Earlier quoted context omitted.
It's a little hard to distinguish worthwhile warnings from the near-constant din of finger-wagging
How... what's the sound of a finger wagging?
Very slight swooshing.
IoT Goes Nuclear: Creating a ZigBee Chain Reaction
21–30 of 100 posts
Re: IoT Goes Nuclear: Creating a ZigBee Chain Reaction
#22Earlier quoted context omitted.
http://archive.is/gRSfN
This too is not immune. I get it here too.
You can use http://archive.is/gRSfN/image to get a screenshot of the page.
Re: IoT Goes Nuclear: Creating a ZigBee Chain Reaction
#23global AES-CCM key that Philips uses to encrypt and authenticate new firmware Who on earth authenticates firmware through AES. Even Sony realizes that doesn't work. (I can already imagine how the idiots fixed this: by drawing another set of bytes for a new "authentication" key..)
It's theoretically sound with a good HSM. But agreed, I'd rather rely on getting a sound software implementation of an asymmetric signature scheme than rely on protecting a symmetric key with hardware.
Re: IoT Goes Nuclear: Creating a ZigBee Chain Reaction
#24Earlier quoted context omitted.
Well, the HTML contains some very shady (encoded and obfuscated) JavaScript code. If you want to investigate further replace the "return r;" in the very end of those two "evals" with "console.log(r);" then get the decoded code from the browser's console. Then run through code beautifier (built-in in Firefox JS debugger) to get readable code. But there are more code obfuscations later, though easy to reverse but I don…
OpenDNS blocks the domain it looks like
There is what looks like another site hosted by the other person who partnered on this: http://colinoflynn.com/iotworm/
Re: IoT Goes Nuclear: Creating a ZigBee Chain Reaction
#25Re: IoT Goes Nuclear: Creating a ZigBee Chain Reaction
#26Wait Hue doesn't use asymmetric keys to sign its firmware updates?
I was wondering the same thing ... shouldn't a design goal for the signing mechanism be to make it impossible to derive signing capability without access to some secret not present on the device?
Re: IoT Goes Nuclear: Creating a ZigBee Chain Reaction
#27And this is why we can't have nice things :(
Re: IoT Goes Nuclear: Creating a ZigBee Chain Reaction
#28Earlier quoted context omitted.
Exactly, for as many legitimate problems I see posted I usually see double as mean fear-mongering stories.
How, exactly, are you identifying "fear-mongering stories"? Mislabeling real security issues as "fear-mongering" is how widespread security problems are created. When attacks can be trivially copied, even obscure security issues can become easily exploitable problems under attack from bulk exploitation tools.
It's a headline problem. Typically these issues are labeled as "all of IoT is terrible".
For as many of these REAL security issues we face, there are many stories published that have no real-world impact.
Examples: The story from defcon (or blackhat, cant remember which) about installing ransom-ware on your smart thermostat.
The headlines were all "Hackers make thermostat ransom-ware" or "Your smart thermostat is now vulnerable to ransom-ware"
A few points: - It required local access - It required an SD card reader - It also required the thermostat run a local HTTP server
Another decent example were the SmartThings security holes from earlier this year: - It was mostly an oauth2 authorization issue (applications requesting grant types it didn't need) - The apps were actually independently developed (not ST official) and took some technical knowledge to deploy yourself - The rest were known security issues in the Zigbee protocol that SmartThings has little control over. Similar to this article.
Or the botnet of cameras which is probably the most high-profile example and most relevant are labeled as "The IoT brought down the internet"
That's a lesson for the makers of those cheap DVRs and Cameras, it was also a lesson in user documentation to avoid them doing stupid things. That's the only example in recent years I've seen that goes anywhere, but the problem is it's drowned out by nonsense and clickbait headlines.
Re: IoT Goes Nuclear: Creating a ZigBee Chain Reaction
#29Clearly, absolutely no one saw this coming, nor did anyone warn us. :-) How else do you explain how woefully unprepared we are?
It's a little hard to distinguish worthwhile warnings from the near-constant din of finger-wagging
What's great about this argument is how versatile it is. Climate change got you down? How about deforestation, or antibiotic overuse? Tired of people telling you not to write web applications in C? Your one liner seamlessly shuts down discussion in any of those debates!
In fact: the finger-waggers have been right about this issue since approximately 1988, when Paul Graham's friend shut down much of the Internet with a tiny C program that shouldn't have been possible to write back then, but is in fact still possible to write in 2016.
Re: IoT Goes Nuclear: Creating a ZigBee Chain Reaction
#30Wait Hue doesn't use asymmetric keys to sign its firmware updates?
Right. Using "standard cryptographic techniques" is not sufficient when you are using the wrong technique for the job.