Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I stayed in a hotel with Android lightswitches and it was as bad as you'd think

mjg59.dreamwidth.org

Post reply on HN
Print view View original

161–170 of 325 posts

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#161

Post by manarth »

Johnny555 wrote: post #149
dsr_ wrote: post #123

Earlier quoted context omitted.

The security risk in an app-controlled sous vide machine includes starting a fire that burns your house down. - Sous vide normally uses a water bath at a controlled low temperature over a long period of time. - Hike the temperature up past the boiling point, and the water is evaporated, allowing you to hike the temperature up to ignition points. - Or, cycle the electronics fast enough to overload the power supply. If…

It seems unlikely that the device received a UL certification without a simple thermal cutoff switch that is common even in low-end cooking appliances. Even without deliberate hackers, the device needs to contend with software errors, running without water, or a stuck relay that could leave it boiling dry and overheating.

You just need to look at Therac-25 for a device which lacked hardware interlocks/cut-offs, had flawed/buggy software interlocks, and still received certification.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#162

Post by Klathmon »

mikeash wrote: post #153
Klathmon wrote: post #134

Earlier quoted context omitted.

Your nest is not built in this way... This is exactly the sentiment i was talking about though. If you buy a car that had a faulty AC unit, do you just swear off cars altogether because "they all have shitty AC"? Why do so many people like to bring up bugs/issues with poor iot devices and act like it is something that can't be improved or fixed?

I think it's because it's so prevalent. If your car had a faulty AC unit, you wouldn't swear off all cars, because most cars don't have that problem. But I feel like we're all still waiting for an Internet of Things Thing to show up that's actually done right. And it's been long enough that if nobody has done it right so far, it seems like a distinct possibility that nobody ever will.

>And it's been long enough that if nobody has done it right so far, it seems like a distinct possibility that nobody ever will.

But it hasn't been that long at all, and there are people doing it right.

The problem is that they are expensive and don't offer the same amount of features that some people want.

Take the "traditional" smarthome networks like z wave and friends.

I have a z wave light switch that works as a lightswitch 100% of the time. I actually installed the switches before i had a controller for them.

Add a controller and you have a "smarthome".

Connect that controller to your wifi and you have the ability to control these things safely from within your own network using anything from a bash script to shitty iphone apps.

Connect that network to the internet through a firewall and an authentication system and you now can control all of that stuff securely across the planet.

If any one of those breaks, functionality is reduced. Internet is down, i can't control it outside the house. Controller goes down, i can't control them as groups or from within the house but still "remotely". But it will literally always turn on/off the lights when i hit the switch. I don't need to worry about the security of a cheap chinese zwave knockoff thing because the controller is that gatekeeper.

That's IOT done right.

But people don't want to pay the money for that, they don't want to pay an electrician to come out and install them across the whole house, they don't care about security or what happens when the internet is down, they want a light they can control from their phone for as cheap as possible as fast as possible. And of course when people are asking for a product, manufacturers are going to make it.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#163

Post by jerf »

eloff wrote: post #5

Turning lights on at 3 a.m. is a nuisance. Knowing when lights go on and off can tell you when the people are not in their room - which could help if you wanted to break in and steal their stuff. Overall quite disconcerting how lax they are with security.

Turning the lights on a 3am is a nuisance. Writing

    while true; do turn_on_all_lights $IPADDRESS; done
is enough to ruin your night's sleep. Fighting with the lights that won't go off will probably pump enough adrenaline into your system to wake you up enough that you're not going back to sleep anytime soon.

And why not do that to the entire block of addresses you can reach, of course?

It's no "steal identity, rack up tens of thousands of debt" level of nuisance, but it's enough that some basic security is definitely called for. Given the capability of the devices on both side (i.e. we're not dealing with "embedded" 1MHz processors here), client and server side validation of SSL certificates on an SSL connection, combined with some basic physical security to detect that someone's pried the Android off the wall (this can be something like "seal" stickers; we're going for detection here more than prevention), would have had a pretty good cost/benefit ratio.

(Remember, the goal here isn't to make the security "perfect", merely to make hacking it more expensive than what is being protected, which in this case still isn't that much. Nobody's going to risk being physically fingered as the room that pried out the Android tablet just to screw with lights.)

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#164

Post by na85 »

forgetsusername wrote: post #150
Kliment wrote: post #8

Earlier quoted context omitted.

I think the implication was that some asshole can obtain photos of you sleeping by opening the curtains and switching on the lights in the middle of the night. A nuisance, sure, but also a massive violation of privacy.

> the implication was that some asshole can obtain photos of you sleeping by opening the curtains and switching on the lights in the middle of the night. So, somebody is going to set up shop across the way, in what is probably another commercial building, commit a couple of crimes, all to take a picture of some random, likely unidentifiable person sleeping in a hotel bed? Personally, I'm not very worried about that.…

How about setting up shop next door to get pics of $random_politician getting a blowjob for blackmail material?

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#165

Post by uptown »

forgetsusername wrote: post #150
Kliment wrote: post #8

Earlier quoted context omitted.

I think the implication was that some asshole can obtain photos of you sleeping by opening the curtains and switching on the lights in the middle of the night. A nuisance, sure, but also a massive violation of privacy.

> the implication was that some asshole can obtain photos of you sleeping by opening the curtains and switching on the lights in the middle of the night. So, somebody is going to set up shop across the way, in what is probably another commercial building, commit a couple of crimes, all to take a picture of some random, likely unidentifiable person sleeping in a hotel bed? Personally, I'm not very worried about that.…

You or I, probably not. But just this week Erin Andrews won a $55 million legal case where somebody had intentionally booked a room next-door to her hotel room, then modified the peephole to her room, in order to film her naked. Certainly, there's people intent on prying into the private lives of others.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#166

Post by SixSigma »

Klathmon wrote: post #97
corobo wrote: post #68

Earlier quoted context omitted.

Great my fridge just rebooted for a firmware update and bricked itself now the peas are rapidly defrosting and I am in a panic. Edit: Shoutout to Internet of Shit https://twitter.com/internetofshit

There are way to build things so that this isn't a problem. Modularize. It's easy to build it in a way so that the worst that the software can do is cause it to turn into a "dumb" fridge. My problem with this whole hatred of iot is that it's not productive. it's a bunch of people commenting how the trend is dumb and how everything was so much better in the past. Nobody ever gives suggestions on how to improve it, or…

having a $3500 fridge go dumb via updates made people very unhappy

http://motherboard.vice.com/read/smart-fridge-only-capable-o...

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#167

Post by takeda »

collyw wrote: post #46
joepie91_ wrote: post #23

Earlier quoted context omitted.

No. Bolt-on security doesn't work. It is either possible to do something securely and won't really take significantly more time, or it's not possible to do it securely at all, and no future update is going to fix it.

So why do I bother clicking "install updates" on machine every few days?

There's a difference in security issues due to programming bug vs insecure design.

If an application was created without security in mind in worst case it might require complete rewrite. In other cases it might be a whack-a-mole game.

For example compare ssh vs application that simply opens port and starts bash as root. You can use both to control your server, but if you want to add security it would be a lot of work (you could incrementally add authentication, encryption, maybe restrict user what s/he can do but there will be million and one ways to escape).

After fixing one issue after another without seeing the end you'll realize it would be less work to just rewrite it from scratch with security in mind.

Security is not a feature, it is a process.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#168

Post by Johnny555 »

manarth wrote: post #161
Johnny555 wrote: post #149

Earlier quoted context omitted.

It seems unlikely that the device received a UL certification without a simple thermal cutoff switch that is common even in low-end cooking appliances. Even without deliberate hackers, the device needs to contend with software errors, running without water, or a stuck relay that could leave it boiling dry and overheating.

You just need to look at Therac-25 for a device which lacked hardware interlocks/cut-offs, had flawed/buggy software interlocks, and still received certification.

You mean I only need to look back 35 years to a professional medical device built when computer control was still very new and that wasn't intended to be operated by unskilled consumers, and wasn't certified by to be safe for home use?

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#169

Post by thoughtsimple »

westi wrote: post #108
thoughtsimple wrote: post #75

Earlier quoted context omitted.

Just read over their FAQ. They claim that Modbus over TCP is an internet protocol. No where do they even mention security. I wonder how many devices are sitting on IPv4 addresses that are completely controllable over the net without a shred of security. Lovely.

Previously: https://blog.shodan.io/dont-be-clever/ > For example, you might know that Shodan crawls the Internet for industrial control systems (ICS). One of the most popular protocols in ICS is called Modbus that runs on port 502. At the moment, there are about 17,000 devices listening to Modbus on the default port. It turns out there are also 700 devices listening on port 503, again a one-off sort of situation. Pro…

Thanks. Exactly as bad as I expected.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#170

Post by na85 »

ajmurmann wrote: post #32
Navarr wrote: post #10

Earlier quoted context omitted.

Wouldn't the way to go about this be: Create an MVP (w/out much security) - get funding for the MVP, hire security experts, get over the obstacles?

I wonder if the competition wouldn't just skip the security, then beat you on the price because you are paying lots of money for security experts. Most customers don't care about/understand security and your company fails.

Hire Russian black hats to sabotage the competition?
Post reply on HN