Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Tapplock IoT padlock has multiple security vulnerabilities

nakedsecurity.sophos.com

Post reply on HN
Print view View original

91–100 of 102 posts

Re: The Tapplock IoT padlock has multiple security vulnerabilities

#91

Post by pavel_lishin »

Double_a_92 wrote: post #88
icebraining wrote: post #69

Earlier quoted context omitted.

Not sure we can blame bootcamps - I learned nothing about internet security in my software engineering college course.

But you probably knew that is was something to consider. And weren't told that you are basically a full fledged developer after a 3 month web dev course and after reading "cracking the coding interview". The Dunning–Kruger effect is heavily at work there.

I'm not the person you responded to, but not really. My college courses - admittedly as a Computer Science major, not Software Engineering - were laughably lacking any practical education. The closest we had was one group project, and we didn't even learn about things like version control.

Security? Forget it.

I've never gone to a bootcamp, but I'd wager that they at least mention security in their classes. College was the equivalent of the PHP documentation that had incredibly insecure examples that people "learned" from.

Re: The Tapplock IoT padlock has multiple security vulnerabilities

#92

Post by notnot »

This may seem unrelated but I watched "The Disaster Artist" for the first time last night. It made me cringe, not for Wiseau but by reminding me of all the times I've been a Wiseau in my life as I disconnected from reality caught up in some fantasy of how I was going to make the world love me by something I was going to do. Reality can be a brutal place for the ego, but at least it's real.

"I'm going to make my own Bluetooth smart-lock. It's gonna be amaaaazing. Oh hai Mark."

Re: The Tapplock IoT padlock has multiple security vulnerabilities

#93

Post by dpark »

lnsru wrote: post #47
rapsey wrote: post #19

Earlier quoted context omitted.

IoT devices are generally built and programmed by electronic engineers. They have no knowledge about software security and neither do they care.

That’s wrong. An engineer has a couple managers above. Product, project, platform manager. You name it. Engineer is just another blue collar worker nowadays. No decision making power. I was not allowed to save company $40k, they told that numbers shouldn’t interest me. If management says, we need no encryption and authentifition, it’s totally ok. I just print their emails with this statement for later.

Engineering is absolutely not blue collar, but this has nothing to do with the issue you’re facing. If you found an opportunity to save $40k and they said you shouldn’t care about numbers, then either you have poor management or there’s more to the story that you didn’t share. At the very least competent management should have been able to explain why saving the $40k was the wrong trade off.

Re: The Tapplock IoT padlock has multiple security vulnerabilities

#94

Post by consp »

lnsru wrote: post #47
rapsey wrote: post #19

Earlier quoted context omitted.

IoT devices are generally built and programmed by electronic engineers. They have no knowledge about software security and neither do they care.

That’s wrong. An engineer has a couple managers above. Product, project, platform manager. You name it. Engineer is just another blue collar worker nowadays. No decision making power. I was not allowed to save company $40k, they told that numbers shouldn’t interest me. If management says, we need no encryption and authentifition, it’s totally ok. I just print their emails with this statement for later.

If you can save 40k and they don't care. Ask for a 40k raise and if they say they don't have the money ... well ... you know where to get it.

Re: The Tapplock IoT padlock has multiple security vulnerabilities

#95

Post by consp »

mercer wrote: post #70
sudhirj wrote: post #18

Earlier quoted context omitted.

I work on encrypting movies for distribution, so there's a spectrum of attacks we try to consider. 1. Beginner opening Firebug / Devtools - use UUIDs for all the things, don't make anything guessable. Scrypt/bcrypt passwords on a separate Oauth system for all passwords / logins, manage all sessions with access tokens that are checked on each operation, allow immediate revocation of all open sessions. 2. Novice / Amat…

> 1. Beginner opening Firebug / Devtools - use UUIDs for all the things, don't make anything guessable. Is that actually necessary/useful? > Scrypt/bcrypt passwords on a separate Oauth system for all passwords / logins, manage all sessions with access tokens that are checked on each operation, allow immediate revocation of all open sessions. why Oauth instead of just a regular user table, login POST form, and the res…

Not my post but my answers would be:

> Is that actually necessary/useful?

Yes, removes guessing, incremental attacks and off by 1 errors/attacks. Obfuscation is bad encryption but good policy.

> why Oauth instead of just a regular user table, login POST form, and the rest as you describe?

Sessions are fixed and can last an indefinite amount of time as an example.

But [token based system X for client/server or some kerberos variant for semi-trusted or m2m] will fill this void as well.

Re: The Tapplock IoT padlock has multiple security vulnerabilities

#96

Post by JeremyBanks »

tomsmeding wrote: post #9

> Web programmer? Don’t make account IDs easy to guess. In an otherwise secure system, account numbers that go 1,2,3… shouldn’t be a problem, but why make it easy? Is that the best advice to web programmers they can give based on this story? That's the "obscurity" part in the security by obscurity scheme. If you've got your security otherwise nailed down fine, some obscurity on the top doesn't hurt: security-in-depth…

“Security by obscurity” has become so misused... it doesn’t apply to this situation at all. There’s nothing illegitimate about having a secret token for your user ID. By the same logic, a password is false security.

“Security by obscurity” refers to the obscurity of the security scheme, not identifiers!

Re: The Tapplock IoT padlock has multiple security vulnerabilities

#97

Post by cptskippy »

JeremyBanks wrote: post #96
tomsmeding wrote: post #9

> Web programmer? Don’t make account IDs easy to guess. In an otherwise secure system, account numbers that go 1,2,3… shouldn’t be a problem, but why make it easy? Is that the best advice to web programmers they can give based on this story? That's the "obscurity" part in the security by obscurity scheme. If you've got your security otherwise nailed down fine, some obscurity on the top doesn't hurt: security-in-depth…

“Security by obscurity” has become so misused... it doesn’t apply to this situation at all. There’s nothing illegitimate about having a secret token for your user ID. By the same logic, a password is false security. “Security by obscurity” refers to the obscurity of the security scheme , not identifiers!

> “Security by obscurity” refers to the obscurity of the security scheme

It's not even that specific. It's obscurity of the workings of the system which may or may not have any security in place.

Re: The Tapplock IoT padlock has multiple security vulnerabilities

#98

Post by sudhirj »

mercer wrote: post #70
sudhirj wrote: post #18

Earlier quoted context omitted.

I work on encrypting movies for distribution, so there's a spectrum of attacks we try to consider. 1. Beginner opening Firebug / Devtools - use UUIDs for all the things, don't make anything guessable. Scrypt/bcrypt passwords on a separate Oauth system for all passwords / logins, manage all sessions with access tokens that are checked on each operation, allow immediate revocation of all open sessions. 2. Novice / Amat…

> 1. Beginner opening Firebug / Devtools - use UUIDs for all the things, don't make anything guessable. Is that actually necessary/useful? > Scrypt/bcrypt passwords on a separate Oauth system for all passwords / logins, manage all sessions with access tokens that are checked on each operation, allow immediate revocation of all open sessions. why Oauth instead of just a regular user table, login POST form, and the res…

In this case oAuth is more because we have multiple products, might have done without it for just one, but it somehow seems to make more sense to have a separate system with isolated human data anyway, what with GDPR and all. The actual application has only the user UUIDs, can null or pseudoanonymise the references as necessary. This is B2B so slightly different rules apply for auditing etc.

And yeah, obscurity is not security but is useful in itself. Smaller attack vector (can’t leak info by iteration) less competitive info leakage (you’ll never figure out how many customers we have unless we tell you). Also has advantages with regards to database replication, backup restore and sequence management, but that’s another topic.

Re: The Tapplock IoT padlock has multiple security vulnerabilities

#99

Post by lnsru »

dpark wrote: post #93
lnsru wrote: post #47

Earlier quoted context omitted.

That’s wrong. An engineer has a couple managers above. Product, project, platform manager. You name it. Engineer is just another blue collar worker nowadays. No decision making power. I was not allowed to save company $40k, they told that numbers shouldn’t interest me. If management says, we need no encryption and authentifition, it’s totally ok. I just print their emails with this statement for later.

Engineering is absolutely not blue collar, but this has nothing to do with the issue you’re facing. If you found an opportunity to save $40k and they said you shouldn’t care about numbers, then either you have poor management or there’s more to the story that you didn’t share. At the very least competent management should have been able to explain why saving the $40k was the wrong trade off.

Yes, competent management. Didn’t experienced much companies having it. With competent management I could save my salary for couple years in this project alone. The client ist other branch of the same company. I could design a pcb with components for our needs, instead of that management wants to go with expensive 3rd party module having all bells and whistles on it.

Edit: pcb design is risky. But the system is very primitive having voltage regulator and single integrated circuit in it. I doubt this department with current performance would survive as independent company.

Re: The Tapplock IoT padlock has multiple security vulnerabilities

#100

Post by mikestew »

ptx wrote: post #77
pedroaraujo wrote: post #11

I thought this was a blog post about the guy who simply unlocked the padlock using a GoPro mount ( https://www.youtube.com/watch?v=RxM55DNS9CE - the video is worth watching from the beginning) but this was more amusing than I was expecting. Nothing went right in the design of this padlock.

Apparently that was a quality-control issue with his lock - the lock is designed to have a small metal pin that prevents rotating the back, but it was defective on his lock.

Same quality control that allows the shackle to be snipped with a 12" set of bolt cutters? It's almost as if at every turn, of two possible decisions, they consistently chose the wrong one.
Post reply on HN