5 ms·

It's proprietary but relatively easy to reverse engineer, the details are out there. In the US it uses like 914.5 MHz or something, and I can send instructions

It's proprietary but relatively easy to reverse engineer, the details are out there. In the US it uses like 914.5 MHz or something, and I can send instructions to devices with an extremely simple serial protocol on my computer. No Bluetooth, no Wi-Fi, no protocol sophisticated enough to distribute code. Just locally transmitted instructions.

kube-system 2y ago
Do they require auth and use solid crypto? If not, they are vulnerable, it's just that the vulnerability requires the attacker to be within range. People thought old analog 900mhz cordless phones were fine until others realized you could just tune a radio to that freq and listen to your neighbors.
- ocdtrekkie 2y ago
  They're not vulnerable in any way that matters. If you manage to get a device in range you can... turn my lights on and off? You can't program them to do malicious things over the Internet. They don't have any sensitive information you can access. There's no damage you can do them. The problem with saying you need auth and crypto is now you just added a bunch of complexity you have to maintain and update and hence now you've introduced vulnerabilities.
  - kube-system 2y ago
    Sure, keeping things offline and vulnerable to only local attackers is a valid security posture for some. But the 'I' in IoT is for internet. "Don't build IoT devices" is not a helpful proposal to increase the security of IoT devices, which is the scope of this initiative.
    - ocdtrekkie 2y ago
      Eh. Debateable. I can control them over the Internet, I am just not delegating Internet access directly to cheap consumer electronics, which simply put, shouldn't be done. I would argue the crisis of IoT security is caused largely by poor IoT design.
      - kube-system 2y ago
        > I am just not delegating Internet access directly to cheap consumer electronics, which simply put, shouldn't be done. Yeah, but most people are going to do that. Most people aren't security-conscious professionals, and they do like cheap things. In a hypothetical reality where home networks were better designed to accommodate remote access, we wouldn't have this problem. And for those of us who can configure networks to be securely accessed remotely, there are definitely better ways to do things. But that isn't the reality of the landscape of consumer IoT -- which is that people expect to buy a cheap device, connect it to the wifi network of any consumer wifi router, and have it work out of the box. They are already buying these devices regardless of whether they are secure, and will continue to do so. This initiative is about encouraging reasonable incremental changes to the existing reality. If the requirements for this label were drastic enough that they required people to secure the devices behind behind a firewall, store data locally, and provide remote access only with an inbound VPN or something like that, it would simply be ignored by manufacturers and would have zero impact. Because vanishingly few people are going to replace their Comcast modem/router just to install some IoT device. To most people, they "get wifi" from their ISP. The concept of "reconfiguring a home network" is a nonstarter. Whatever the ISP provides is what normal people use, by default.
        ocdtrekkie 2y ago
        You missed my point. On the contrary, having every light switch in the house need its own network stack is not just insecure, it's overengineered and expensive. It's fine to have a computer or "gateway" device that calls outbound to a server for outside access, no firewall rules or VPN required. The point is there should only be one point of contact with the outside world, and that's a tech device with enough power to update, secure, etc. As Wi-Fi standards and such change, people should expect to replace it. Hardware in and on your walls should be dumb, cheap, and long-lasting. Insteon's technology hasn't substantially changed in twenty years, most of my smarthome hardware is over ten years old, and is no less secure or current than when I installed it. And of course, all of it works just like a "dumb" counterpart when the Internet is down or there's no smarthome controller involved. This should be cheaper at scale than "wi-fi smart outlets", if they aren't selling your data to offset the cost.
  - reverendsteveii 2y ago
    >If you manage to get a device in range you can... turn my lights on and off? Is that all it's capable of or all you use it for?
    - ocdtrekkie 2y ago
      So the highest risk device on my RF network is my thermostat. But not only do I get alerts for out of range conditions, the beauty of the local attacker model is most types of attacks become silly: The thermostat has a predefined range of relatively normal temperatures, so the only way to really cause damage is turning it off. You could bring a custom-programmed RF transceiver and plant it on my property for the job, or you could use a $5 wrench to shut off my natural gas and pull the power shutoff on my AC condenser. I think the latter is infinitely more likely.
      - reverendsteveii 2y ago
        this is a great example of defense in depth. there are several factors limiting how vulnerable the device is and what can actually be done with it once exploited.
        ocdtrekkie 2y ago
        Thanks! This is something every company producing smart-stuff should be thinking about, though unfortunately I think many do not. ;)

kube-system 2y ago

Do they require auth and use solid crypto? If not, they are vulnerable, it's just that the vulnerability requires the attacker to be within range. People thought old analog 900mhz cordless phones were fine until others realized you could just tune a radio to that freq and listen to your neighbors.

ocdtrekkie 2y ago
They're not vulnerable in any way that matters. If you manage to get a device in range you can... turn my lights on and off? You can't program them to do malicious things over the Internet. They don't have any sensitive information you can access. There's no damage you can do them. The problem with saying you need auth and crypto is now you just added a bunch of complexity you have to maintain and update and hence now you've introduced vulnerabilities.
- kube-system 2y ago
  Sure, keeping things offline and vulnerable to only local attackers is a valid security posture for some. But the 'I' in IoT is for internet. "Don't build IoT devices" is not a helpful proposal to increase the security of IoT devices, which is the scope of this initiative.
  - ocdtrekkie 2y ago
    Eh. Debateable. I can control them over the Internet, I am just not delegating Internet access directly to cheap consumer electronics, which simply put, shouldn't be done. I would argue the crisis of IoT security is caused largely by poor IoT design.
    - kube-system 2y ago
      > I am just not delegating Internet access directly to cheap consumer electronics, which simply put, shouldn't be done. Yeah, but most people are going to do that. Most people aren't security-conscious professionals, and they do like cheap things. In a hypothetical reality where home networks were better designed to accommodate remote access, we wouldn't have this problem. And for those of us who can configure networks to be securely accessed remotely, there are definitely better ways to do things. But that isn't the reality of the landscape of consumer IoT -- which is that people expect to buy a cheap device, connect it to the wifi network of any consumer wifi router, and have it work out of the box. They are already buying these devices regardless of whether they are secure, and will continue to do so. This initiative is about encouraging reasonable incremental changes to the existing reality. If the requirements for this label were drastic enough that they required people to secure the devices behind behind a firewall, store data locally, and provide remote access only with an inbound VPN or something like that, it would simply be ignored by manufacturers and would have zero impact. Because vanishingly few people are going to replace their Comcast modem/router just to install some IoT device. To most people, they "get wifi" from their ISP. The concept of "reconfiguring a home network" is a nonstarter. Whatever the ISP provides is what normal people use, by default.
      - ocdtrekkie 2y ago
        You missed my point. On the contrary, having every light switch in the house need its own network stack is not just insecure, it's overengineered and expensive. It's fine to have a computer or "gateway" device that calls outbound to a server for outside access, no firewall rules or VPN required. The point is there should only be one point of contact with the outside world, and that's a tech device with enough power to update, secure, etc. As Wi-Fi standards and such change, people should expect to replace it. Hardware in and on your walls should be dumb, cheap, and long-lasting. Insteon's technology hasn't substantially changed in twenty years, most of my smarthome hardware is over ten years old, and is no less secure or current than when I installed it. And of course, all of it works just like a "dumb" counterpart when the Internet is down or there's no smarthome controller involved. This should be cheaper at scale than "wi-fi smart outlets", if they aren't selling your data to offset the cost.
- reverendsteveii 2y ago
  >If you manage to get a device in range you can... turn my lights on and off? Is that all it's capable of or all you use it for?
  - ocdtrekkie 2y ago
    So the highest risk device on my RF network is my thermostat. But not only do I get alerts for out of range conditions, the beauty of the local attacker model is most types of attacks become silly: The thermostat has a predefined range of relatively normal temperatures, so the only way to really cause damage is turning it off. You could bring a custom-programmed RF transceiver and plant it on my property for the job, or you could use a $5 wrench to shut off my natural gas and pull the power shutoff on my AC condenser. I think the latter is infinitely more likely.
    - reverendsteveii 2y ago
      this is a great example of defense in depth. there are several factors limiting how vulnerable the device is and what can actually be done with it once exploited.
      - ocdtrekkie 2y ago
        Thanks! This is something every company producing smart-stuff should be thinking about, though unfortunately I think many do not. ;)