44 ms·

Eh. It's certainly not great practice though not stunning given how utter crap 99% of IOT WiFi seems to be. That said the author gets a bit overdone, and not ju

by xoa 4y ago

Eh. It's certainly not great practice though not stunning given how utter crap 99% of IOT WiFi seems to be. That said the author gets a bit overdone, and not just in brushing over the physical access requirement bit. >Storing passwords in plain text is a major security risk in hotels or businesses using the devices on their internal or private wireless networks, giving any potential attackers access to any other equipment on this network or allowing them to create a rogue network and redirect traffic or conduct a MITM (man-in-the-middle) attack. Nah, unless it's a truly awful network even for a prosumer let alone any organization. Even with IOT, ever more widespread PPSK support (which I'd consider a must have for anything greenfield at this point) makes segmenting devices onto their own tightly firewalled VLANs trivial. Normal user interactive devices (computers, smartphones, tablets etc) should all be using VPNs for internal access and just not trust the WiFi at all, or at the least again have their own VLANs. These devices should all support WPA-EAP as well so that's another option, and can just use certs and do away with passwords entirely. If IOT wasn't such crap that'd be an option there too but such is life. It would be fair to say this is all still more complex then it should be, all the tech pieces are in place to make this vastly easier even for the non-technical, the UX is poor in a bunch of respects. And I'm sure there are plenty of small businesses who just run flat networks, maybe with a guest wifi. But that's an issue anyway, and I don't think someone physically stealing an Echo and dumping its eMMC to get at their WiFi password is floor level on their threat model. More like "the desk machine has a password of abc123 and is left unlocked while the elderly B&B lady goes and makes breakfast for guests" and frankly who is breaking in looking for that anyway? It's egg on Amazon's face for sure, absolutely embarrassing for a company of that size and product line that big, and that it's exposed in plaintext on the fs might chain a remote exploit in interesting ways, but not if physical access is required. And again, organizations actually facing threats really just shouldn't be trusting WiFi much anyway. It's not that secure even in theory and implementations are a mess and probably always will be.

Dragon863 4y ago
Thanks for the feedback! It's the first time I've written anything like this, and I'm currently studying computer science so I appreciate the corrections as they help me improve my knowledge of the field :)
- xoa 4y ago
  No problem, good for you both for digging into it at all and then actually writing it all out, good little exercise to go through and poke at for sure! Network security is its own entire other specialization and despite working in it there's always new stuff to learn and new challenges. And the mess and issues of the WiFi standards process is an entire book itself. I guess the one generalist suggestion I'd have for you just for security overall is to always try to consider the overall threat scenario and "economics" of given attacks when judging seriousness for clients. It's easy to theorycraft purely in terms of hardware or software and get lost in the weeds of attacks that don't actually make any sense. All "security" overall is about the economics between how much it costs to defend and attack and what the value gained/lost is. So things that scale very well, like pure software remote exploits, are huge risks since somebody can run attacks near or fully automatically dirt cheap/free at mass scale and do so in a way that can be hard to trace back. Thus even those with very few resources are at risk, if the attack is free to the attacker then anything at all is profit. In contrast an attack that requires in person access doesn't scale at all, it must be done each time by an actual human actually going out there. And that entails major physical risks as well. So while expensive to defend against, it's also expensive to execute and thus won't happen unless a lot of value is available, and naturally individuals/organizations in that position (lots of money or high value assets) tend to have the resources themselves to take action. Anyway, "engineering is the art of the possible", getting the best bang for the buck matched to what clients or employers need sometimes is part of the real challenge. Good luck with everything!

by xoa 4y ago

Dragon863 4y ago

Thanks for the feedback! It's the first time I've written anything like this, and I'm currently studying computer science so I appreciate the corrections as they help me improve my knowledge of the field :)

xoa 4y ago
No problem, good for you both for digging into it at all and then actually writing it all out, good little exercise to go through and poke at for sure! Network security is its own entire other specialization and despite working in it there's always new stuff to learn and new challenges. And the mess and issues of the WiFi standards process is an entire book itself. I guess the one generalist suggestion I'd have for you just for security overall is to always try to consider the overall threat scenario and "economics" of given attacks when judging seriousness for clients. It's easy to theorycraft purely in terms of hardware or software and get lost in the weeds of attacks that don't actually make any sense. All "security" overall is about the economics between how much it costs to defend and attack and what the value gained/lost is. So things that scale very well, like pure software remote exploits, are huge risks since somebody can run attacks near or fully automatically dirt cheap/free at mass scale and do so in a way that can be hard to trace back. Thus even those with very few resources are at risk, if the attack is free to the attacker then anything at all is profit. In contrast an attack that requires in person access doesn't scale at all, it must be done each time by an actual human actually going out there. And that entails major physical risks as well. So while expensive to defend against, it's also expensive to execute and thus won't happen unless a lot of value is available, and naturally individuals/organizations in that position (lots of money or high value assets) tend to have the resources themselves to take action. Anyway, "engineering is the art of the possible", getting the best bang for the buck matched to what clients or employers need sometimes is part of the real challenge. Good luck with everything!