IoT Devices Are Secretly Phoning Home (thenewstack.io) 196
An anonymous reader writes: A popular internet-enabled security camera "secretly and constantly connects into a vast peer-to-peer network run by the Chinese manufacturer of the hardware," according to security blogger Brian Krebs. While the device is not necessarily sharing video from your camera, it is punching through firewalls to connect with other devices. Even if the user discovers it, it's still extremely hard to turn off. Krebs notes that the same behavior has been detected in DVRs and smart plugs -- they're secretly connecting to the same IP address in China, apparently without any mention of this in the product's packaging. One security researcher told Krebs the behavior is an "insanely bad idea," and that it opens an attack vector into home networks.
it's not a secret (Score:4, Insightful)
Reasons why I don't like the Internet of Things. (Score:5, Insightful)
Here's a list of reasons why I don't like the Internet of Things:
1) Internet of Things devices could watch me while I sleep.
2) Internet of Things devices could watch me while I pee.
3) Internet of Things devices could watch me while I make kaka.
4) Internet of Things devices could watch me while I pleasure myself.
5) Internet of Things devices could watch me while I wash my body in the shower.
6) Internet of Things devices could watch me while I relax in the tub.
7) Internet of Things devices could watch me while I brush my teeth.
8) Internet of Things devices could watch me while I make passionate love to my wife.
9) Internet of Things devices could watch me while I brush my hair.
10) Internet of Things devices could watch me while I read a book.
11) Internet of Things devices could watch me while I read Slashdot.
12) Internet of Things devices could watch me while I bake cake.
13) Internet of Things devices could watch me while I put in my contact lenses.
14) Internet of Things devices could watch me while I get ready to play golf.
15) Internet of Things devices could watch me while I do my laundry.
16) Internet of Things devices could watch me while I think about rugby.
17) Internet of Things devices could watch me while I tie my shoes.
18) Internet of Things devices could watch me while I celebrate the 4th of July.
19) Internet of Things devices could watch me while I water my flowers.
20) Internet of Things devices could watch me while I eat ham.
21) Internet of Things devices could watch me while I use my stapler to staple documents.
22) Internet of Things devices could watch me while I chew bubble gum.
23) Internet of Things devices could watch me while I check the oil in my car.
24) Internet of Things devices could watch me while I look for my TV remote.
25) Internet of Things devices could watch me while I blow my nose.
26) Internet of Things devices could watch me while I rearrange my stamp collection.
27) Internet of Things devices could watch me while I listen to the Backstreet Boys.
28) Internet of Things devices could watch me while I do my calisthenics.
29) Internet of Things devices could watch me while I search for a paper clip.
30) Internet of Things devices could send information about me to advertisers.
31) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I sleep.
32) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I pee.
33) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I make kaka.
34) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I pleasure myself.
35) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I wash my body in the shower.
36) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I relax in the tub.
37) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I brush my teeth.
38) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I make passionate love to my wife.
39) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I brush my hair.
40) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I read a book.
41) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I read Slashdot.
42) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I bake cake.
43) Internet of Things devices could let advertisers use the data unsuspectingly coll
Re: (Score:2)
it opens an attack vector into home networks.
ET pwn home.
Re:it's not a secret (Score:4, Funny)
Not new (Score:4, Informative)
Anyone familiar with IoT knows that most of them phone home to report.
Re: (Score:2)
Just put those IoT on their own VLAN and do not allow them to connect anywhere!
Re: Not new (Score:5, Insightful)
Easy for the typical /. reader perhaps, not so much for your everyday consumer. Go ask random folks what a Vlan is and you'll understand pretty quickly.
The typical user isn't even aware of the possibility of this sort of thing.
Re: (Score:2)
so hype up the dangers and sell the "titaniumShield security appliance" for $300. it doesn't even have to work very well. who cares?
Re: (Score:2, Funny)
Just configure it to phone home so you can update its configuration periodically to cover new IoT devices that phone home....
Re:Not new (Score:4, Interesting)
Then they don't work. Some have to have a 24/7 Internet connection, and if it gets cut, the devices turn off. I'm just waiting for everything out there, be it fridges, TVs, and anything else to either follow suit, or have a 3G antenna, so it has its own private pipe to tattle user info on.
Re: (Score:3)
Re: (Score:2)
Not buying isn't a practical choice in the general sense. It might be if all the shitty features and behavior was spelled out on the box. Since they aren't, the consumer must discover them after purchase.
Re: (Score:2)
Re: (Score:3)
That's assuming that the device does has an offline mode, and will work without that connection to a Chinese server.
Re: (Score:3)
Don't connect them in the first place.
Better yet, DON'T EVEN BUY these things...
Re:Not new (Score:5, Interesting)
Agreed. This doesn't surprise me one bit. Maybe the name gives it away... you know... that these Things communicate over the Internet?
I'm going to take a potentially contrary position, though, and argue that if a device is internet enabled, it absolutely should be phoning home on a regular basis, and for very good reasons. The recent glibc library vulnerability only helps to validate my opinion, in fact, which is that it's absolutely inevitable that serious vulnerabilities will be found in ANY internet-facing device, and so these devices MUST be able to automatically update themselves. What's more, manufacturers should be responsible for providing security updates for a reasonable product lifetime - otherwise, they're no longer fit to stay connected, and essentially must be discarded in order to keep your network secure.
I'm sure there are those who would argue against such a policy, but these are *consumer* devices, and we damn well know by now that a typical consumer will never update the firmware on their own device. We now accept that browsers must self-update in order to remain secure, and we're just now grappling with the notion that OSes must do it too. Frankly, anything that's internet-facing needs to be treated the same way. The manufacturer must take responsibility for this. Otherwise, we're going to have billions of tiny infection vectors that will last as long as the devices do, which could be decades. Look at how much of a problem this is for old desktops, servers, and routers sitting on the internet, spewing botnet-controlled traffic because they've never been updated. Granted, this has to be done in a secure manner, so that MITM attacks are not possible, but it's absolutely possible to do it right.
Of course, we all know what's really going to happen, which is that these companies with absolutely no clue how to do internet security are going to get many thousands of people infected through these crappy little internet-enabled gizmos, and the people who get infected with the Zeus banking trojan or crypto-ransomware will be outraged, and articles will be written, and eventually things *may* improve slightly. I'm sure as hell not going to be one of the early-adoption suckers.
Re:Not new (Score:5, Interesting)
Perhaps an even better thing would be to go to a hub and spoke topology? That way, devices can communicate with the center hub (or hubs, if redundancy is desired), and if there is a fix, the hub asks for it on behalf of one device, caches it, so other devices can use that same fix without issue. It is basically what happens when devices communicate through an access point, but the devices would use a low power, low range protocol as opposed to Wi-Fi, or even opening themselves for attack by touching the Internet directly. Plus, with a hub and spoke, an IDS/IPS mechanism can be places so if one device starts behaving suspiciously that is out of the design parameters (nmapping everything it can find), its connection gets dropped, and life goes on. As an added bonus, an attacker would either have to be physically nearer to intercept the low power protocol, or would have to attack the hardened hub (which could run on fairly modest hardware and use virtual machines to separate the firewall instance from the instance that deals with the devices.)
Re: (Score:3)
I like your idea but I think it misses the fundamental problem with IoT devices: Lifespan.
Older wifi chipsets don't support WPA2 and can't be upgraded. The only option is to replace them, which fortunately is an option with most laptops/computers. Old phones, games consoles, TVs though... You are screwed. The only options are to disable the functionality or use WEP which can be cracked in minutes.
Unless people are going to be happy replacing their IoT doorbell, light switches, smoke alarms, thermostat, cook
Re: (Score:2)
Very true. The hub idea isn't perfect... but it is better than nothing, and with IoT, virtually anything is better than what we have now. Who owns the list is important, but hopefully it can be changed to whomever the consumer wants to maintain it. The key is having some way to not just block devices that have vulnerable firmware, but also limit devices from communicating directly with the outside world. That way if someone's smart toaster has a vulnerability, because it never directly communicates to t
If don't have the source you don't own the device. (Score:4, Insightful)
It's really simple. It's separate from source code quality. If you have proprietary software running free on your device then you don't own the device, whoever set up the software owns it. Windows phones home because it's working for Microsoft. Your IOT devices phone home because they are working for a Chinese company. Your Android phone phones home because it's working for Samsung and your mobile operator. This is not different and it's not complicated.
Re: (Score:2)
Dumb quote (Score:3)
Spy features could just as easily be hidden in hardware. Unless you want to verify the die and masks used, you still have no clue what this device can do.
Re: (Score:2)
This is a red herring. If everything you bought was open source, would that INCREASE or DECREASE you level of security? The EULAs I agree to every day are open source, but do I bother reading them? Even if the code was available for every little thing you used, you would still be relying on trust.. or else you would be spending all day fiddling with every little thing.
Phone home functionality can be hidden in the hardware, on a remote server, in a text file, or literally anywhere. The only way to control al
IoT devices (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
The turn of phrase existed long before the word spade was an ethnic slur.
Re: (Score:3)
Re: (Score:2)
I'm a day late, but
* 3D printed DRONE!
Re: (Score:2)
Kind of like social networking, Web x.0 and "the cloud?" People get paid the big bucks to come up with these things!
Re: (Score:2)
"insanely bad idea" (Score:4, Interesting)
If you think (Score:4, Interesting)
Re: (Score:2)
That core principle was never meant to define IoT as some company monetizing your data.
Re: (Score:2)
That core principle was never meant to define IoT as some company monetizing your data.
But it has become that.
Because an IoT device could probably function just as well without phoning home and selling your data.
Or in the cameras case, they don't have to punch through firewalls (I'd really like some more data on that one) in search of other cameras and constantly phone home. But they do, for some mysterious reason.
Re:If you think (Score:4, Informative)
Re: (Score:2)
Hey, he's got his smugly-sarcastic-narrative-that-makes-him-feel-smart-on-teh-internet and he's sticking with it.
Re: (Score:2)
Hey, he's got his smugly-sarcastic-narrative-that-makes-him-feel-smart-on-teh-internet and he's sticking with it.
What really pisses people of is when I'm smug, sarcastic, and right.
Sorta like an honest feedback mechanism for me.
Re: (Score:2)
That's not true at all. IoT simply means an embedded device connected to Internet.
That's a definition, not a principle.
Now in an ideal world, this simple device would be under your control, secure, and the limit of phoning home would be checking for updates (under your control) and sending diagnostics when requested, and also under your control.
But is that what these devices are doing? We don't even know why they are seeking out other cameras. We do know that they phone home even when told not to. So right away, not as simple as you claim. No security, doing odd things.
Nest Therm
DDNS (Score:5, Informative)
Re: (Score:2)
I am using a network power switch which does exactly this. It pings a server in China on a regular basis (3gstore.com). When I got my first status report from it, I wondered how it
Total FUD (Score:5, Informative)
That's it - the two peers are your camera and your mobile device, not some fast torrent network or something.
Now, sure, this could've been documented better, but Krebs should also know better than to jump to hyperbole based on two letters and a number in a configuration screen.
No need to phone home. (Score:4, Interesting)
And it is completely, absolutely, 100% unnecessary.
o Plug in not-yet configured device.
o Shortly thereafter, it accepts DHCP configuration. Now it has an IP.
o Then it vomits out a tiny UDP (broadcast) packet every 60 seconds or so that says "I'm a WackyWidget and my IP is Yad.daY.yad.daY"
o You start app, it listens for the UDP packet, when it hears it, it begins comm via TCP at the IP identified in the UDP broadcast. UDP broadcasts then cease until, or unless, the TCP (and possibly the DHCP) connection is dropped, in which case, begin again at whatever step is needed.
That's it. That's ALL of it. You need nothing more for an IP camera, a smart power plug, a smart lightbulb, an aquarium controller, the garage door opener, etc., etc., ad infinitum.
If you THEN want to expose WackyWidget to the WAN, you could enable that separately.
If you were out of your damned mind.
If you haven't yet figured out that "the cloud" is nothing but a way to take/get things from you -- money, data, ownership of media, etc. -- then you really need to look at all this harder.
Re: No need to phone home. (Score:4, Insightful)
You're describing Bonjour/mDNS and yes it works within LANs but not if you want to connect from outside your network. People want convenience, punching a hole in your firewall is a "lot of work" and sometimes impossible depending on your configuration.
And yes, anyone with the information could possibly have your camera talking to them but most people don't care or refuse to understand the issue. Whether it's China or the NSA, as long as people have "bread and circuses" they'll be fine.
Re: (Score:2, Informative)
Trivial, is it? As the GP explained, the vast majority of people do not have static IP addresses so it's absolutely necessary to use a DDNS type service. Since the DDNS service has to be a server somewhere that DOES have a static IP address, that is indeed what the kids today call "the cloud."
Re: (Score:3)
Re: (Score:2)
It used to be for sure. Configuring port forwarding manually isn't for the average person. Now there are a bunch of ways to poke holes in NAT though. One of the most common is a UPnP IGD, which is a protocol for asking the router to pretty please forward a port for you.
Re: (Score:2)
Re: No need to phone home. (Score:4, Interesting)
Re: (Score:2)
Smart. But you are (and I am) the exception. People are ignorant and gullible and dishonest marketing is a complementary protein for that particular receptor.
Re: No need to phone home. (Score:2)
Same reason you lock down everything. Especially those things which are dual network capable. ( eg cellular equipped )
There is a very good reason the smartphones and the alarm system reside on Private vlans.
They can easily be utilized as a " beach head " or jump server into your network bypassing your firewall completely.
Re:No need to phone home. (Score:4, Interesting)
And it is completely, absolutely, 100% unnecessary.
o Plug in not-yet configured device.
o Shortly thereafter, it accepts DHCP configuration. Now it has an IP.
o Then it vomits out a tiny UDP (broadcast) packet every 60 seconds or so that says "I'm a WackyWidget and my IP is Yad.daY.yad.daY"
o You start app, it listens for the UDP packet, when it hears it, it begins comm via TCP at the IP identified in the UDP broadcast. UDP broadcasts then cease until, or unless, the TCP (and possibly the DHCP) connection is dropped, in which case, begin again at whatever step is needed.
That's it. That's ALL of it. You need nothing more for an IP camera, a smart power plug, a smart lightbulb, an aquarium controller, the garage door opener, etc., etc., ad infinitum.
If you THEN want to expose WackyWidget to the WAN, you could enable that separately.
If you were out of your damned mind.
If you haven't yet figured out that "the cloud" is nothing but a way to take/get things from you -- money, data, ownership of media, etc. -- then you really need to look at all this harder.
That's a really long and condescending way to say "I don't understand how subnets work". While it may work fine on your household network, this camera is designed to be accessed over the public internet. Most people don't need to check security cameras that are in the same room as them.
Re: No need to phone home. (Score:2)
Setup a VPN.
Connect to VPN, check your camera, disconnect from VPN. Tada. Want to go a step further ? Configure VPN to only allow access to camera.
No open ports on the edge router, can easily route outbound traffic from suspect device to a black hole or just deny it completely.
Re: (Score:2)
You can never be too rich, too thin, or have too many VPNs.
Re:No need to phone home. (Score:4, Informative)
which makes the device useless to the people who buy it. People buy security cameras with IP connectivity so they can view their camera from a remote location, for alerts and the ability to view and control devices remotely.
Like you have a camera on your front door. It sends you an alert someone is there, to which you access your camera to see who it is. Generally, this is useful if the UPS or FedEx guy comes while you're at work, at which point you can ask them to drop the package off in the garage (which you open and close remotely). No package left on the door stop, and the garage door is closed by you so it's safe and waiting for you.
And that's the reason why people are going for the "cloud" stuff. Sure there's probably a few lazy asses using it inside their home (or their home is a huge mansion that takes 10 minutes to get from one side to the other), but the key selling point of this "IoT" devices is remote access.
Remotely turn on the lights. Remotely turn on the heat or AC so you come home to a warm or cool house. View cameras and recordings while you're out.
What you propose is secure, but gives consumers none of that. They're buying it for the remote accessibility and giving them only local access until they do a bunch of fancy stuff is basically counter to what consumers are buying the things for.
Re: (Score:2)
o You start app, it listens for the UDP packet, when it hears it, it begins comm via TCP at the IP identified in the UDP broadcast. UDP broadcasts then cease until, or unless, the TCP (and possibly the DHCP) connection is dropped, in which case, begin again at whatever step is needed.
Ease of use: 1 star
Device required some weird configuration. Couldn't connect to it via my iPhone when I wasn't at home out of the box. Should come pre-configured in a way that most people want. Would not buy again.
Re: (Score:2)
... because I only ever want to watch my video cameras while I'm in front of them.
The whole idea of this is to get out of NAT systems - so the real solution is just use IPv6 - but we all know how long thats going to take.
Re: (Score:2)
Re: (Score:2)
A "vast peer-to-peer network" sounds like cloud computing. Cisco once tried to get their users to configure their Linksys routers through "The Cloud". Unless told to do otherwise, routers would auto-update the firmware so that all configuration settings could only be controlled from Cisco's router management website.
Re: (Score:2)
How would you configure your router to actually work (ie before it has working connectivity)?
Updates (Score:2)
Phoning home isn't notable unless you know what it's doing so for. It could be to send information back, or it could just be to just for updates etc.
Insanely bad idea? (Score:5, Insightful)
I'm sorry, but based on what we've been seeing, so far the entire Internet of Things is an insanely bad idea ... shoddy security by incompetent idiots who want more analytics data and ad revenue, and don't give a crap about your security.
Fuck that, I want my toaster connected to the internet why again?
That this is happening should no longer come as a surprise to anybody who has paid even the smallest amount of attention to how much of a mess the IoT is.
Re:Insanely bad idea? (Score:4, Funny)
How else do you think it will keep its antivirus software up-to-date?
Re: (Score:2)
NetBSD has been running on toasters for over a decade.
Re: (Score:2)
Oh I know there's a meme. But I also know that an unfortunate majority here on slashdot don't think it is one.
Re: (Score:2)
Awww, pookie ... do you make internet connected toasters.
Wah wah wah, the mean old man made fun of IoT.
Seriously? Get over it. I know what IoT is, I just don't think it's worth all the hype.
A bunch of random crap connected to the internet so a bunch of idiots with no attention span can feel cool because they can control it from their phone? Yeah, don't care. Your technology fetish is your damned problem.
The only value I see in IoT is the endless amusement I get as everybody howls about how they've been
Re: (Score:2)
A bunch of random crap connected to the internet so a bunch of idiots with no attention span can feel cool because they can control it from their phone? Yeah, don't care.
Yep. Failed. Thought so. The vast majority of IoT stuff I've come across with can't be controlled from a phone. Heck it can't be remotely controlled at all. Ignorance is bliss isn't it.
Re: (Score:2, Insightful)
Fuck that, I want my toaster connected to the internet why again?
You don't.
No one does.
And the fact that you think IoT = toaster connected to the internet shows how little you understand of the concept.
So what exactly is the point of IoT in consumer space? I've been trying to figure it out for a while and honestly have no idea.
Or maybe you are just picking a useless edge case to try and make an anti-IoT point.
Trade rags seem unable to communicate a coherent value proposition other than data collection and ads. Always fridges, light bulbs, thermostats and similarly useless crap.
I go to browse the "connected home" section at my local electronics store and all I see are overpriced worthless gadgets not so dissimilar in value to an Internet connected toaster.
So what exactly is the point?
Re: (Score:3, Insightful)
So what exactly is the point of IoT in consumer space?
For most products it's the same as it is in the commercial space. The only difference is that assets under monitor and control are physical things you own rather than a mix of customer connected monitoring devices ala "sensor network".
Ultimately "sensor network" is it. Data aggregation of your life and monitoring of your things is the goal of IoT. (Though admittedly many corporations believe that "them monitoring you" is what it's all about and that is just fucking with an otherwise good concept).
Examples f
Re: (Score:3)
That's exactly why we call it an "insanely bad idea". When you aggregate that much data about people, the risks are huge while the benefits are small and in many cases, still theoretical. Unfortunately, humans are bad at evaluating risk, which may be why you react strongly to the claim that the IoT is and will be full of "shoddy security by incompetent idiots who want more analytics data and ad
Re: (Score:3)
That still creates an exfiltration risk. Pretending that risk doesn't exist is negligence. Don't pretend any device has perfect security; most embedded hardware runs ancient kernels that have know exploits.
Yes, that's still a terrible idea. It is very difficult to "anonymize" personal data, as it can usual be re-correlated back to whomever generated the data. Even simple traffic analysis - witho
Re: (Score:2)
Data aggregation of your life and monitoring of your things is the goal of IoT
To what end?
- Trends from the temperature in my apartment show I had the heater turned on a good hour before I got home from work. But in the week the heater was off I realised I spent that hour leeching heat from the neighbours anyway and while it normally took an hour to get the apartment up to temperature on a week day at 4pm I could do it in 15min.
Leeching from thy neighbor in principal sounds like a great use of technology. I imagine at some point you can expect the dreaded "WARN: THERE IS ANOTHER SYSTEM" message to flash across your console as your neighbor gets wise and introduces retaliatory AI into the control loop of their heater.
Trends from my water meter shows a leaking pipe under ground costing me money I would likely have not noticed before something actually got damaged.
A little old fashioned but you could look at the little spinning leak detector triangle on your meter.
- Trends from my power meter showed my fridge was set to the wrong temperature after a power outage. I could see that due to the duty cycle changing.
Are there fridges on the market which lack non volatile temperature settings? Or is it just the IoT mo
Re: (Score:2, Flamebait)
Skippy ... if you think I waste any fucking time giving a crazy idiot like you any "guff", you sorely over-value your place in your universe.
I'm not your personal stalker, I just ignore your stupid drivel and inane bullshit. Don't flatter yourself.
Re: (Score:2)
We did?
ESP 8266-12E to invade the world! (Score:3)
If you just use them as they are (With the AT+ command set, hayes compatible) - they already phone home because they can Upgrade the firmware - albeit you can initiate that yourself).
But unless you've got a WiFi hotspot with a firewall where you can Wireshark monitor your network traffic - you will have NO idea whether this thing is phoning home with a few extra details about your network, it's bad enough that it actually phones "home" with your IP address, I'm not sure if it does that - but it's def. worth an extra look. Anyone know the details about this? Have anyone tried looking into the ESP8266 series to see if they even phone home after they've been bootloaded with the Arduino Bootloader?
We've got to be a little careful about this - I agree completely - It's so tempting to just insert those wonderful all-in-one IoT devices here and there...and forget about the advanced details...because lets face it - they've made it wonderfully practical for us to use with very little skill or knowledge required to get these things talking to each other (while - perhaps...hiding a darker side).
Re: (Score:3)
IoT Subnet, it needs not be able to reach the internet ever.
Re: (Score:2)
Not much of an internet of things then, is it?
Re: (Score:2)
I've got a couple hundred devices that work that way and seems pretty internet of things to me. Only they are my things and only allowed to talk to what I allow them to.
So CCTV camera only talk to NVR's and an application specific gateway. Why would some wifi camera need to talk to the internet as a whole? If I wanted to access it directly I can VPN in. In general the application gateway thats part of my home automation give me all the live info I need. The NVR's deal with long term encryption and rete
Re: (Score:2)
That's all well and good, but the manufacturers want to sell IP cameras and other "Internet of things" stuff to regular consumers. Regular consumers don't "VPN into" things. They tap on an app on their smartphone.
Besides which, unless you're extraordinarily lucky or for some reason spend multiple times the regular rate for Internet service, you have a dynamic DNS address. That means something on your network, whether it's a toaster, desktop computer or your router, has to talk to an external DDNS server
Re: (Score:2)
Point being IoT end devices should not be exposed to the internet it's a horrid design for something that should work for 10+ years without modification. App specific controllers make sense thus why zwave etc does just that.
Setting up a singular VPN to a dynamic IP is pretty easy and thats one thing updating one service to do so. My app gateway just works with my phone. Besides who wants to install and maintain a pile of different apps. My garage door opener has an app, I just use the single app gateway
Why is this a surprise? (Score:2)
That's what the whole point of the IoT. If you are going to control your lights or toaster or whatever with your phone, OF COURSE it has to connect to an external server - so that you can connect to the device. Naturally, it's stupid, but that's the IoT for you.
Re: (Score:2)
Wrong. [slashdot.org]
Now that kids is why ... (Score:2)
If you need to access it via the internet, then fair enough, but now we've got yet another example as to why we should use firewall settings to make sure they can only contact what you want them to contact.
Re: (Score:2)
We're seeing the current wave of WiFi-enabled devices because the cheap SoC parts now include a WiFi NIC. At some point in the future (I believe prototype hardware already exists) a new SoC will include a baseband processor and software defined radio. When that happens, all of these devices will no longer need your permission and LAN access to steal data - they will simply use the cellular networks.
If you buy these WiFi devices - regardless of your plans to deny them your gateway address - you are supportin
Philips Hue does this too (Score:2)
Any IOT device that has access from a smartphone does something like this. If you look at the traffic from a Philips Hue hub you'll see SSDP broadcasts, NTP synchronisation and phoning home with details of it's local IP address and checking for updated firmware.
This article seems to be yet more anti-Chinese nonsense. There was a very similar one recently by an American "journalist" that didn't understand that NTP is a distributed protocol either and implied these devices were somehow infiltrating US homes a
Re: (Score:2)
https://tools.cisco.com/securi... [cisco.com]
https://social.technet.microso... [microsoft.com]
http://www.kb.cert.org/vuls/id... [cert.org]
It's just a harmless protocol - nothing to worry about.
IoT devops = security nightmare (Score:2)
It's Foscam you /.pussys (Score:4, Informative)
Here is the Krebs link if you want the actual details and don't want to dig it out of the articles linked in the summary: [krebsonsecurity.com]http://krebsonsecurity.com/201... [krebsonsecurity.com]
Re: (Score:2)
Dice sold the site...
Pay attention.
Really? lol. Guess I don't pay attention. So who bought it now? Who's more of a sucker than Dice?
Re: (Score:2)
Something called BIZX. There's a staffer called "whipslash" going around and answering people's question. He's promising a lot.
They were bought out by Limp Bizkit?
why singled out chinese? (Score:2)
by this, one can get a false impression that this sort of thing is confined to a "chinese manufacturer ", when it isn't.
From the (Score:2)
from the no-shit-sherlock dept?
Start to fix this ... (Score:2, Insightful)
with legislation: (a) that this must be documented (what, where to, ...) and (b) how to switch it off. However that will not happen: (1) most of the legislators do not understand the problem; (2) those that do realise that this would stop $OurCountry products from doing this at the behest of GCHQ/NSA/... So it shall be ignored.
There might be some movement when some government high ups are, through one of these, exposed: in bed with a hooker; snorting white powder; accepting money\Wcampaign-contributions fro
Re: Start to fix this ... (Score:2)
A better way to fix this is to forgo legislation ( think of the level of tech expertise within Congress for just a moment ) and start teaching the average user about the security concerns that comes with convenience.
Obviousl... (Score:2)
Have some fun (Score:5, Funny)
Set up a honeypot consisting of a Chinese DVR and a bunch of security cams pointing at pictures of Minuteman ICBMs sitting in their silos. Sit back and watch your IP address get hacked.
Re: (Score:2)
Better idea. Set it on a long video loop that shows a bunch of missiles launching after several hours of just sitting there.
And in other news... (Score:2)
It gets dark at night, and water is wet...
Giant fucking DUH! to the idiots who didn't think would happen...
Re: (Score:2)
It gets dark at night, and water is wet...
Except at the poles.
Re: (Score:2)
Wet, but frozen, and while there are times at the poles it doesn't get dark at "clock" night, what percentage of the world's population actually lives there :)
Can't turn it off? (Score:2)
Even if the user discovers it, it's still extremely hard to turn off.
Why? Does it continue to draw energy from the ether after you unplug it?
Sounds like an 80s episode of The Twilight Zone...