81–90 of 182 posts
Earlier quoted context omitted.
I suppose you could just loop through all the IPs for some common ranges like 10.0.0.0/16 and 192.168.0.0/16 looking for a given port, if you knew the toothbrushes exposed it and there was something exploitable there, that makes sense.
Even 192.168.1.0/8 will probably get you ~95% coverage for residential networks.
Earlier quoted context omitted.
“The door refused to open. It said, “Five cents, please.” He searched his pockets. No more coins; nothing. “I’ll pay you tomorrow,” he told the door. Again he tried the knob. Again it remained locked tight. “What I pay you,” he informed it, “is in the nature of a gratuity; I don’t have to pay you.” “I think otherwise,” the door said. “Look in the purchase contract you signed when you bought this conapt.” In his desk…
More recently see Cory Doctorow's "Unauthorized Bread": > The toaster wasn’t the first appliance to go (that honor went to the dishwasher, which stopped being able to validate third-party dishes the week before when Disher went under), but it was the last straw. She could wash dishes in the sink but how the hell was she supposed to make toast—over a candle? * https://arstechnica.com/gaming/2020/01/unauthorized-bread-…
Earlier quoted context omitted.
> The second is the fact that devices on the LAN are accessible to other devices on the LAN. Malicious JS in a webpage can scan for and compromise other local devices. Which browser API enables that?
HTTP, it's all the rage these days. (via , fetch, XMLHttpRequest, et al)
I had misremembered these as a single comic, but you can't have everything: https://i0.wp.com/www.litterboxcomics.com/wp-content/uploads... https://i0.wp.com/www.litterboxcomics.com/wp-content/uploads...
If only there was a kind of toothbrush which doesn't use the internet. Seems like an opportunity.
Earlier quoted context omitted.
You might not be able to turn bluetooth off, but you can choose not to pair them with anything (or remove the pairing after setting up the device).
The issue is what happens to these toothbrushes in a couple of years when their vulnerabilities will be discovered. Their inevitable exploitation could be prevented by simply allowing to turn off bluetooth. Or even better, only enable bluetooth if the user wants to set up and use these smart features, at least in that case the vulnerable firmware can be updated using the smartphone app.
Have a colorful switch to enable it, whatever.
But poor security posture out of the box, for a questionably-supported, poorly-developed, long-lived physical device seems important enough to mandate slight one-time inconvenience.
In the future, this bullshit is going to be looked back at like default passwords on ISP WAPs.
Earlier quoted context omitted.
HTTP, it's all the rage these days. (via , fetch, XMLHttpRequest, et al)
Ah ok, so we are talking about dumb old methods. I thought it was something like the fancy APIs that are all the rage these days.
But now even "native" apps are web apps, and IoT devices all use web APIs too. They can be locked down through CORS etc., but it's easier for devs to set `Access-Control-Allow-Origin: *` and worry about it "later".
Earlier quoted context omitted.
What risks could a WiFi hotspot on an air purifier expose if it's not connected to the network or a computer?
Anyone in Wi-Fi range can exploit the device. The sensors of the air purifier can be used for spying, and the device could also serve as a hopping point for exploiting other devices in your home.
To be able to... know if your target's house has a lot of pollutants? Is particularly warm? There is practically no useful information that can't be gleamed by just looking through their windows, blinds and all.
> and the device could also be used as a hopping point for exploiting other devices in your home.
It's not connected to your home network, that's the whole reason for the hotspot existing. How, exactly, could it be used as a hopping off point, except to other devices with hotspots that... can just be exploited in the first place.
Earlier quoted context omitted.
> Somehow we've failed as a profession to provide people with a home network which continues to function as long as the router has power, and that sucks. This already existed for lightbulbs in the 70's: https://en.wikipedia.org/wiki/X10_(industry_standard) Wikipedia says the computer interface was 80's, but if you managed to have a computer in the seventies, you probably knew enough electronics to homebrew something.
Yeah, we've invented it several times over, and yet, what people buy and use is IoS crapware which craps out when the network does. That's worse. You see how that's worse, right?
I'm not sure that people (in general) want these things. It seems like product managers adding stuff to justify their existence and people buying what they find on the shelf. You get an internet connected oven because you have no choice anymore. (Hyperbole, but the non-internet choices are narrowing.)
Maybe people want to change the color of their lightbulb (I'm guessing it gets old quick), but I suspect they're not asking for it to be on the internet.
A warning about Philips electric toothbrushes: you cannot turn off Bluetooth on them, even if you are not using the smart features. Also be careful with all Philips air purifiers that support Wi-Fi, because the remote control feature cannot be disabled. They create a Wi-Fi hotspot that you need to connect to with a smartphone to finish setting up the device, but if you don't use these features, the air purifier will…
I finally got rid of one of my fitness watches that had dreadful battery life and I couldn't figure out why. After a few months of this, I finally realized the same thing, you can't turn off the bluetooth on it. The app on your phone and the watch are constantly searching for each other to always sync and the alternative is to unpair the watch, use it, re-pair, sync and go which became a total headache, but did in fa…