50 ms·

Oh yeah, for some reason the companies with the highest risk products seem to be the ones that care less about security. Don't even get me started with "smart"

by hootz 4mo ago

Oh yeah, for some reason the companies with the highest risk products seem to be the ones that care less about security. Don't even get me started with "smart" bulbs and cameras that each individually connect to your local network and the Internet. You have 5 lightbulbs? That's 5 different devices you need to track, keep updated and trust the in the vendor firmware's security.

zahlman 4mo ago
> "smart" bulbs Thankfully I don't think I've seen these for sale. What sensors would they have that could be exploited by an attacker?
- zeta0134 4mo ago
  Shopping in the US, these have entirely replaced zigbee and other sensible mesh-based options at hardware stores like Home Depot and Lowes. The only exception I can find is Phillips Hue, and those seem to be slowly getting phased out with (sigh) a new "hubless" (requires wifi) series. I run my home automation network entirely offline, so anything that needs the internet doesn't get added to my cart. I just do not trust the security of these IoT vendors at all, and refuse to have their nonsense cluttering up my limited network bandwidth and causing unknown problems. (Edit: maybe not obvious, this is in the "smart bulbs" product category. Regular bulbs are still much more common on store shelves, because why fix what isn't broken? Most people don't need to automate their light bulbs.)
  - sebastiennight 4mo ago
    > Regular bulbs are still much more common on store shelves, because why fix what isn't broken? TV manufacturers might want to differ.
    - samtheDamned 4mo ago
      If we could started teaching Morse Code in standard curriculum then in about 18 years or so we could finally subsidize smart lightbulbs with blinking ads for products and then we could stop selling pesky "dumb" bulbs.
      - sebastiennight 4mo ago
        You're underestimating the potential of subsidizing smart bulbs with data collection. Someone smart is getting paid a lot right now somewhere to figure this out.
    - efreak 4mo ago
      A light bulb doesn't require a processor to turn on and off when power is applied, so the only reason to add one is for extra functionality. A TV requires a (relatively) powerful processor just for decoding the signal.
  - zahlman 4mo ago
    > I run my home automation network entirely offline, so anything that needs the internet doesn't get added to my cart. Absolutely support you in that. I don't really feel the urge to automate appliances around me in the first place, though. I feel like I'd just be locking myself into the schedule I'd automated, building my life around it. What good is free time without freedom?
- duckmysick 4mo ago
  You don't need to exploit sensors. If a compromised device is connected to the internet (because the vendor app requires it to set up and control), you can use it as a part of botnet with a nice residential IP address.
  - zahlman 4mo ago
    ... Why does it have anywhere near the level of computing power that a botnet would find useful?
    - Nasrudith 4mo ago
      Guess what the big bottleneck is in a DDOS? Not the computing power.
- hgoel 4mo ago
  You can find a lot of literature out there for tracking people based on WiFi signal strength. The very thing they use to connect ends up being a sensor that gives away some pretty critical info.
- RobMurray 4mo ago
  wifi, bluetooth, and microphones. Yes microphones. I have a very cheap smart bulb with a mode that responds to music. That's not even unusual for smart bulbs.

by hootz 4mo ago

zahlman 4mo ago

> "smart" bulbs Thankfully I don't think I've seen these for sale. What sensors would they have that could be exploited by an attacker?

zeta0134 4mo ago
Shopping in the US, these have entirely replaced zigbee and other sensible mesh-based options at hardware stores like Home Depot and Lowes. The only exception I can find is Phillips Hue, and those seem to be slowly getting phased out with (sigh) a new "hubless" (requires wifi) series. I run my home automation network entirely offline, so anything that needs the internet doesn't get added to my cart. I just do not trust the security of these IoT vendors at all, and refuse to have their nonsense cluttering up my limited network bandwidth and causing unknown problems. (Edit: maybe not obvious, this is in the "smart bulbs" product category. Regular bulbs are still much more common on store shelves, because why fix what isn't broken? Most people don't need to automate their light bulbs.)
- sebastiennight 4mo ago
  > Regular bulbs are still much more common on store shelves, because why fix what isn't broken? TV manufacturers might want to differ.
  - samtheDamned 4mo ago
    If we could started teaching Morse Code in standard curriculum then in about 18 years or so we could finally subsidize smart lightbulbs with blinking ads for products and then we could stop selling pesky "dumb" bulbs.
    - sebastiennight 4mo ago
      You're underestimating the potential of subsidizing smart bulbs with data collection. Someone smart is getting paid a lot right now somewhere to figure this out.
  - efreak 4mo ago
    A light bulb doesn't require a processor to turn on and off when power is applied, so the only reason to add one is for extra functionality. A TV requires a (relatively) powerful processor just for decoding the signal.
- zahlman 4mo ago
  > I run my home automation network entirely offline, so anything that needs the internet doesn't get added to my cart. Absolutely support you in that. I don't really feel the urge to automate appliances around me in the first place, though. I feel like I'd just be locking myself into the schedule I'd automated, building my life around it. What good is free time without freedom?
duckmysick 4mo ago
You don't need to exploit sensors. If a compromised device is connected to the internet (because the vendor app requires it to set up and control), you can use it as a part of botnet with a nice residential IP address.
- zahlman 4mo ago
  ... Why does it have anywhere near the level of computing power that a botnet would find useful?
  - Nasrudith 4mo ago
    Guess what the big bottleneck is in a DDOS? Not the computing power.
hgoel 4mo ago
You can find a lot of literature out there for tracking people based on WiFi signal strength. The very thing they use to connect ends up being a sensor that gives away some pretty critical info.
RobMurray 4mo ago
wifi, bluetooth, and microphones. Yes microphones. I have a very cheap smart bulb with a mode that responds to music. That's not even unusual for smart bulbs.