Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I stayed in a hotel with Android lightswitches and it was as bad as you'd think

mjg59.dreamwidth.org

Post reply on HN
Print view View original

221–230 of 325 posts

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#221

Post by ocdtrekkie »

Klathmon wrote: post #162
mikeash wrote: post #153

Earlier quoted context omitted.

I think it's because it's so prevalent. If your car had a faulty AC unit, you wouldn't swear off all cars, because most cars don't have that problem. But I feel like we're all still waiting for an Internet of Things Thing to show up that's actually done right. And it's been long enough that if nobody has done it right so far, it seems like a distinct possibility that nobody ever will.

>And it's been long enough that if nobody has done it right so far, it seems like a distinct possibility that nobody ever will. But it hasn't been that long at all, and there are people doing it right. The problem is that they are expensive and don't offer the same amount of features that some people want. Take the "traditional" smarthome networks like z wave and friends. I have a z wave light switch that works as a…

Indeed, I'm quite happy with my INSTEON system. They're stylish, high quality in wall switches, they have a very reliable (though unfortunately proprietary) communications protocol. The serial and USB adapters for them are easy to code for and there's a variety of third party control programs available. I'm writing my own actually. They also now have a cloud hub for people who want that sort of thing.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#222

Post by mdk754 »

thoughtsimple wrote: post #33

I'm amused by the use of Modbus. I worked on Modbus networking back in the 1980's at Modicon (a company that disappeared long ago that created the "standard"). Using a protocol invented before the internet to control devices on a semi-public network is insane. The original Modbus was designed to communicate with factory devices controlled by logic controllers over serial and eventually over a custom token ring networ…

Modbus is still very common in ECUs. I work for a telematics company and Modbus is probably our 2nd biggest bus protocol next to CAN(J1939).

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#223

Post by syntheticnature »

pidg wrote: post #171
eric_h wrote: post #124

Earlier quoted context omitted.

> You'd need to access the balcony Or a camera equipped drone.

This is starting to sound like the plot of an NCIS episode.

Or CSI: Cyber, except they need to add something brain-breakingly wrong to those of us in the know for that.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#224

Post by kogepathic »

pjkundert wrote: post #208
thoughtsimple wrote: post #33

I'm amused by the use of Modbus. I worked on Modbus networking back in the 1980's at Modicon (a company that disappeared long ago that created the "standard"). Using a protocol invented before the internet to control devices on a semi-public network is insane. The original Modbus was designed to communicate with factory devices controlled by logic controllers over serial and eventually over a custom token ring networ…

I think if people actually knew the true extent of the debacle that industrial control protocols are, they would pass out. If you ever want nightmares, check out EtherNet/IP CIP protocol... Of course, there are no security provisions whatsoever. If you can get a device on the LAN, you're golden. Every device, fully open to monitoring and control of every attached piece of equipment. In the new world of inexpensive, b…

I recently went to a LoRaWan workshop funded by my megacorp (a utility company). It felt like paying someone to try and sell you their stuff.

Anyway, what the LoRa did emphasize is that both the network layer and application layer are encrypted with different keys using AES. This means someone would have to compromise both layers to actually control the devices.

Buuut, given that both encryption keys are stored on the device, I bet someone will just walk up with a chip clip and read the keys right out of EEPROM and then the pretty lights will start.

Or they'll just hack the application servers. I've seen some really god awful pieces of software in use.

A vendor once told me "it's so easy to admin our device over the internet. Just go to 192.168..." And of course due to corporate politics we still bought that piece of shit.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#225

Post by ChuckMcM »

brbsix wrote: post #218
ChuckMcM wrote: post #206

So sad. I find the mechanics here really challenging to overcome. The hotel management no doubt wants "really cool tech" for their hotel to show they are up to date etc. And they send out an RFQ which someone bids on, really cheaply. Knowing that by only doing the things the hotel asks for, they can throw something together quickly and cheaply for a big payday. This is exactly the mechanism that gets people in troubl…

There are a few realms of business that seemingly necessitate such games. It's about as aggravating as can be imagined. I wish I knew a way around it. Different people? Closer aligned incentives? The cross-cultural aspects here make it especially difficult. You don't know what you don't know.

This is what makes people with so many years of experience so valuable. NetApp had a woman who would source parts from around the world and she had done it for long enough that she knew many (if not all) of the tricks in the book. Often her conversations would start with a new supplier and her requests with explicit constraints would tell them that she knew what she was talking about and that they had better play it straight. So they started out assuming none of the tricks they might use with an inexperienced buyer would work. That experience had tremendous value to the company.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#226

Post by bdamm »

pjkundert wrote: post #208
thoughtsimple wrote: post #33

I'm amused by the use of Modbus. I worked on Modbus networking back in the 1980's at Modicon (a company that disappeared long ago that created the "standard"). Using a protocol invented before the internet to control devices on a semi-public network is insane. The original Modbus was designed to communicate with factory devices controlled by logic controllers over serial and eventually over a custom token ring networ…

I think if people actually knew the true extent of the debacle that industrial control protocols are, they would pass out. If you ever want nightmares, check out EtherNet/IP CIP protocol... Of course, there are no security provisions whatsoever. If you can get a device on the LAN, you're golden. Every device, fully open to monitoring and control of every attached piece of equipment. In the new world of inexpensive, b…

Don't even get me started on medical devices. Hospitals are facing a disaster they've never even conceptualized.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#228

Post by seanp2k2 »

stestagg wrote: post #193

When I stayed there, it was just as soul destroying to use these things as you might imagine. The implementation felt like they'd asked a VB6 dabbler to implement it in Java. Then stuck it in the cheapest 600mhz tablet they could find. The UI was purely a button grid with distorted graphics, and dodgy typography. Button presses took about 1/2 a second to respond, and every 5th press caused the app to crash (adding a…

but it's got a touchscreen

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#229

Post by DasIch »

finnn wrote: post #187
DasIch wrote: post #158

Earlier quoted context omitted.

Depends on how targeted the attack is. A hacker who is bored and is searching Shodan for what entertainment the IoT is offering might find GPS quite useful.

It's on a private subnet. You'd have to have some way to get onto the hotel's internal network. The one described in the post is being physically at the hotel. Now, there might be other ways, but this most likely isn't about to show up on shodan.

You're right that in this particular case it's not a problem. Nevertheless any type of device that can be connected to a network, will be connected to the internet. Someone somewhere will make it happen.

I doubt the hotel came up with this solution completely by themselves. Whoever installed it will probably install it elsewhere and it's only a matter of time until it goes badly.

Re: I stayed in a hotel with Android lightswitches and it was as bad as you'd think

#230

Post by Jean-Philipe »

ChuckMcM wrote: post #206

So sad. I find the mechanics here really challenging to overcome. The hotel management no doubt wants "really cool tech" for their hotel to show they are up to date etc. And they send out an RFQ which someone bids on, really cheaply. Knowing that by only doing the things the hotel asks for, they can throw something together quickly and cheaply for a big payday. This is exactly the mechanism that gets people in troubl…

I agree with you on all your points, except:

> This is exactly the mechanism that gets people in trouble going to China for manufacturing.

I keep hearing about the "cheap Chinese tech", even though nowadays a lot of high-quality gadgets are really Chinese. Even Apple's products are mostly from China. And it's not even for the cheap prices, it's because the entire production chain is there[1]

The mistake is not going to China, it's going to China just in order to save money - or anywhere, for that matter. I get that your point is not actually about China, but saving money on the wrong things.

I'd just appreciate if we could stop using "Chinese" as a synonym for "cheap".

[1] http://www.heraldtribune.com/article/20120123/ARTICLE/301239...

Post reply on HN