8 ms·

The device in the article (an internet connected oven) is checking for internet connectivity by pinging: google.com, baido.cn yes, and yandex.ru every 5 minutes

The device in the article (an internet connected oven) is checking for internet connectivity by pinging: google.com, baido.cn yes, and yandex.ru every 5 minutes. My guess is this isn't about sending data to those sites, but rather using relying on high availability urls that you can connect to from most countries. Is this bad engineering? Probably. Is it nefarious? Probably not. One thing to keep in mind is that the companies making these smart appliances do not make their money from the internet connected features. Internet connectivity may be enough for to push a buyer over the edge or for the device to qualify for some rebate. The manufactures make them from selling ovens. This means they probably don't have the best software development team or processes.

pyrolistical 4y ago
You can never tell if it’s a covert channel. Maybe it’s signalling bits by slightly differing the timing of each ping. The bandwidth would be extremely low but it’s always connected
- mstolpm 4y ago
  What would be the information the oven can expose over thus a channel? How often I cook? How much energy I use for cooking? The oven will not even know if I'm at home or not if not used. I can't think of any critical spying done that way? Of course if the oven had cameras and microphones - but then again, the bandwidth of a covert channel would be rather limiting.
  - nerdponx 4y ago
    Oven usage data is probably extremely valuable for advertisers.
  - uoaei 4y ago
    The things you can do with statistical methods nowadays might blow your mind if you think there is not much information in oven usage. You could infer likely occupancy periods of the home, since obviously if the house is empty no one is pushing buttons on the oven, and use some basic priors (9-5 jobs, x number of kids) to develop what is likely a pretty accurate model that would be profitable to sell to advertisers. Perhaps there are sensitive voltmeters on the power supply that can detect usage of other devices on the same circuit. Not to mention that it is yet one more channel of information alongside the flood of data being generated about you and your home by the rest of the devices you have incorporated into your life, and these things tend to have superlinear benefits when combined a la "multi-task" ML contexts. This is not an exhaustive list.
- tarotuser 4y ago
  Moreso, you never know if there's some logic bomb inserted in the response. And it's not at all far-fetched. We have the Sony PS2 Linux yanked away after it being a sold feature. And with a joke of a response to that, indicates that any internet connected device is a rental to the ever-changing terms of the real owner.
sizzzzlerz 4y ago
For now, maybe its only pinging the servers (for which we still don't have the full story) but who knows what happens with the next update, assuming it doesn't brick your device, that is.
- jchw 4y ago
  No fan of the internet of shit here or anything, but I don't think these aspects of the firmware will get any more nefarious. The other terrible things about smart home devices are already well-known. As usual, I just recommend sticking to only smart home equipment that can work over local radio or some other bus that's not internet connected. Strongly recommend people check out home assistant; for moderate power users it's pretty easy to wrangle a bunch of Bluetooth LE, ZigBee and Zwave devices. I can find off the shelf Zwave devices at my local Lowe's and ZigBee at my local Best Buy (Philips Hue devices work fine for me out of the box.) Of course, when it comes to ovens, you're probably shit out of luck. But whatever. Not sure what serious value add a radio on an oven adds. Guess you can see the timer from the couch... I'll be keeping my Samsung appliances off the network personally. No real need for whatever SmartThings might offer anyways.
  - sizzzzlerz 4y ago
    I agree its probably benign, but its really hard to trust companies these days to do the right thing. Consumers are basically being treated as sheep to be sheared.
- pphysch 4y ago
  And literally any piece of Internet-connected software could start doing nefarious things, whether or not it pings google.com (or non-Western equivalents). This is a sensationalist piece of blogspam, probably designed to get picked up by a unscrupulous tabloid and boost the author's engagement metrics.
Aperocky 4y ago
looks like an OR relationship. Since such an oven won't be able to connect to google.com if it is located in China, looks like lazy/resourceful engineering instead of malicious intent.
kurthr 4y ago
I'm stunned that almost anyone would go through the effort of connecting their oven to WiFi. I'll be more concerned when these become 5G connected and start charging you a monthly fee for connection. I wouldn't be surprised if in the future you can get $100 OFF! by signing up for the $5/mo service that you just can't seem to cancel (or it's free for the first year when you sign up with a credit card).
- rcme 4y ago
  Device manufacturers are starting to build mesh networks so pretty soon your devices won't need to connect to your WiFi in order to phone home.
  - evilduck 4y ago
    Removing antennas from electronics isn't too hard, or worst case, physically damaging them or installing faraday cages. Seems like an interesting cottage industry that could bloom around intentionally stupifying your unwanted smart home.
    - counttheforks 4y ago
      I'm sure they'll just throw error messages until they've managed to establish a connection. Device manufacturers have already shown they'd rather cripple your devices than respect your wishes.
    - HeyLaughingBoy 4y ago
      Antennas on cheap consumer devices are often just a trace on the PC board. Still not that hard to remove (could just cut the trace), but harder to do without damaging anything than unplugging an external one.
  - sizzzzlerz 4y ago
    Enclose your kitchen in a Faraday cage.
  - LeifCarrotson 4y ago
BizarreByte 4y ago
I worked on a project that did this very thing to determine if the software was online. It’s a very common way of doing it, even if it’s not the best way, because it’s reliable, simple, and cheap.
- megous 4y ago
  Well, just connect to your own service, then? If it's offline, then you will not be able to "sync data" or whatever anyway, even if the device is connected to "The Internet". These connectivity checks sound completely pointless.
  - lesuorac 4y ago
    Do you know how many ovens there are? The AWS lambda fees are going to be insane! So much cheaper just to ping google.com instead.
    - megous 4y ago
      Let's see: ping packet size is say 64 bytes so 128B both ways My $3 VPS has 1TiB/mo bandwidth limit. So that's 2^40 / 128 / 24 / 60 / 30 = ~200k ovens pinging once every minute (which is ridiculous frequency) for $3 I guess if manufacturer can't afford $3 per 200k ovens sold, he should go out of business or stop stuffing ovens with IoT shit. :)
    - skellera 4y ago
      Hopefully no one is using lambda for connection health checks. An empty static page on a CDN is probably a better use of resources. But yeah, at that point just ping google since they’ve spent millions on availability.
    - Tobani 4y ago
      I worked for a Company that was a vendor for Lenovo. They had some sort of "News about Lenovo" app on all of their commercial grade machines. The content and translations were managed in our system and each computer would pull down the feed from our servers. It was decent traffic, but nothing crazy... Until they made a change and all of the sudden every machine was pulling every hour at zero minutes and zero seconds. We had one minute of DDoS every day at noon for about a week until that was mitigated.
deleted 4y ago
[deleted]
cnorthwood 4y ago
When I worked at the BBC, there was a substantial proportion of all traffic to the homepage which were just some devices checking for an internet connection. I believe as part of the move to HTTPS-only there was serious discussion over whether or not there was a public service responsibility to not break some random devices out there, as moving from a 200 to 301 response on http://www.bbc.co.uk http://www.bbc.co.uk might have broken some things.
- luckylion 4y ago
  There should be official services for that. I'm sure Google (or in Germany, heise.de, which publishes multiple IT-related magazines since forever) sees a lot of that as well. The BBC's home page currently weighs in at around 45kb compressed or 230kb uncompressed. Imagine how much traffic is needlessly generated just by connectivity checks, not to speak of the amount of computing power.
  - neurostimulant 4y ago
    Some internet connectivity check endpoints I see in my home networks: - http://detectportal.firefox.com http://detectportal.firefox.com - http://ping.manjaro.org/check_network_status.txt http://ping.manjaro.org/check_network_status.txt - http://connectivitycheck.gstatic.com/generate_204 http://connectivitycheck.gstatic.com/generate_204 - http://captive.apple.com http://captive.apple.com - http://www.msftconnecttest.com/connecttest.txt http://www.msftconnecttest.com/connecttest.txt - http://api.ipify.org http://api.ipify.org The manjaro one will respond with "NetworkManager is online" when accessed from curl, but redirect to manjaro homepage when accessed from a browser.
  - xxpor 4y ago
    A good use case for using HEAD instead of GET
    - alex_suzuki 4y ago
      Ancient wisdom… easily forgotten.
United857 4y ago
Perhaps they just want to make it useful in the Chinese market where Google is blocked by the great firewall without having to have a separate firmware build just for that.
- red-iron-pine 4y ago
  that was my thought -- ping google, which is reachable in the Americas and Europe, and hit the Chinese and Russian sites that might limit Google. Guess you're out of luck in Turkmenistan, but works well enough most other places.
amelius 4y ago
> Is this bad engineering? Probably. Curious, how would you implement it?
iforgotpassword 4y ago
Yeah I sighed when I got to that point. You have no problem to expose your oven to the internet, but then a ping to Yandex or Baidu is taking it too far? If they wanted to exfiltrate data they'd surely find a way to piggyback it on the legitimate traffic to the cloud service they're using...
counttheforks 4y ago
They're actually making their money from negligence. If you plan to sell an internet connected device you better be prepared to to put care and effort into designing & maintaining it.
skibidibipiti 4y ago
[dead]
karmicthreat 4y ago
So what IS the correct way?

pyrolistical 4y ago

You can never tell if it’s a covert channel. Maybe it’s signalling bits by slightly differing the timing of each ping. The bandwidth would be extremely low but it’s always connected

mstolpm 4y ago
What would be the information the oven can expose over thus a channel? How often I cook? How much energy I use for cooking? The oven will not even know if I'm at home or not if not used. I can't think of any critical spying done that way? Of course if the oven had cameras and microphones - but then again, the bandwidth of a covert channel would be rather limiting.
- nerdponx 4y ago
  Oven usage data is probably extremely valuable for advertisers.
- uoaei 4y ago
  The things you can do with statistical methods nowadays might blow your mind if you think there is not much information in oven usage. You could infer likely occupancy periods of the home, since obviously if the house is empty no one is pushing buttons on the oven, and use some basic priors (9-5 jobs, x number of kids) to develop what is likely a pretty accurate model that would be profitable to sell to advertisers. Perhaps there are sensitive voltmeters on the power supply that can detect usage of other devices on the same circuit. Not to mention that it is yet one more channel of information alongside the flood of data being generated about you and your home by the rest of the devices you have incorporated into your life, and these things tend to have superlinear benefits when combined a la "multi-task" ML contexts. This is not an exhaustive list.
tarotuser 4y ago
Moreso, you never know if there's some logic bomb inserted in the response. And it's not at all far-fetched. We have the Sony PS2 Linux yanked away after it being a sold feature. And with a joke of a response to that, indicates that any internet connected device is a rental to the ever-changing terms of the real owner.

sizzzzlerz 4y ago

For now, maybe its only pinging the servers (for which we still don't have the full story) but who knows what happens with the next update, assuming it doesn't brick your device, that is.

jchw 4y ago
No fan of the internet of shit here or anything, but I don't think these aspects of the firmware will get any more nefarious. The other terrible things about smart home devices are already well-known. As usual, I just recommend sticking to only smart home equipment that can work over local radio or some other bus that's not internet connected. Strongly recommend people check out home assistant; for moderate power users it's pretty easy to wrangle a bunch of Bluetooth LE, ZigBee and Zwave devices. I can find off the shelf Zwave devices at my local Lowe's and ZigBee at my local Best Buy (Philips Hue devices work fine for me out of the box.) Of course, when it comes to ovens, you're probably shit out of luck. But whatever. Not sure what serious value add a radio on an oven adds. Guess you can see the timer from the couch... I'll be keeping my Samsung appliances off the network personally. No real need for whatever SmartThings might offer anyways.
- sizzzzlerz 4y ago
  I agree its probably benign, but its really hard to trust companies these days to do the right thing. Consumers are basically being treated as sheep to be sheared.
pphysch 4y ago
And literally any piece of Internet-connected software could start doing nefarious things, whether or not it pings google.com (or non-Western equivalents). This is a sensationalist piece of blogspam, probably designed to get picked up by a unscrupulous tabloid and boost the author's engagement metrics.

Aperocky 4y ago

looks like an OR relationship. Since such an oven won't be able to connect to google.com if it is located in China, looks like lazy/resourceful engineering instead of malicious intent.

kurthr 4y ago

I'm stunned that almost anyone would go through the effort of connecting their oven to WiFi. I'll be more concerned when these become 5G connected and start charging you a monthly fee for connection. I wouldn't be surprised if in the future you can get $100 OFF! by signing up for the $5/mo service that you just can't seem to cancel (or it's free for the first year when you sign up with a credit card).

rcme 4y ago
Device manufacturers are starting to build mesh networks so pretty soon your devices won't need to connect to your WiFi in order to phone home.
- evilduck 4y ago
  Removing antennas from electronics isn't too hard, or worst case, physically damaging them or installing faraday cages. Seems like an interesting cottage industry that could bloom around intentionally stupifying your unwanted smart home.
  - counttheforks 4y ago
    I'm sure they'll just throw error messages until they've managed to establish a connection. Device manufacturers have already shown they'd rather cripple your devices than respect your wishes.
  - HeyLaughingBoy 4y ago
    Antennas on cheap consumer devices are often just a trace on the PC board. Still not that hard to remove (could just cut the trace), but harder to do without damaging anything than unplugging an external one.
- sizzzzlerz 4y ago
  Enclose your kitchen in a Faraday cage.
- LeifCarrotson 4y ago

BizarreByte 4y ago

I worked on a project that did this very thing to determine if the software was online. It’s a very common way of doing it, even if it’s not the best way, because it’s reliable, simple, and cheap.

megous 4y ago
Well, just connect to your own service, then? If it's offline, then you will not be able to "sync data" or whatever anyway, even if the device is connected to "The Internet". These connectivity checks sound completely pointless.
- lesuorac 4y ago
  Do you know how many ovens there are? The AWS lambda fees are going to be insane! So much cheaper just to ping google.com instead.
  - megous 4y ago
    Let's see: ping packet size is say 64 bytes so 128B both ways My $3 VPS has 1TiB/mo bandwidth limit. So that's 2^40 / 128 / 24 / 60 / 30 = ~200k ovens pinging once every minute (which is ridiculous frequency) for $3 I guess if manufacturer can't afford $3 per 200k ovens sold, he should go out of business or stop stuffing ovens with IoT shit. :)
  - skellera 4y ago
    Hopefully no one is using lambda for connection health checks. An empty static page on a CDN is probably a better use of resources. But yeah, at that point just ping google since they’ve spent millions on availability.
  - Tobani 4y ago
    I worked for a Company that was a vendor for Lenovo. They had some sort of "News about Lenovo" app on all of their commercial grade machines. The content and translations were managed in our system and each computer would pull down the feed from our servers. It was decent traffic, but nothing crazy... Until they made a change and all of the sudden every machine was pulling every hour at zero minutes and zero seconds. We had one minute of DDoS every day at noon for about a week until that was mitigated.

deleted 4y ago

[deleted]

cnorthwood 4y ago

When I worked at the BBC, there was a substantial proportion of all traffic to the homepage which were just some devices checking for an internet connection. I believe as part of the move to HTTPS-only there was serious discussion over whether or not there was a public service responsibility to not break some random devices out there, as moving from a 200 to 301 response on http://www.bbc.co.uk http://www.bbc.co.uk might have broken some things.

luckylion 4y ago
There should be official services for that. I'm sure Google (or in Germany, heise.de, which publishes multiple IT-related magazines since forever) sees a lot of that as well. The BBC's home page currently weighs in at around 45kb compressed or 230kb uncompressed. Imagine how much traffic is needlessly generated just by connectivity checks, not to speak of the amount of computing power.
- neurostimulant 4y ago
  Some internet connectivity check endpoints I see in my home networks: - http://detectportal.firefox.com http://detectportal.firefox.com - http://ping.manjaro.org/check_network_status.txt http://ping.manjaro.org/check_network_status.txt - http://connectivitycheck.gstatic.com/generate_204 http://connectivitycheck.gstatic.com/generate_204 - http://captive.apple.com http://captive.apple.com - http://www.msftconnecttest.com/connecttest.txt http://www.msftconnecttest.com/connecttest.txt - http://api.ipify.org http://api.ipify.org The manjaro one will respond with "NetworkManager is online" when accessed from curl, but redirect to manjaro homepage when accessed from a browser.
- xxpor 4y ago
  A good use case for using HEAD instead of GET
  - alex_suzuki 4y ago
    Ancient wisdom… easily forgotten.

United857 4y ago

Perhaps they just want to make it useful in the Chinese market where Google is blocked by the great firewall without having to have a separate firmware build just for that.

red-iron-pine 4y ago
that was my thought -- ping google, which is reachable in the Americas and Europe, and hit the Chinese and Russian sites that might limit Google. Guess you're out of luck in Turkmenistan, but works well enough most other places.

amelius 4y ago

> Is this bad engineering? Probably. Curious, how would you implement it?

iforgotpassword 4y ago

Yeah I sighed when I got to that point. You have no problem to expose your oven to the internet, but then a ping to Yandex or Baidu is taking it too far? If they wanted to exfiltrate data they'd surely find a way to piggyback it on the legitimate traffic to the cloud service they're using...

counttheforks 4y ago

They're actually making their money from negligence. If you plan to sell an internet connected device you better be prepared to to put care and effort into designing & maintaining it.

skibidibipiti 4y ago

[dead]

karmicthreat 4y ago

So what IS the correct way?