3 ms·

The vulnerability was in their backend cloud structure. The backend wasn't restricting access to only devices associated with your account. > Out of sheer lazi

The vulnerability was in their backend cloud structure. The backend wasn't restricting access to only devices associated with your account. > Out of sheer laziness, I connected to the Mysa MQTT server and subscribed to the match-everything wildcard topic, #. I was hoping I’d see messages from a few more MQTT topics, giving me more information about my Mysa devices. > Instead, I started receiving a torrent of messages from every single Internet-connected production Mysa device in the whole world. The devices had unique IDs, but they were all connected to one big MQTT pub/sub system that didn't even try to isolate anything. It's lazy backend development. This happens often in IoT products where they hire some consultant or agency to develop a proof of concept, the agency makes a prototype without any security considerations, and then they call it done because it looks like it works. To an uninformed tester who only looks at the app it appears secure because they had to type in their password.

JoshTriplett 9mo ago
> The vulnerability was in their backend cloud structure. The vulnerability is in having a backend cloud structure. (There are plenty of ways to provide remote access without that, and no other feature warrants it.)
- jcgrillo 9mo ago
  Not sure why this is being downvoted, it's a pervasive flaw across all these IoT products. See my description elsewhere here about how Haier "smart" controls work. It's completely insane, and pointless. For systems that can't fail--I include heating systems in the winter--this kind of "move fast and break shit" way of doing it is malpractice. The last thing in the entire world I want my furnace controls doing is an automatic OTA firmware update. Ever.
  - JoshTriplett 9mo ago
    Exactly. I want a "smart thermostat" that's entirely under my control, not the manufacturer's.
    - bethekidyouwant 9mo ago
      But then you would have to configure something on your router and have dynamic dns for remote access and that’s too hard.
      - nerdsniper 9mo ago
        Sell an additional $200 box containing a Raspberry Pi with Home Assistant on it and a cheap capacitive touchscreen and pre-configure it with Tailscale. Would be reasonably consumer-friendly. Give it a fancy name and start slapping "{$HOME_ASSISTANT} Compatible" branding logos on partners boxes. If it's not quite as consumer-friendly as you want it to be, contribute your engineering hours to the Home Assistant product until it is. Bonus points for giving it 25-250W audio output to power speakers and letting you pair them together to play music in sync across different rooms of your house connected to speakers of your choice.
        devilbunny 9mo ago
        Market size: approximately zero. The number of people who 1) really want local-only control and 2) can deal with Home Assistant and Tailscale but 3) don't actually have the skill set to put together a Raspberry Pi or other small Linux box and set up HA and TS themselves is tiny. The cloud systems are insecure and invasive, but it's really hard to get Normal People to understand why it's a problem. "So someone can tell if I'm not home; so what? I live in a gated community, they can't just drive in at night and burgle the house." They're not entirely wrong about that; it is unlikely. The hard push for subscription services by these companies has turned out to be the best way to push people into locally hosted alternatives, because they don't want to pay for another service, but the usual approach is just to do without the service when they realize that the "smart" functions are not that useful. Most people don't have the free time, knowledge, or inclination to set up and maintain Home Assistant. They can appreciate it when they see it done well, but they aren't going to pay for a professional installation and maintenance and they aren't able to do it themselves.
        jcgrillo 9mo ago

JoshTriplett 9mo ago

> The vulnerability was in their backend cloud structure. The vulnerability is in having a backend cloud structure. (There are plenty of ways to provide remote access without that, and no other feature warrants it.)

jcgrillo 9mo ago
Not sure why this is being downvoted, it's a pervasive flaw across all these IoT products. See my description elsewhere here about how Haier "smart" controls work. It's completely insane, and pointless. For systems that can't fail--I include heating systems in the winter--this kind of "move fast and break shit" way of doing it is malpractice. The last thing in the entire world I want my furnace controls doing is an automatic OTA firmware update. Ever.
- JoshTriplett 9mo ago
  Exactly. I want a "smart thermostat" that's entirely under my control, not the manufacturer's.
  - bethekidyouwant 9mo ago
    But then you would have to configure something on your router and have dynamic dns for remote access and that’s too hard.
    - nerdsniper 9mo ago
      Sell an additional $200 box containing a Raspberry Pi with Home Assistant on it and a cheap capacitive touchscreen and pre-configure it with Tailscale. Would be reasonably consumer-friendly. Give it a fancy name and start slapping "{$HOME_ASSISTANT} Compatible" branding logos on partners boxes. If it's not quite as consumer-friendly as you want it to be, contribute your engineering hours to the Home Assistant product until it is. Bonus points for giving it 25-250W audio output to power speakers and letting you pair them together to play music in sync across different rooms of your house connected to speakers of your choice.
      - devilbunny 9mo ago
        Market size: approximately zero. The number of people who 1) really want local-only control and 2) can deal with Home Assistant and Tailscale but 3) don't actually have the skill set to put together a Raspberry Pi or other small Linux box and set up HA and TS themselves is tiny. The cloud systems are insecure and invasive, but it's really hard to get Normal People to understand why it's a problem. "So someone can tell if I'm not home; so what? I live in a gated community, they can't just drive in at night and burgle the house." They're not entirely wrong about that; it is unlikely. The hard push for subscription services by these companies has turned out to be the best way to push people into locally hosted alternatives, because they don't want to pay for another service, but the usual approach is just to do without the service when they realize that the "smart" functions are not that useful. Most people don't have the free time, knowledge, or inclination to set up and maintain Home Assistant. They can appreciate it when they see it done well, but they aren't going to pay for a professional installation and maintenance and they aren't able to do it themselves.
        jcgrillo 9mo ago