Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I stayed in a hotel with Android lightswitches and it was as bad as you'd think

mjg59.dreamwidth.org

Post reply on HN
Print view View original

181–190 of 325 posts

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#181

Post by derefr »

thoughtsimple wrote: post #77
joezydeco wrote: post #60

Earlier quoted context omitted.

Perhaps the hotel's HVAC is running Modbus?

Could be. I just spent some time on the modbus.org site. I haven't looked in a while. There is pretty much no mention of security though they claim that Modbus over TCP is an internet protocol.

Given a completely static authentication realm like the rooms of a hotel, Modbus over TCP over IPSec would work just fine, and be transparent to the application. That sort of sounds like a good reason to be using Linux (Android) controllers in the first place; maybe they just forgot to enable it (or let go the installing contractors before their job was done, as soon as everything seemed to be "working.")

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#182

Post by massysett »

alexose wrote: post #16
westi wrote: post #4

This is the unfortunate outcome of a bunch of factors. OEMs moving to XXX over TCP protocols which have zero security by default and documenting this in the datasheets. VAR installers switching to the newer products because CAT5 cable is cheaper and easier to pull than what they used to use. The previous solution was just as insecure but harder to hack because you needed more specialised equipment. I'm not sure how w…

I couldn't agree more. It shouldn't surprise anyone that cheap outfits are cutting corners on something optional. Structural engineering solved these kinds of problems with building codes. While I'm not sure that's the answer here, I think most people would welcome guidance beyond "just put whatever devices you want on a shared network and hope for the best".

> Structural engineering solved these kinds of problems with building codes.

I'm guessing a lot of buildings and bridges had to collapse for codes to take hold. I hate to think about how many power grid shutdowns and crashing cars we will have to go through. Clearly the routine theft of personal data has not made enough of an impact to improve security.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#183

Post by Someone »

ams6110 wrote: post #174
jerf wrote: post #163

Earlier quoted context omitted.

Turning the lights on a 3am is a nuisance. Writing while true; do turn_on_all_lights $IPADDRESS; done is enough to ruin your night's sleep. Fighting with the lights that won't go off will probably pump enough adrenaline into your system to wake you up enough that you're not going back to sleep anytime soon. And why not do that to the entire block of addresses you can reach, of course? It's no "steal identity, rack up…

Given the capability of the devices on both side ... Your're not wrong, but the other point is they are swatting a fly with a sledgehammer. What wrong with a simple light switch for gods sake. Why would a hotel spend hundreds of dollars to do what a $2 device can do more reliably and securely?

There might be significant cost savings in the ability to power off a room remotely instead of having to send someone over when a guest checks out. I would be more worried about the tv, the faucets and air conditioning, though.

Also, some hotels manage to have the tv showing a welcome message when you enter.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#184

Post by protomyth »

na85 wrote: post #164
forgetsusername wrote: post #150

Earlier quoted context omitted.

> the implication was that some asshole can obtain photos of you sleeping by opening the curtains and switching on the lights in the middle of the night. So, somebody is going to set up shop across the way, in what is probably another commercial building, commit a couple of crimes, all to take a picture of some random, likely unidentifiable person sleeping in a hotel bed? Personally, I'm not very worried about that.…

How about setting up shop next door to get pics of $random_politician getting a blowjob for blackmail material?

Or taking a shot at the clearly surprised and now well lit individual.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#185

Post by st3v3r »

ams6110 wrote: post #174
jerf wrote: post #163

Earlier quoted context omitted.

Turning the lights on a 3am is a nuisance. Writing while true; do turn_on_all_lights $IPADDRESS; done is enough to ruin your night's sleep. Fighting with the lights that won't go off will probably pump enough adrenaline into your system to wake you up enough that you're not going back to sleep anytime soon. And why not do that to the entire block of addresses you can reach, of course? It's no "steal identity, rack up…

Given the capability of the devices on both side ... Your're not wrong, but the other point is they are swatting a fly with a sledgehammer. What wrong with a simple light switch for gods sake. Why would a hotel spend hundreds of dollars to do what a $2 device can do more reliably and securely?

Prestige.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#186

Post by mordocai »

ams6110 wrote: post #174
jerf wrote: post #163

Earlier quoted context omitted.

Turning the lights on a 3am is a nuisance. Writing while true; do turn_on_all_lights $IPADDRESS; done is enough to ruin your night's sleep. Fighting with the lights that won't go off will probably pump enough adrenaline into your system to wake you up enough that you're not going back to sleep anytime soon. And why not do that to the entire block of addresses you can reach, of course? It's no "steal identity, rack up…

Given the capability of the devices on both side ... Your're not wrong, but the other point is they are swatting a fly with a sledgehammer. What wrong with a simple light switch for gods sake. Why would a hotel spend hundreds of dollars to do what a $2 device can do more reliably and securely?

I think you are talking thousands not hundreds. They had to pay people to set it up, pay for tablets for every room, and pay for the control devices too.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#187

Post by finnn »

DasIch wrote: post #158
chippy wrote: post #35

Earlier quoted context omitted.

Except they a) know where the room is anyhow and b) GPS doesn't tend to work very well indoors

Depends on how targeted the attack is. A hacker who is bored and is searching Shodan for what entertainment the IoT is offering might find GPS quite useful.

It's on a private subnet. You'd have to have some way to get onto the hotel's internal network. The one described in the post is being physically at the hotel. Now, there might be other ways, but this most likely isn't about to show up on shodan.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#188

Post by marcosdumay »

mortenjorck wrote: post #175

There’s nothing inherently wrong with a touchscreen, IoT light switch. But the main problem here, apart from using an insecure legacy protocol, is the use of a general-purpose OS like Android instead of an embedded OS. It’s not just this light switch – Android refrigerators, Android ovens, Android washing machines are all using a wildly inappropriate operating system for single-purpose devices. The problem is likely…

Yes, there is. Touchscreens lack tactile feedback, and for stuff that one must manipulate on the dark (like a light switch), that's a very important flaw.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#189

Post by thoughtsimple »

vacri wrote: post #178
thoughtsimple wrote: post #33

I'm amused by the use of Modbus. I worked on Modbus networking back in the 1980's at Modicon (a company that disappeared long ago that created the "standard"). Using a protocol invented before the internet to control devices on a semi-public network is insane. The original Modbus was designed to communicate with factory devices controlled by logic controllers over serial and eventually over a custom token ring networ…

> Using a protocol invented before the internet to control devices on a semi-public network is insane. Using Modbus may be insane, but Internet Protocol (IP) predates it by 5 years.

Modbus is an application layer protocol. Different things. It's more akin to HTTP than IP.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#190

Post by st3v3r »

JustSomeNobody wrote: post #84

I don't see what this gains the hotel. You get an increase in complaints/request about not being able to turn on/off lights, etc. Standard light switches are dirt cheap and last years and everyone from age 2 up knows how to use them. Is this solely to look "fancy"? If so, then at least get the tech right otherwise you look incompetent.

"Is this solely to look "fancy"? If so, then at least get the tech right otherwise you look incompetent."

How many of their guests have thought it looked fancy? Probably a lot. How many of their guests have done something similar to what this guy did? Probably not so much.

Post reply on HN