4 ms·

It Looks Like a School Bathroom Smoke Detector. It Could Be an Audio Bug

17 points by pkaeding 1y ago

pkaeding 1y ago
https://archive.ph/kEJco https://archive.ph/kEJco
deleted 1y ago
[deleted]
Hizonner 1y ago
If I recall correctly, the obviously incompetent clowns responsible for this device make most of their money in radio systems for public safety and critical industrial uses.
Animats 1y ago
Here's the administrator's manual for the thing.[1] Connecting to a HALO device can be done in two separate ways. It can be done with the HALO Device Manager HDM (see HDM Manual) which is the preferred method for setting up multiple HALOs at once. It can also be done by typing the HALO device’s IP address in Google Chrome. A popup will appear asking for a username and password. Type “admin” for the username and “changeme” for the password. Click “Sign in”. What could possibly go wrong? [1] https://www.dickerdata.com.au/hubfs/%2B%20New%20Zealand/%2B%20Connect%20Website%20Assets/Connect%20Knowledgebase%20Assets/Fire/Halo%20Smart%20Sensor/HALO-AdminGuide-2.9.0.10-20231009-.pdf https://www.dickerdata.com.au/hubfs/%2B%20New%20Zealand/%2B%...
ManuelKiessling 1y ago
I had a scary (and hopefully illogical) thought today: what’s stopping threat actors from selling SSDs that are „pimped“ with a SIM-card and some additional stuff, and phone home „interesting“ pieces from said SSD?
- arcfour 1y ago
  The fact that it would be extremely expensive to do so for what could amount to $0 worth of valuable information for months or years, if ever?
  - cluckindan 1y ago
    Looks like a reminder is due: https://www.bloomberg.com/features/2021-supermicro/ https://www.bloomberg.com/features/2021-supermicro/
    - arcfour 1y ago
      I don't think that is in any way related to the original comment.
      - cluckindan 1y ago
        Sure it is. There are plenty of players out there willing to invest in a long game of chance, if the potential payout is intelligence.
        arcfour 1y ago
        They sure bungled that one then!
- incone123 1y ago
  In the movies they usually sneak in and replace your genuine gadget with a modified one. more effective use of resources.
  - eurleif 1y ago
    The NSA is said to have intercepted packages bound for surveillance targets, opened them, modified the electronics inside, then taped them back up and sent them on their way: https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...
- yjftsjthsd-h 1y ago
  Don't at least Windows and macOS encrypt the main drive by default these days, such that the SSD never sees anything interesting?

17 points by pkaeding 1y ago

pkaeding 1y ago

https://archive.ph/kEJco https://archive.ph/kEJco

deleted 1y ago

[deleted]

Hizonner 1y ago

If I recall correctly, the obviously incompetent clowns responsible for this device make most of their money in radio systems for public safety and critical industrial uses.

Animats 1y ago

Here's the administrator's manual for the thing.[1] Connecting to a HALO device can be done in two separate ways. It can be done with the HALO Device Manager HDM (see HDM Manual) which is the preferred method for setting up multiple HALOs at once. It can also be done by typing the HALO device’s IP address in Google Chrome. A popup will appear asking for a username and password. Type “admin” for the username and “changeme” for the password. Click “Sign in”. What could possibly go wrong? [1] https://www.dickerdata.com.au/hubfs/%2B%20New%20Zealand/%2B%20Connect%20Website%20Assets/Connect%20Knowledgebase%20Assets/Fire/Halo%20Smart%20Sensor/HALO-AdminGuide-2.9.0.10-20231009-.pdf https://www.dickerdata.com.au/hubfs/%2B%20New%20Zealand/%2B%...

ManuelKiessling 1y ago

I had a scary (and hopefully illogical) thought today: what’s stopping threat actors from selling SSDs that are „pimped“ with a SIM-card and some additional stuff, and phone home „interesting“ pieces from said SSD?

arcfour 1y ago
The fact that it would be extremely expensive to do so for what could amount to $0 worth of valuable information for months or years, if ever?
- cluckindan 1y ago
  Looks like a reminder is due: https://www.bloomberg.com/features/2021-supermicro/ https://www.bloomberg.com/features/2021-supermicro/
  - arcfour 1y ago
    I don't think that is in any way related to the original comment.
    - cluckindan 1y ago
      Sure it is. There are plenty of players out there willing to invest in a long game of chance, if the potential payout is intelligence.
      - arcfour 1y ago
        They sure bungled that one then!
incone123 1y ago
In the movies they usually sneak in and replace your genuine gadget with a modified one. more effective use of resources.
- eurleif 1y ago
  The NSA is said to have intercepted packages bound for surveillance targets, opened them, modified the electronics inside, then taped them back up and sent them on their way: https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...
yjftsjthsd-h 1y ago
Don't at least Windows and macOS encrypt the main drive by default these days, such that the SSD never sees anything interesting?