDunkirk 6y ago
  I don't care how "secure" one can make an internet-connected lamp. I don't want or need a lamp to connect to the internet to change its operating conditions. The problem is that we, as a society, are being so suckered by cheap consumer devices that it's becoming difficult to even FIND NON-connected devices in some categories. Like the lamp in the article, I'm willing to bet that he looked for something with purely physical controls, and couldn't find one in a comparable price point. I honestly don't get it. I can't fathom what some company could possibly be doing with my usage data from some internet-connected LAMP, or why they would go about designing all the infrastructure to make it work. It would be orders of magnitude more easy to just put some buttons on the side of the unit. At this point, I guess someone out there thinks, "Oh, neat!" but this sort of situation is paving the way for it to be impossible to buy ANY consumer electronic device that doesn't phone home in the very near future.
- temac 6y ago
  Would it only allow for the lamp to be "secure" in the sense that the owner would not be able to take back control anymore? If that's the case, that's a "solution" worse than the problem, that's even unethical as hell given this will short/medium term accelerate the ecological nightmare.
throw080700 6y ago
The open KNX Standard seems to be the answer to IoT's woes. But nobody seems to have heard of it. https://en.wikipedia.org/wiki/KNX_(standard) https://en.wikipedia.org/wiki/KNX_(standard) This classic talk - Learn how to control every room at a luxury hotel remotely (2015) [has eng subtitles]: https://www.youtube.com/watch?v=RX-O4XuCW1Y https://www.youtube.com/watch?v=RX-O4XuCW1Y
- markild 6y ago
  Also Zigbee and Z-Wave.
  - throw080700 6y ago
    Zigbee got problems with non-free licensing. Z-Wave seems open, is it completely open?
    - danhor 6y ago
      Z-Wave is very closed, afaik only a few chips are available and need to be licensed. Compared to that Zigbee seems to be much more open.
      - throw080700 6y ago
        Ok. The top thread of this HN post about Zigbee not being that open: https://news.ycombinator.com/item?id=21825822 https://news.ycombinator.com/item?id=21825822
    - pantalaimon 6y ago
      Zigbee is IEEE 802.15.4, you can also run 6LoWPAN on top instead of the Zigbee stack.
- gog 6y ago
  It's not that nobody heard of it, the problem is that it's not cheap to get stared since the devices are pretty expensive and you usually need to run wiring. > It is administered by the KNX Association cvba, a non-profit organisation governed by Belgian law which was formed in 1999. The KNX Association had 443 registered hardware and software vendor members from 44 nations as at 1 July 2018. It had partnership agreements with over 77,000 installer companies in 163 countries and more than 440 registered training centres.[2] This is a royalty-free open standard and thus access to the KNX specifications is unrestricted. It looks to me like it is competing with systems like Control4 in US since usually you want somebody to install and set it up for you. Having said that I do believe that it is a good standard and I hope I will be able to implement it in my next home for the fundamental (must work) things like heating, blinds and lighting (maybe with DALI).
motohagiography 6y ago
The S in IoT should be for "Stop buying stupid disposable junk." I can't listen to anyone complain about climate change while they fill their homes with cheap consumer electronics from globalized supply chains that spy on them. I also can't imagine letting an internet connected anything in my home, and I keep all internet electronics in one room. Sure, other people can live in a surveillance zoo, but I prefer to keep mine limited. If it has a circuit, stow it.
- viraptor 6y ago
  There's a lot of IoT stuff which doesn't reach out to the internet. You can also reflash some commercial solutions with open firmware. Also, there's quite a few local only solutions using ZigBee / zwave that you can manage from Home Assistant.
  - chrisBob 6y ago
    I think the I in IoT is really for Internet, so I am not sure if it counts if it is local only.
    - tehlike 6y ago
      Vpn
    - unethical_ban 6y ago
      Literally yes, but come on. "connected home" and IoT are so close in use case, and _because_ most connected home things are Internet-only, let's not pick at terminology too much. I would love to have a connected home that did not require _any_ external connectivity or web accounts. Why did I need to login with my Google account and enable location services to set up a Chromecast Audio?
      - 8note 6y ago
        I imagine it enables Google to enforce location based licensing for where you can listen to certain songs at a given price point. Listening to a song in the forest is free, listening to it in a bustling street costs 10¢ per play because you're performing it to people walking by
outadoc 6y ago
If you want to, you can turn it into a Home Assistant plugin (or even add it to the core). It's a great project that aims to provide this kind of interface for all kinds of "smart" devices in a user-friendly way. https://github.com/home-assistant/ https://github.com/home-assistant/
- hirundo 6y ago
  I have found Home Assistant to be very user unfriendly and difficult to use. I have about $1000 in switches that are among the most popular Z-Wave devices on the market that I have not been able to get working, as well as other devices. I'm admittedly clueless with hardware, but I build software for a living. The few things that do work required hours of spelunking on forums into incomprehensible details of configuration. It's not a system I'd recommend to a typical consumer.
  - connorproctor 6y ago
    How long ago did you try it? I had a similar experience with Home Assistant a couple years ago, but they’ve made a ton of progress on UX recently. I still wouldn’t recommend for a typical consumer, but should be easy for someone building their own apps.
    - outadoc 6y ago
      Agreed! It was really terrible, it's much better now - at least you don't need to fiddle with YAML anymore for most things. There's still a ways to go, but for the audience reading this, it should be accessible.
    - hirundo 6y ago
      Maybe two and half years. I'll give it another try, thanks.
  - BrandoElFollito 6y ago
    HA is not the easiest system to get into, but once you are there is is fantastic. It is a state machine that I also use for some other software, not to mention that it has tons of integrations. I use Zigbee and it took me 10 minutes to have it successfully running (via MQTT autodiscovery, or via the ZHE module (which I tested byt keep with MQTT)). It certianly is not something would suggest to my parents, but someone who is technical (especially with software, and especially-especially with Python) it is not difficult. The main issue is how the docs are organized, it takes quite sometime to understand the way the whole thig works. After that it is downhill. Finally there is a strong move to the UI where many things become click-n-go.
danhor 6y ago
Many of these WiFi-LED lamps contain esp8266 devices, which have a lot of open source alternative firmware available, like esphome[0] or tasmota[1]. You can reflash them by opening them & connecting a cheap (1$) usb-to-tty adapter. If that isn't an option (for reasons like not wanting to permanently damage them or being afraid of electrical shocks) a lot of them come with tuya firmware, which you can (still) often exploit and convert with TUYA-CONVERT [2]. I found the Tasmota Device Templates Repository[3] to be a really valuable resource, although I've been using zigbee devices for lightbulbs. [0]https://esphome.io/ https://esphome.io/ [1]https://github.com/arendst/Tasmota https://github.com/arendst/Tasmota [2]https://github.com/ct-Open-Source/tuya-convert https://github.com/ct-Open-Source/tuya-convert [3]https://templates.blakadder.com/index.html https://templates.blakadder.com/index.html
DarkCrusader2 6y ago
One thing I haven't seen mention much with these "smart" devices is how inconvenient lack of physical buttons is. Instead of just reaching over and adjust the volume/brightness whatever, I now have to unlock the phone, find the app and do some gestures to achieve same results, all of which now requires some mental bandwidth for these banal tasks.
- hunter2_ 6y ago
  When your hands are occupied by cooking or some such, it's nice to bark orders at a voice assistant for timers, lighting adjustments, adding to the shopping list, etc.
  - _Microft 6y ago
    I think the parent commenter was not annoyed by the fact that they could use an app but that they have to.
    - mattwad 6y ago
      He's got a point. My smart lights are the only reason I even own a Google Home assistant. The rest of the features are not very important to me.
- cube2222 6y ago
  This problem will depend on the vendors you buy your products from. Having a few brands of smart home devices which are all compatible with homekit, I just swipe down on my lockscreen and have all of them as shortcuts in the single native interface or use my watch to operate them with voice. Android seems to have the Google Home app for this exact same reason, but I have no idea how well that works.
- ktpsns 6y ago
  I absolutely second this. "IoT" is a keyword to furnish up cheap hardware where the price of physical switches would have harmed the profit margin too much. This is not really ironic: Physical switches (with a price of probably 0,2 USD per component) are more expensive then SoC having Wifi implemented. Also it's cheaper to hire software-only developers to do as little hardware engineering as possible. It's all about cutting the price per unit down.
soheil 6y ago
There doesn't have to be an S in it to be secured since the T is for Trustworthiness.
- hnedeotes 6y ago
  and the three "asses" in that stand for simply super secure.
  - soheil 6y ago
    I'm one person shouldn't that be singular?
steve_gh 6y ago
IoT runs across a range of use cases and connections. There is a lot of emphasis on WiFi IoT applications, but this makes things hard in other places. I'm working on various IoT sensor products that require a cellular connection - NB-IoT is preferred for this use case due to the good penetration characteristics. But the problem is that UDP is recommended as the NB-IoT transport layer due to the problem with TCP ack timeouts due to NB-IoT latency. That means that you are practically reduced to MQTT-SN as a data protocol, which in turn means you lose TLS. There are partial solutions - we whitelist our MQTT data sources (i.e. only the Cellular provider's NB-IoT gateway), and we can verify and whitelist the IDs of all connected devices). But it is a partial and imperfect solution. Security is hard...
blablabla123 6y ago
Software needs to be updated though, certificates need to be checked and all that. That's only possible with Internet - unless you run your own CA, Package Mirror on the local network. That said, there is also a trade off between having a having ports open for REST vs. having a gateway (whether that's on the local network or on the Internet). Also it's probably a difference whether one plans to update the installed system every now and then or whether that should be fully automated...
- denysvitali 6y ago
  This is true, but honestly I have almost never seen an IoT device getting updated for security reasons - instead they seem to update things OTA to just add more crap to it. In any case, a CA lasts ~20-30 years. Hopefully the IoT device will be dead by then
flyinghamster 6y ago
Another problem: Even when the device is working as it should, there needs to be a "lock" mode that says, "don't download new firmware." Nothing like having your smoothly-functioning lighting setup FUBARed by an unnecessary and buggy firmware update - especially if you're far away from home when it happens.
- astrea 6y ago
  What about the inverse where it was shipped with buggy software or one with a massive security hole that now can't be patched because it is "locked"?
  - grenoire 6y ago
    What if we built simpler systems that are less prone to security issues, without the cpre assumption that we can 'just patch it up' whenever after it's shipped off?
    - astrea 6y ago
      What if we were born without the need to consume or generate matter? I think it's easy to generate idealistic scenarios, but not so easy to implement them in reality. There's a couple counter-pressures to your question. The first being that the average consumer has come to expect and demand a higher level of functionality out of even simple devices. The next is that there's no monetary incentive in creating the perfect system from the start, especially when you can just use premade things. Finally, hackers (whether they be nation-state actors or your neighbor's bored teenager) are CONSTANTLY on the prowl for vulnerabilities in all things connected to the internet. With that in mind, it's not quite as easy to develop the perfect, unhackable system.
      - KozmoNau7 6y ago
        Maybe we should change the incentive structure.
wojciii 6y ago
Ok.. so he needs to scan for an unique AP first and then send the command to the device on this network. Is the phone capable being connected to multiple 2.4 networks or does controlling the light mean having to first scan and the connect to a network? This approach sounds slooow.
mrb 6y ago
Usually the factory default WiFi network that IoT devices create during setup is open. No password required. It seems the author left the device in that state when he reverse-engineered the API. So anyone in the vicinity of the network can connect to his lamp and control it. I wouldn't call this "secure."
edf13 6y ago
Isn't this just a vailed SEO/Content filled blog post/Ad for puri.sm?
- alpaca128 6y ago
  I don't see a veil on a blog post where the author's name and CEO position in the company is the first thing you see. Sure you can argue Purism won't exactly publish something that doesn't agree with their marketing, but at the same time I prefer seeing a blog post than some other product page on here. And they're not the only one, in fact right now the very top post on HN is a blog entry by Mozilla about a new feature in their product.
wolfi1 6y ago
somehow ironic that he uses flatpak for his "secure" app, considering an article about flatpack security hit the HN frontpage a few days ago
- deleted 6y ago
  [deleted]
mixedmath 6y ago
I think I'm missing a few major points. I wonder if someone here might be able to clarify. 1. The real meat of this "pwning" was (it seems) a google search to identify the WEB API endpoint. Then it turns out that sending POST requests to this endpoint can turn the light on/off, change its temperature, and change its brightness. 2. In order to turn a light on/off using the "found" api, it is first necessary to connect to the lamp's network. So if I were doing this on my own linux machine, which cannot as far as I can tell connect to multiple wireless networks at the same time, my script to change the settings on the light would include disconnecting from my true wifi network, connecting to the lamp's network, sending the signal to the lamp, disconnecting from the lamp, and then reconnecting to my own network. Is that right? Is this what the bash scripts and apps mentioned in the post are doing? 3. If I lived in the apartment above the OP's (say), and I were malicious, I could even now also access the lamps' networks and, say, set their values to be whatever I wanted. And there is simply no way of stopping this (S in IoT, after all).
- Spivak 6y ago
  Yeah this is so far from pwning that it’s hilarious to be presented as such. This is literally authorized access. He built an integration for his smart bulbs the same way Google Home or HomeKit would access it but with some weird Wi-Fi paranoia that actually made him less secure. The security model of pretty much all smart lighting "if you can reach me on the network you're trusted" just like the security of light switches "if you can reach the switch you can flip it."
  - spongechameleon 6y ago
    I mean the alternative was installing the propietary app so I would say this is still a big win. But also yes, any wifi capable device in your home with no authorization is clearly a disaster waiting to happen.
    - Spivak 6y ago
      I don't disagree that it's a huge improvement over some proprietary app but I still don't think "using the light's API as designed" counts as pwning it. It's the same API that openHAB or Home Assistant would consume to control it.
formercoder 6y ago
I’d encourage anyone who enjoys these projects to check out Home Assistant. It’s an incredible open source project with support for countless devices.
alpaca128 6y ago
The U in Smart (devices) stands for user-friendly. We need an app to control a stupid lamp but at the same time are expected to buy a "smart home" system so that we don't have to pull the phone out of the pocket. Originally smartwatches were marketed for the same purpose, but I guess now there's also the severe risk of having both hands unavailable at the moment so we need to be able to delay the system update via voice command. Of course with tracking so they can "improve the user experience", and the occasional personalised ad. Meanwhile I'm wondering how people got convinced this is better than just pressing a physical button, but then I remember even $500+ appliances nowadays are built with such cheap buttons that after a few years I'm forced to learn where to smack the fist on the front cover so they work again for a few minutes.
- melomal 6y ago
  > I'm wondering how people got convinced FOMO and PR. I have friends that have plenty of money and read the latest reviews/gadget magazines. They assume whatever is in the recommended area you should be buying it or your neighbours will have it first.
_joel 6y ago
Is there a curated list of IoT devices from a security perspective? Like is the firmware flashable with open code, how chatty is the device/callhome, update frequency (if any) etc?
- ville 6y ago
  https://foundation.mozilla.org/en/privacynotincluded/ https://foundation.mozilla.org/en/privacynotincluded/ is the "*privacy not included" guide from Mozilla. However, the main "creepiness" score is based on user votes, so it's not particularly useful (people rate brands they like highly, regardless of actual security). https://templates.blakadder.com https://templates.blakadder.com is a repository of devices flashable with Tasmota (an open firmaware for devices with ESP8266 or ESP32 which are very common chips for wi-fi based IoT devices https://zigbee.blakadder.com https://zigbee.blakadder.com is a repository of Zigbee devices, which don't connect to internet at all by design. You can use them with a Zigbee gateway.
godot 6y ago
Just out of curiosity, if that web API request is made while connected to the lamp via its WiFi access point, I am guessing that means whenever they wanted to control the lamp using this custom app, they'd have to make their phone disconnect from the main WiFi, reconnect to lamp WiFi, do actions, then reconnect back to main WiFi (I suppose that could all be automated within the custom app) Wish the lamp would just put that control as a knob on the lamp..
DannyB2 6y ago
The SH in SHIoT is for Security Hardened IoT.
BrandoElFollito 6y ago
Well, hacking such devices gets immediately easier when you can google the API endpoint, and that endpoint is REST (or REST-like). I have a wifi radio (Ocean) and I tried several times to hack it so that I can programmatically start and configure it but failed every time because the whole system is completely closed and non standard. I would love to buy a radio that has an API (actually I would buy three right away)
gautamcgoel 6y ago
Took me a moment to get the joke, pretty clever title.
cute_boi 6y ago
and P in IOT is for privacy lol.
KETpXDDzR 6y ago
One can't spell "idiot" without "i", "o", "t".
lrvick 6y ago
This is why I just flash ESPHome firmware on all all the IoT stuff I buy to make them useful, trusted, and easily updated elements of my home. I even run tuya-convert to switch over my dozens of light bulbs. Anything that can't run open firmware I control doesn't get to live on my internal LAN.
- 1023bytes 6y ago
  This is what the article should've been about. OP's implementation is pretty impractical
KETpXDDzR 6y ago
My way to deal with IoT devices: A virtual "guest" WiFi w/ AP isolation using DD-WRT. Devices in there can access the Internet. That's it. They can't see other devices in my local networks. That makes me sleep better.
xyzzy21 6y ago
As in the S is missing! :-)
- thitcanh 6y ago
  thatsthejoke.jpg
ShakataGaNai 6y ago
Ah yes. Elgato Key Lights. Let's be thankful that they are, in fact, using ESP32 for a central control chip and use a very simple REST protocol. It could be a lot worse, a lot more proprietary. These are simple devices, but expensive as far as lights go. You can very easily get dumb lights that have only physical controls. For a lot cheaper too.
kissgyorgy 6y ago
Shameless plug: We are working on the solution! Our motto is actually "Put the S into IoT" :D by working with security researchers on an automated tool which can scan and find vulnerabilities in all kinds of IoT firmwares. Check it out: https://www.iot-inspector.com/ https://www.iot-inspector.com/ Our old UI is "not very nice", but we already have a GraphQL API and pretty UI very soon. If you are a security researcher or IoT shop, you should contact us!
ridaj 6y ago
Good point by the author, but iiuc neighbors can just walk up and control the lamp too if operating on the lamp's presumably open wifi? Missing from the home IoT security works is a decentralized auth infrastructure story. I don't fully subscribe to the notion that people do this because they want to monetize... That may be the case sometimes but here I tend to believe you get to this kind of solution if you want something that is usable by average consumers and has some form of auth.
drivinmecrazy 6y ago
Can you believe Generac standby generators need you to download an app and receive an activation code which no doubt you key into the generator before it will work. I nearly got caught out with this when we were looking to replace our cottage genny. We don't have internet access how stupid a concept is this. Thankfully I found out before completing the purchase so I bought a different brand but I'm with this guy all the way. I'm not connecting my lightbulbs, toaster or intelligent microflushing loo to anything internet just to use the product.
mafro 6y ago
I imagine it's mentioned elsewhere in this commentary, but the key point I think this chap missed was not connecting to a wifi network under his control. "A browser hitting that returned a page to connect the lamp to local WiFi. That is a no-go ..." You can buy prosumer routers nowadays for $99 USD which enable one to setup different subnets and VLANS such that a device is accessible on the network but unable to access the internet. I'm not afraid of IoT like some other tinfoil types commenting here - just make sure they can't call home (I'm looking at you Samsung TV)
rolph 6y ago
>>The S in IoT is for Security<< I cant help noticing, the s in IoT comes last, after all other things and is lower case, and not even important enough to appear in the acronym /s
- warmfuzzykitten 6y ago
  Um. There is no S in IoT. I think that's the joke.
  - rolph 6y ago
    InternetofThings as per the joke the s is often overlooked /s
  - warmfuzzykitten 6y ago
    Who downvoted my comment? The guy who didn't get the joke?
radicalriddler 6y ago
This is just a Librem 5 / pureOS ad right?
messo 6y ago
IKEAs zigbee devices are cheap, realiable and accessible and works great with Home Assistant + the deCONZ usb dongle. No WiFi connected devices, not internet access. When I'm out of the house I "phone home" with a VPN to adjust the temperature and turn off the lights if I forgot. I have automated several basic things, like the color temperature of the lights and the temperature of my heaters when electricity prices spikes. Unfortunately this is not really accessible for regular consumers, only for nerds who know their way around a terminal and vi(m).
fomine3 6y ago
> Full Lamp Stack :D
deleted 6y ago
[deleted]
_wldu 6y ago
The P is for Privacy.
asiachick 6y ago
AppleTV Airplay kind of fits this for me. Maybe it's secure, but, and MacOS Big Sur surfaced this for me. I click the screen sharing icon on my Mac and my 2 shares show up. I go to select the one I always select, asynchronously MacOS scans for more Airplay receivers. It finds my neighbors and adds them sorted alphabetically to the menu in real time. Result, 50-70% of the time I click the AirPlay device for another apartment since by sorting the list the positions change under my mouse. I've learned to click the screen share menu, then wait about 3 seconds for my neighbors' devices to appear, since the position of the device I want to click will move. But, here's the thing. AFAIK a display pops up on my neighbor's TV showing a code I'm supposed to type into my Mac. Further, AFAIK, if the TV was off the device (usually an AppleTV) will turn on the TV on via HDMI. So, I've possibly interrupted my neighbors viewing. Or if it's late at night I just turned on their TV (no idea if it shuts it self off). I know Apple has this feature to make it zero configuration but I'm not convinced it's the best feature. I've thought about figuring out how to send the same packets and building a small device/app that tries to connect to every Airplay device constantly. Then I could drive around the Apple campus and interrupt meetings. Or, I could just put the app on my phone and walk around and hope that Apple will get enough complaints from users about "why does this code keep popping up on my TV" until Apple fixes the issue. I think the issue is that the AppleTV uses Bluetooth as an extra communication channel to setup a session and you can turn it off but I suspect most users have not. Is that a security issue that I can turn on my neighbors TVs and AppleTVs remotely?

565 points by rauhl 6y ago

This is a great article explaining the need for open standards and non-proprietary approaches to IoT just like we have in the digital world. Vendor lock-in is a real issue for security and non-dependancy as well.

beckingz 6y ago

Good overview of how to hack a specific internet connected lamp to avoid installing the manufacturer's app.

sebastien_b 6y ago

Pretty sure that title was coined by Steve Gibson on his Security Now! podcast[1] (at least that's where I've first/only heard it). [1]https://www.grc.com/sn/sn-586.htm https://www.grc.com/sn/sn-586.htm

monocasa 6y ago
I've heard/said it before that point.
ullevaal 6y ago
> Pretty sure that title was coined by Steve Gibson on his Security Now! podcast In your source he explicitly says he does not know who the originator is. > I don't know who the originator was because I saw it coming from several different sources over the past week. But I just love this. I mean, I liked the acronym IDIOT, I-D-I-O-T, which of course stands for I Don't Internet of Things. But I think even better is this slogan: "The 'S' in IOT Is for Security."
- sebastien_b 6y ago
  Good point - I missed that.
driverdan 6y ago
That style joke predates IoT. "The [letter] in [acronym that doesn't contain letter] stands for [punchline]"

schnable 6y ago

> A brief search returned the web API URL path that returns a JSON structure A brief search of what?

johanbcn 6y ago
Yeah, I'm wondering the same, since he refused to use the app at all, so no sniffing packets either.
durnygbur 6y ago
of lamp endpoints I presume!
sigmonsays 6y ago
i took it as a google search, which made me laugh at how much I read before i got to the point. I enjoyed reading this post actually but there is very little meat to what actually happened.
- crescentfresh 6y ago
  Agreed, talking about how he discovered this API is what I would have wanted to read. He said the only opened port was 8xxx and it was a dead-end, so what port was this API running on then? How did he discover it without sniffing packets from the app? various, etc
  - bellyfullofbac 6y ago
    And if the browser "404'd", that means there's actually a web server listening (different to connection refused/timed out error messages). So was it a 404 or something else but you don't understand HTTP so you just called it 404? From the writing my impression is this is a guy flexing his "I know tech" muscles. Calling it "pwn"? Talking about his Librem phone/desktop? Well done 1337 hacker! /s
    - adolph 6y ago
      Put signature and stated use case appears to match the Elgato Key Lights API. https://www.elgato.com/en/key-light https://www.elgato.com/en/key-light https://www.npmjs.com/package/elgato-light-api https://www.npmjs.com/package/elgato-light-api

z3ncyberpunk 6y ago

Poignant way show show how there is no security in IoT

djcooley 6y ago

Chipset developers like Silicon Labs* are developing very advanced but approachable security capabilities into their latest products (secure boot, secure debug, physical protection (DPA countermeasure, anti-tamper), key management, key storage, crypto engine, etc.)*. The tools are there now to address this, and this should go a long way toward actually securing the application, the data, the IP, and overall simplify lifecycle management. * - disclaimer, I am an employee * - https://www.silabs.com/security https://www.silabs.com/security

tpolzer 6y ago
The issue here isn't hardware capabilities, it's that vendors like to make their gadgets centrally connected for convenience and analytics and then on top often don't care about hygiene (e.g. no crypto at all).
TheRealDunkirk 6y ago
I don't care how "secure" one can make an internet-connected lamp. I don't want or need a lamp to connect to the internet to change its operating conditions. The problem is that we, as a society, are being so suckered by cheap consumer devices that it's becoming difficult to even FIND NON-connected devices in some categories. Like the lamp in the article, I'm willing to bet that he looked for something with purely physical controls, and couldn't find one in a comparable price point. I honestly don't get it. I can't fathom what some company could possibly be doing with my usage data from some internet-connected LAMP, or why they would go about designing all the infrastructure to make it work. It would be orders of magnitude more easy to just put some buttons on the side of the unit. At this point, I guess someone out there thinks, "Oh, neat!" but this sort of situation is paving the way for it to be impossible to buy ANY consumer electronic device that doesn't phone home in the very near future.
temac 6y ago
Would it only allow for the lamp to be "secure" in the sense that the owner would not be able to take back control anymore? If that's the case, that's a "solution" worse than the problem, that's even unethical as hell given this will short/medium term accelerate the ecological nightmare.

throw080700 6y ago

The open KNX Standard seems to be the answer to IoT's woes. But nobody seems to have heard of it. https://en.wikipedia.org/wiki/KNX_(standard) https://en.wikipedia.org/wiki/KNX_(standard) This classic talk - Learn how to control every room at a luxury hotel remotely (2015) [has eng subtitles]: https://www.youtube.com/watch?v=RX-O4XuCW1Y https://www.youtube.com/watch?v=RX-O4XuCW1Y

markild 6y ago
Also Zigbee and Z-Wave.
- throw080700 6y ago
  Zigbee got problems with non-free licensing. Z-Wave seems open, is it completely open?
  - danhor 6y ago
    Z-Wave is very closed, afaik only a few chips are available and need to be licensed. Compared to that Zigbee seems to be much more open.
    - throw080700 6y ago
      Ok. The top thread of this HN post about Zigbee not being that open: https://news.ycombinator.com/item?id=21825822 https://news.ycombinator.com/item?id=21825822
  - pantalaimon 6y ago
    Zigbee is IEEE 802.15.4, you can also run 6LoWPAN on top instead of the Zigbee stack.
gog 6y ago
It's not that nobody heard of it, the problem is that it's not cheap to get stared since the devices are pretty expensive and you usually need to run wiring. > It is administered by the KNX Association cvba, a non-profit organisation governed by Belgian law which was formed in 1999. The KNX Association had 443 registered hardware and software vendor members from 44 nations as at 1 July 2018. It had partnership agreements with over 77,000 installer companies in 163 countries and more than 440 registered training centres.[2] This is a royalty-free open standard and thus access to the KNX specifications is unrestricted. It looks to me like it is competing with systems like Control4 in US since usually you want somebody to install and set it up for you. Having said that I do believe that it is a good standard and I hope I will be able to implement it in my next home for the fundamental (must work) things like heating, blinds and lighting (maybe with DALI).

motohagiography 6y ago

The S in IoT should be for "Stop buying stupid disposable junk." I can't listen to anyone complain about climate change while they fill their homes with cheap consumer electronics from globalized supply chains that spy on them. I also can't imagine letting an internet connected anything in my home, and I keep all internet electronics in one room. Sure, other people can live in a surveillance zoo, but I prefer to keep mine limited. If it has a circuit, stow it.

viraptor 6y ago
There's a lot of IoT stuff which doesn't reach out to the internet. You can also reflash some commercial solutions with open firmware. Also, there's quite a few local only solutions using ZigBee / zwave that you can manage from Home Assistant.
- chrisBob 6y ago
  I think the I in IoT is really for Internet, so I am not sure if it counts if it is local only.
  - tehlike 6y ago
    Vpn
  - unethical_ban 6y ago
    Literally yes, but come on. "connected home" and IoT are so close in use case, and _because_ most connected home things are Internet-only, let's not pick at terminology too much. I would love to have a connected home that did not require _any_ external connectivity or web accounts. Why did I need to login with my Google account and enable location services to set up a Chromecast Audio?
    - 8note 6y ago
      I imagine it enables Google to enforce location based licensing for where you can listen to certain songs at a given price point. Listening to a song in the forest is free, listening to it in a bustling street costs 10¢ per play because you're performing it to people walking by

outadoc 6y ago

If you want to, you can turn it into a Home Assistant plugin (or even add it to the core). It's a great project that aims to provide this kind of interface for all kinds of "smart" devices in a user-friendly way. https://github.com/home-assistant/ https://github.com/home-assistant/

hirundo 6y ago
I have found Home Assistant to be very user unfriendly and difficult to use. I have about $1000 in switches that are among the most popular Z-Wave devices on the market that I have not been able to get working, as well as other devices. I'm admittedly clueless with hardware, but I build software for a living. The few things that do work required hours of spelunking on forums into incomprehensible details of configuration. It's not a system I'd recommend to a typical consumer.
- connorproctor 6y ago
  How long ago did you try it? I had a similar experience with Home Assistant a couple years ago, but they’ve made a ton of progress on UX recently. I still wouldn’t recommend for a typical consumer, but should be easy for someone building their own apps.
  - outadoc 6y ago
    Agreed! It was really terrible, it's much better now - at least you don't need to fiddle with YAML anymore for most things. There's still a ways to go, but for the audience reading this, it should be accessible.
  - hirundo 6y ago
    Maybe two and half years. I'll give it another try, thanks.
- BrandoElFollito 6y ago
  HA is not the easiest system to get into, but once you are there is is fantastic. It is a state machine that I also use for some other software, not to mention that it has tons of integrations. I use Zigbee and it took me 10 minutes to have it successfully running (via MQTT autodiscovery, or via the ZHE module (which I tested byt keep with MQTT)). It certianly is not something would suggest to my parents, but someone who is technical (especially with software, and especially-especially with Python) it is not difficult. The main issue is how the docs are organized, it takes quite sometime to understand the way the whole thig works. After that it is downhill. Finally there is a strong move to the UI where many things become click-n-go.

danhor 6y ago

Many of these WiFi-LED lamps contain esp8266 devices, which have a lot of open source alternative firmware available, like esphome[0] or tasmota[1]. You can reflash them by opening them & connecting a cheap (1$) usb-to-tty adapter. If that isn't an option (for reasons like not wanting to permanently damage them or being afraid of electrical shocks) a lot of them come with tuya firmware, which you can (still) often exploit and convert with TUYA-CONVERT [2]. I found the Tasmota Device Templates Repository[3] to be a really valuable resource, although I've been using zigbee devices for lightbulbs. [0]https://esphome.io/ https://esphome.io/ [1]https://github.com/arendst/Tasmota https://github.com/arendst/Tasmota [2]https://github.com/ct-Open-Source/tuya-convert https://github.com/ct-Open-Source/tuya-convert [3]https://templates.blakadder.com/index.html https://templates.blakadder.com/index.html

DarkCrusader2 6y ago

One thing I haven't seen mention much with these "smart" devices is how inconvenient lack of physical buttons is. Instead of just reaching over and adjust the volume/brightness whatever, I now have to unlock the phone, find the app and do some gestures to achieve same results, all of which now requires some mental bandwidth for these banal tasks.

hunter2_ 6y ago
When your hands are occupied by cooking or some such, it's nice to bark orders at a voice assistant for timers, lighting adjustments, adding to the shopping list, etc.
- _Microft 6y ago
  I think the parent commenter was not annoyed by the fact that they could use an app but that they have to.
  - mattwad 6y ago
    He's got a point. My smart lights are the only reason I even own a Google Home assistant. The rest of the features are not very important to me.
cube2222 6y ago
This problem will depend on the vendors you buy your products from. Having a few brands of smart home devices which are all compatible with homekit, I just swipe down on my lockscreen and have all of them as shortcuts in the single native interface or use my watch to operate them with voice. Android seems to have the Google Home app for this exact same reason, but I have no idea how well that works.
ktpsns 6y ago
I absolutely second this. "IoT" is a keyword to furnish up cheap hardware where the price of physical switches would have harmed the profit margin too much. This is not really ironic: Physical switches (with a price of probably 0,2 USD per component) are more expensive then SoC having Wifi implemented. Also it's cheaper to hire software-only developers to do as little hardware engineering as possible. It's all about cutting the price per unit down.

soheil 6y ago

There doesn't have to be an S in it to be secured since the T is for Trustworthiness.

hnedeotes 6y ago
and the three "asses" in that stand for simply super secure.
- soheil 6y ago
  I'm one person shouldn't that be singular?

steve_gh 6y ago

IoT runs across a range of use cases and connections. There is a lot of emphasis on WiFi IoT applications, but this makes things hard in other places. I'm working on various IoT sensor products that require a cellular connection - NB-IoT is preferred for this use case due to the good penetration characteristics. But the problem is that UDP is recommended as the NB-IoT transport layer due to the problem with TCP ack timeouts due to NB-IoT latency. That means that you are practically reduced to MQTT-SN as a data protocol, which in turn means you lose TLS. There are partial solutions - we whitelist our MQTT data sources (i.e. only the Cellular provider's NB-IoT gateway), and we can verify and whitelist the IDs of all connected devices). But it is a partial and imperfect solution. Security is hard...

blablabla123 6y ago

Software needs to be updated though, certificates need to be checked and all that. That's only possible with Internet - unless you run your own CA, Package Mirror on the local network. That said, there is also a trade off between having a having ports open for REST vs. having a gateway (whether that's on the local network or on the Internet). Also it's probably a difference whether one plans to update the installed system every now and then or whether that should be fully automated...

denysvitali 6y ago
This is true, but honestly I have almost never seen an IoT device getting updated for security reasons - instead they seem to update things OTA to just add more crap to it. In any case, a CA lasts ~20-30 years. Hopefully the IoT device will be dead by then

flyinghamster 6y ago

Another problem: Even when the device is working as it should, there needs to be a "lock" mode that says, "don't download new firmware." Nothing like having your smoothly-functioning lighting setup FUBARed by an unnecessary and buggy firmware update - especially if you're far away from home when it happens.

astrea 6y ago
What about the inverse where it was shipped with buggy software or one with a massive security hole that now can't be patched because it is "locked"?
- grenoire 6y ago
  What if we built simpler systems that are less prone to security issues, without the cpre assumption that we can 'just patch it up' whenever after it's shipped off?
  - astrea 6y ago
    What if we were born without the need to consume or generate matter? I think it's easy to generate idealistic scenarios, but not so easy to implement them in reality. There's a couple counter-pressures to your question. The first being that the average consumer has come to expect and demand a higher level of functionality out of even simple devices. The next is that there's no monetary incentive in creating the perfect system from the start, especially when you can just use premade things. Finally, hackers (whether they be nation-state actors or your neighbor's bored teenager) are CONSTANTLY on the prowl for vulnerabilities in all things connected to the internet. With that in mind, it's not quite as easy to develop the perfect, unhackable system.
    - KozmoNau7 6y ago
      Maybe we should change the incentive structure.

wojciii 6y ago

Ok.. so he needs to scan for an unique AP first and then send the command to the device on this network. Is the phone capable being connected to multiple 2.4 networks or does controlling the light mean having to first scan and the connect to a network? This approach sounds slooow.

mrb 6y ago

Usually the factory default WiFi network that IoT devices create during setup is open. No password required. It seems the author left the device in that state when he reverse-engineered the API. So anyone in the vicinity of the network can connect to his lamp and control it. I wouldn't call this "secure."

edf13 6y ago

Isn't this just a vailed SEO/Content filled blog post/Ad for puri.sm?

alpaca128 6y ago
I don't see a veil on a blog post where the author's name and CEO position in the company is the first thing you see. Sure you can argue Purism won't exactly publish something that doesn't agree with their marketing, but at the same time I prefer seeing a blog post than some other product page on here. And they're not the only one, in fact right now the very top post on HN is a blog entry by Mozilla about a new feature in their product.

wolfi1 6y ago

somehow ironic that he uses flatpak for his "secure" app, considering an article about flatpack security hit the HN frontpage a few days ago

deleted 6y ago
[deleted]

mixedmath 6y ago

I think I'm missing a few major points. I wonder if someone here might be able to clarify. 1. The real meat of this "pwning" was (it seems) a google search to identify the WEB API endpoint. Then it turns out that sending POST requests to this endpoint can turn the light on/off, change its temperature, and change its brightness. 2. In order to turn a light on/off using the "found" api, it is first necessary to connect to the lamp's network. So if I were doing this on my own linux machine, which cannot as far as I can tell connect to multiple wireless networks at the same time, my script to change the settings on the light would include disconnecting from my true wifi network, connecting to the lamp's network, sending the signal to the lamp, disconnecting from the lamp, and then reconnecting to my own network. Is that right? Is this what the bash scripts and apps mentioned in the post are doing? 3. If I lived in the apartment above the OP's (say), and I were malicious, I could even now also access the lamps' networks and, say, set their values to be whatever I wanted. And there is simply no way of stopping this (S in IoT, after all).

Spivak 6y ago
Yeah this is so far from pwning that it’s hilarious to be presented as such. This is literally authorized access. He built an integration for his smart bulbs the same way Google Home or HomeKit would access it but with some weird Wi-Fi paranoia that actually made him less secure. The security model of pretty much all smart lighting "if you can reach me on the network you're trusted" just like the security of light switches "if you can reach the switch you can flip it."
- spongechameleon 6y ago
  I mean the alternative was installing the propietary app so I would say this is still a big win. But also yes, any wifi capable device in your home with no authorization is clearly a disaster waiting to happen.
  - Spivak 6y ago
    I don't disagree that it's a huge improvement over some proprietary app but I still don't think "using the light's API as designed" counts as pwning it. It's the same API that openHAB or Home Assistant would consume to control it.

formercoder 6y ago

I’d encourage anyone who enjoys these projects to check out Home Assistant. It’s an incredible open source project with support for countless devices.

alpaca128 6y ago

The U in Smart (devices) stands for user-friendly. We need an app to control a stupid lamp but at the same time are expected to buy a "smart home" system so that we don't have to pull the phone out of the pocket. Originally smartwatches were marketed for the same purpose, but I guess now there's also the severe risk of having both hands unavailable at the moment so we need to be able to delay the system update via voice command. Of course with tracking so they can "improve the user experience", and the occasional personalised ad. Meanwhile I'm wondering how people got convinced this is better than just pressing a physical button, but then I remember even $500+ appliances nowadays are built with such cheap buttons that after a few years I'm forced to learn where to smack the fist on the front cover so they work again for a few minutes.

melomal 6y ago
> I'm wondering how people got convinced FOMO and PR. I have friends that have plenty of money and read the latest reviews/gadget magazines. They assume whatever is in the recommended area you should be buying it or your neighbours will have it first.

_joel 6y ago

Is there a curated list of IoT devices from a security perspective? Like is the firmware flashable with open code, how chatty is the device/callhome, update frequency (if any) etc?

ville 6y ago
https://foundation.mozilla.org/en/privacynotincluded/ https://foundation.mozilla.org/en/privacynotincluded/ is the "*privacy not included" guide from Mozilla. However, the main "creepiness" score is based on user votes, so it's not particularly useful (people rate brands they like highly, regardless of actual security). https://templates.blakadder.com https://templates.blakadder.com is a repository of devices flashable with Tasmota (an open firmaware for devices with ESP8266 or ESP32 which are very common chips for wi-fi based IoT devices https://zigbee.blakadder.com https://zigbee.blakadder.com is a repository of Zigbee devices, which don't connect to internet at all by design. You can use them with a Zigbee gateway.

godot 6y ago

Just out of curiosity, if that web API request is made while connected to the lamp via its WiFi access point, I am guessing that means whenever they wanted to control the lamp using this custom app, they'd have to make their phone disconnect from the main WiFi, reconnect to lamp WiFi, do actions, then reconnect back to main WiFi (I suppose that could all be automated within the custom app) Wish the lamp would just put that control as a knob on the lamp..

DannyB2 6y ago

The SH in SHIoT is for Security Hardened IoT.

BrandoElFollito 6y ago

Well, hacking such devices gets immediately easier when you can google the API endpoint, and that endpoint is REST (or REST-like). I have a wifi radio (Ocean) and I tried several times to hack it so that I can programmatically start and configure it but failed every time because the whole system is completely closed and non standard. I would love to buy a radio that has an API (actually I would buy three right away)

gautamcgoel 6y ago

Took me a moment to get the joke, pretty clever title.

cute_boi 6y ago

and P in IOT is for privacy lol.

KETpXDDzR 6y ago

One can't spell "idiot" without "i", "o", "t".

lrvick 6y ago

This is why I just flash ESPHome firmware on all all the IoT stuff I buy to make them useful, trusted, and easily updated elements of my home. I even run tuya-convert to switch over my dozens of light bulbs. Anything that can't run open firmware I control doesn't get to live on my internal LAN.

1023bytes 6y ago
This is what the article should've been about. OP's implementation is pretty impractical

KETpXDDzR 6y ago

My way to deal with IoT devices: A virtual "guest" WiFi w/ AP isolation using DD-WRT. Devices in there can access the Internet. That's it. They can't see other devices in my local networks. That makes me sleep better.

xyzzy21 6y ago

As in the S is missing! :-)

thitcanh 6y ago
thatsthejoke.jpg

ShakataGaNai 6y ago

Ah yes. Elgato Key Lights. Let's be thankful that they are, in fact, using ESP32 for a central control chip and use a very simple REST protocol. It could be a lot worse, a lot more proprietary. These are simple devices, but expensive as far as lights go. You can very easily get dumb lights that have only physical controls. For a lot cheaper too.

kissgyorgy 6y ago

Shameless plug: We are working on the solution! Our motto is actually "Put the S into IoT" :D by working with security researchers on an automated tool which can scan and find vulnerabilities in all kinds of IoT firmwares. Check it out: https://www.iot-inspector.com/ https://www.iot-inspector.com/ Our old UI is "not very nice", but we already have a GraphQL API and pretty UI very soon. If you are a security researcher or IoT shop, you should contact us!

ridaj 6y ago

Good point by the author, but iiuc neighbors can just walk up and control the lamp too if operating on the lamp's presumably open wifi? Missing from the home IoT security works is a decentralized auth infrastructure story. I don't fully subscribe to the notion that people do this because they want to monetize... That may be the case sometimes but here I tend to believe you get to this kind of solution if you want something that is usable by average consumers and has some form of auth.

drivinmecrazy 6y ago

Can you believe Generac standby generators need you to download an app and receive an activation code which no doubt you key into the generator before it will work. I nearly got caught out with this when we were looking to replace our cottage genny. We don't have internet access how stupid a concept is this. Thankfully I found out before completing the purchase so I bought a different brand but I'm with this guy all the way. I'm not connecting my lightbulbs, toaster or intelligent microflushing loo to anything internet just to use the product.

mafro 6y ago

I imagine it's mentioned elsewhere in this commentary, but the key point I think this chap missed was not connecting to a wifi network under his control. "A browser hitting that returned a page to connect the lamp to local WiFi. That is a no-go ..." You can buy prosumer routers nowadays for $99 USD which enable one to setup different subnets and VLANS such that a device is accessible on the network but unable to access the internet. I'm not afraid of IoT like some other tinfoil types commenting here - just make sure they can't call home (I'm looking at you Samsung TV)

rolph 6y ago

>>The S in IoT is for Security<< I cant help noticing, the s in IoT comes last, after all other things and is lower case, and not even important enough to appear in the acronym /s

warmfuzzykitten 6y ago
Um. There is no S in IoT. I think that's the joke.
- rolph 6y ago
  InternetofThings as per the joke the s is often overlooked /s
- warmfuzzykitten 6y ago
  Who downvoted my comment? The guy who didn't get the joke?

radicalriddler 6y ago

This is just a Librem 5 / pureOS ad right?

messo 6y ago

IKEAs zigbee devices are cheap, realiable and accessible and works great with Home Assistant + the deCONZ usb dongle. No WiFi connected devices, not internet access. When I'm out of the house I "phone home" with a VPN to adjust the temperature and turn off the lights if I forgot. I have automated several basic things, like the color temperature of the lights and the temperature of my heaters when electricity prices spikes. Unfortunately this is not really accessible for regular consumers, only for nerds who know their way around a terminal and vi(m).

fomine3 6y ago

> Full Lamp Stack :D

deleted 6y ago

[deleted]

_wldu 6y ago

The P is for Privacy.

asiachick 6y ago

AppleTV Airplay kind of fits this for me. Maybe it's secure, but, and MacOS Big Sur surfaced this for me. I click the screen sharing icon on my Mac and my 2 shares show up. I go to select the one I always select, asynchronously MacOS scans for more Airplay receivers. It finds my neighbors and adds them sorted alphabetically to the menu in real time. Result, 50-70% of the time I click the AirPlay device for another apartment since by sorting the list the positions change under my mouse. I've learned to click the screen share menu, then wait about 3 seconds for my neighbors' devices to appear, since the position of the device I want to click will move. But, here's the thing. AFAIK a display pops up on my neighbor's TV showing a code I'm supposed to type into my Mac. Further, AFAIK, if the TV was off the device (usually an AppleTV) will turn on the TV on via HDMI. So, I've possibly interrupted my neighbors viewing. Or if it's late at night I just turned on their TV (no idea if it shuts it self off). I know Apple has this feature to make it zero configuration but I'm not convinced it's the best feature. I've thought about figuring out how to send the same packets and building a small device/app that tries to connect to every Airplay device constantly. Then I could drive around the Apple campus and interrupt meetings. Or, I could just put the app on my phone and walk around and hope that Apple will get enough complaints from users about "why does this code keep popping up on my TV" until Apple fixes the issue. I think the issue is that the AppleTV uses Bluetooth as an extra communication channel to setup a session and you can turn it off but I suspect most users have not. Is that a security issue that I can turn on my neighbors TVs and AppleTVs remotely?