Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
Ghost Leviathan
Mar 2, 2017

Exploration is ill-advised.
You know what simple household appliances need? More points of failure, and to be more difficult to use. The Simpsons Y2K episode is apparently the future.

Point is, adoption of the Internet of Things seems hamstrung by the demonstrable failure of devices that don't actually give a noticeable boost to their users' quality of life, and that's when the drat things actually work properly in the first place. Otherwise we'd all be making 3D videophone calls on our smart fridges right now.

Adbot
ADBOT LOVES YOU

Tei
Feb 19, 2011

Maybe by 2085 we will have full employement, if all these IoT devices get somebody to update them so they dont have know holes. Thats a lot of sysop jobs.

Lightning Lord
Feb 21, 2013

$200 a day, plus expenses

Tei posted:

Maybe by 2085 we will have full employement, if all these IoT devices get somebody to update them so they dont have know holes.

Nah we'll all be dead from hacked stoves that burn people, hacked cars that drive off bridges, etc

3D Megadoodoo
Nov 25, 2010

I just visited a supplier that bought a second-hand robot arm and customized it to make a very specific thing for us. They're a really small local outfit and they could actually produce it in half the time manually, but this way they can just work out at the gym on the loft or work on their bikes all day, and then if they get some other order they can start making that without stopping production of our part. I was rather impressed at how well they'd embraced automation considering it's literally a guy working out of his garage with his dad helping out.

tl;dr: Automation is cool and good when it allows smart small operators to compete with big outfits while improving their quality of life.

Owlofcreamcheese
May 22, 2005
Probation
Can't post for 9 years!
Buglord
I never get being really freaked out about HACKERS and smart devices. Like I guess it's bound to happen but we already have computers and cell phones and hundreds of apps and websites and I never get why one more becomes the bridge too far. Like I guess someone might hack my bluetooth connected toaster and I'd rather they not but I'm not sure why that is supposed to be any more scary than them hacking the pizza ordering app I have on my cell phone, let alone hacking my online bank account or something.

Like someone hacking my lights would be mildly annoying but it doesn't even seem like it'd be in the top ten percent of inconvenience of things a person could hack. Like I don't get why I am supposed to be all pearl clutching about fear of scary hackers at this and not everything else? It feels like someone warning me I shouldn't buy a clock because someone could break into my house and steal it. Like, that is true, someone could, they aren't wrong, people have stolen clocks out of people's houses, but it's not even in the top ten things someone could break into my house to steal, and I already own things that could be stolen so a clock is just one more thing on a list that already includes "everything".

A Buttery Pastry
Sep 4, 2011

Delicious and Informative!
:3:

Owlofcreamcheese posted:

I never get being really freaked out about HACKERS and smart devices. Like I guess it's bound to happen but we already have computers and cell phones and hundreds of apps and websites and I never get why one more becomes the bridge too far. Like I guess someone might hack my bluetooth connected toaster and I'd rather they not but I'm not sure why that is supposed to be any more scary than them hacking the pizza ordering app I have on my cell phone, let alone hacking my online bank account or something.

Like someone hacking my lights would be mildly annoying but it doesn't even seem like it'd be in the top ten percent of inconvenience of things a person could hack. Like I don't get why I am supposed to be all pearl clutching about fear of scary hackers at this and not everything else? It feels like someone warning me I shouldn't buy a clock because someone could break into my house and steal it. Like, that is true, someone could, they aren't wrong, people have stolen clocks out of people's houses, but it's not even in the top ten things someone could break into my house to steal, and I already own things that could be stolen so a clock is just one more thing on a list that already includes "everything".
You'll change your tone when you come home to a refrigerator that was turned off by hackers, then go to the store and see empty shelves because it happened to everyone in the country.

Call Me Charlie
Dec 3, 2005

by Smythe
I can understand it with devices that have a camera or smart locks or smart garage doors since those would give access to your home. Somebody hacking my lights or gaining access to my Alexa recordings...ehhhhhh. They'd either be mildly inconveniencing me (oh no, I have to unplug my bedroom lamp) or listening to hundreds of recordings of me asking my Echo 'what time it is', 'how do you spell [x] word' or 'shuffle my funk music'

mobby_6kl
Aug 9, 2009

by Fluffdaddy
It's not just that somebody could turn your lights on and off, by hacking them they might also a) use it to run denial of service attacks and b) gain access to other devices or services on your network. This is something that needs to be taken absolutely seriously and we should avoid making critical devices accessible to the whole internet. But I also don't think it will (or should) prevent progress.

A ton of IoT stuff now is useless garbage, but that's to be expected with a new paradigm when everyone just throws poo poo at the wall. There are plenty of great use cases for it that can genuinely improve your daily life.

Xae
Jan 19, 2005

mobby_6kl posted:

It's not just that somebody could turn your lights on and off, by hacking them they might also a) use it to run denial of service attacks and b) gain access to other devices or services on your network. This is something that needs to be taken absolutely seriously and we should avoid making critical devices accessible to the whole internet. But I also don't think it will (or should) prevent progress.

A ton of IoT stuff now is useless garbage, but that's to be expected with a new paradigm when everyone just throws poo poo at the wall. There are plenty of great use cases for it that can genuinely improve your daily life.

The Accessibility factor for IOT and smart home stuff is huge.

The first guy I know who jumped on it was my uncle. His wife his problems with fine muscle control. She doesn't need to fumble with switches anymore she can simply tell Alexa to turn on the lights she wants on. If she is too hot or too cold she can adjust the Temp. She can make calls with out dialing a number or fumbling with menus.

Owlofcreamcheese
May 22, 2005
Probation
Can't post for 9 years!
Buglord

A Buttery Pastry posted:

You'll change your tone when you come home to a refrigerator that was turned off by hackers, then go to the store and see empty shelves because it happened to everyone in the country.

Like I guess that would be a medium amount of inconvenient?

It really really does sound like "don't own a clock, someone could break in and steal it". It's not untrue, it's not wrong. But like, I already own things, I already use computers for things. Why should this one thing give me the vapors worrying about compared to anything else?

Like I have computer controlled lights right now, I wouldn't like it if someone hacked into them and flashed them at night or whatever but that doesn't even feel like it'd be in the top 50 accounts I have that would be most annoying if someone hacked.

A Buttery Pastry
Sep 4, 2011

Delicious and Informative!
:3:

Owlofcreamcheese posted:

Like I guess that would be a medium amount of inconvenient?
Death from starvation is not simply an inconvenience.

Owlofcreamcheese
May 22, 2005
Probation
Can't post for 9 years!
Buglord

A Buttery Pastry posted:

Death from starvation is not simply an inconvenience.

What sort of diet do you live on that you'd starve to death if your refrigerator went out? Have you never lived anywhere there is power outages? It'd be like a large power outage that wasn't even as bad as a real power outage and didn't effect stores or restaurants or anything but some people's home refrigerators.

Chakan
Mar 30, 2011
I think you're getting lost in the example they chose. The point is that IoT is dangerous because everything you hook up to it can be disabled. Individually, a broken fridge isn't usually a grave threat but on a country-wide scale it could be, or automated trucks all being disbaled, etc. DDoS attacks also become more dangerous as people can use your DVD player to attack amazon, and there's no real solution because nobody builds a system that can withstand every camera and lightbulb in the world sending requests.

e: not to say there aren't uses for stuff like this, the woman who can turn off her lights and makes calls using voice is fortunate Alexa exists, but it's still something we have to be aware of.

Chakan fucked around with this message at 15:52 on Jul 10, 2017

Cicero
Dec 17, 2003

Jumpjet, melta, jumpjet. Repeat for ten minutes or until victory is assured.

Xae posted:

The Accessibility factor for IOT and smart home stuff is huge.

The first guy I know who jumped on it was my uncle. His wife his problems with fine muscle control. She doesn't need to fumble with switches anymore she can simply tell Alexa to turn on the lights she wants on. If she is too hot or too cold she can adjust the Temp. She can make calls with out dialing a number or fumbling with menus.
This seems to be a common pattern, where something that's a nice but unnecessary luxury for the rich is a huge life-saver for people with some handicap. E.g. for the average adult, buying a self-driving car will mostly be for convenience: now I can do something other than driving! Cool! But for a blind or very elderly adult, it means you go from not being able to drive to being able to drive, a huge lifestyle and productivity change for people in most of America.

edit: another example is ebooks. For most people, they're just like regular books but more convenient to carry around with you. For a blind person, it means being going from almost all books being inaccessible to being able to access the contents of most books through text-to-speech tools.

Cicero fucked around with this message at 16:03 on Jul 10, 2017

Owlofcreamcheese
May 22, 2005
Probation
Can't post for 9 years!
Buglord

Chakan posted:

I think you're getting lost in the example they chose. The point is that IoT is dangerous because everything you hook up to it can be disabled. Individually, a broken fridge isn't usually a grave threat but on a country-wide scale it could be, or automated trucks all being disbaled, etc. DDoS attacks also become more dangerous as people can use your DVD player to attack amazon, and there's no real solution because nobody builds a system that can withstand every camera and lightbulb in the world sending requests.

I keep saying the same example but it really just sounds like "don't own a clock because burglars could steal your clock" it's not factually incorrect but it's such a weirdly specific fear that applies to literally everything and also wouldn't even be the top 50 worst thing to get stolen. Like I guess a hacker might hack my internet microwave and I wouldn't like that but I already have an internet connected retirement account and car insurance and bank login and sensitive work email and like 120 other website logins and phone apps. Why is THIS the place I should get super afraid? We all already have stuff that is so much vastly more important online already, why is this the thing we are supposed to be terrified of?

And like you said, they could be used to attack something else. But like, again, that isn't some magic special property of the computers in new things, someone already could do that to the computers we already have. It's just an argument against the concept of having computers in houses at all, not one that applies special to computers in toasters.

Cicero
Dec 17, 2003

Jumpjet, melta, jumpjet. Repeat for ten minutes or until victory is assured.
People are more scared because IoT concerns physical things. Stuff like account logins or even bank account info feels more abstract.

A Buttery Pastry
Sep 4, 2011

Delicious and Informative!
:3:
Not saying bank security is necessarily as good as it should be, but I've read stuff about how a lot of these IoT devices have basically no security at all, which might warrant some concern? Like, could an easily hackable refrigerator be a backdoor into more sensitive stuff, if all your poo poo was part of some integrated network?

Chakan
Mar 30, 2011
Ah, I forgot this was a thread I needed to check the name of the someone before I responded. Sorry everyone.

In earnest, if you're asking whether you should be worried about stuff like your bank account, yes you should. If you're asking whether an internet connected device is easier to hack at a bank or house, the latter, and this is cause enough for fear, because there are enough people with "admin" as their router password that someone can hack a lot of houses easily leading to the DDoS problem.The fear, on a personal level is they will set the temperature on a nest to 85 and set an oven to "on" while the owners are on vacation. Macro-scale it means things like a business will have a leak and all of their auto-trucks will be disabled.

I'm not saying you, Owlofcreamcheese, shouldn't be more afraid of losing your life savings than your IoT toaster burns your toast one morning because it was hacked. I'm saying there are dangers of IoT and automation that are not being considered by most people involved.

Guavanaut
Nov 27, 2009

Looking At Them Tittys
1969 - 1998



Toilet Rascal

A Buttery Pastry posted:

Not saying bank security is necessarily as good as it should be, but I've read stuff about how a lot of these IoT devices have basically no security at all, which might warrant some concern? Like, could an easily hackable refrigerator be a backdoor into more sensitive stuff, if all your poo poo was part of some integrated network?
That and my bank is insured if they get hacked. I'm not necessarily insured if I get hacked and someone gets my bank information, but that's why banks have things like keylogger countermeasures and airgapped devices like CAP/DPA as part of their authentication.

Owlofcreamcheese
May 22, 2005
Probation
Can't post for 9 years!
Buglord
I agree it'd be bad if iot devices are extremely poorly programmed but again I'm not exactly clear why I'm supposed to hold this fear specifically about this compared to anything else?

Like it'd be really bad if my laptop was extremely poorly programmed or if my phone was? It's not exactly a hot take to point out "it's bad if things are programmed bad". Like I guess wait till apple releases a toilet if you want a company you can trust to run software and hardware, or throw away the phone and laptop you already own that already manage extremely important data if you don't trust apple.

Like hacking is a real and serious problem but it's not a new problem that having a computer controlled dish washer introduces that wasn't a problem a person already faced 500x times already by having a computer controlled computer.

A Buttery Pastry
Sep 4, 2011

Delicious and Informative!
:3:

Owlofcreamcheese posted:

I agree it'd be bad if iot devices are extremely poorly programmed but again I'm not exactly clear why I'm supposed to hold this fear specifically about this compared to anything else?
The issue is that IoT poo poo might be especially poorly secured.

ElCondemn
Aug 7, 2005


Owlofcreamcheese posted:

I agree it'd be bad if iot devices are extremely poorly programmed but again I'm not exactly clear why I'm supposed to hold this fear specifically about this compared to anything else?

Like it'd be really bad if my laptop was extremely poorly programmed or if my phone was? It's not exactly a hot take to point out "it's bad if things are programmed bad". Like I guess wait till apple releases a toilet if you want a company you can trust to run software and hardware, or throw away the phone and laptop you already own that already manage extremely important data if you don't trust apple.

Like hacking is a real and serious problem but it's not a new problem that having a computer controlled dish washer introduces that wasn't a problem a person already faced 500x times already by having a computer controlled computer.

It's not a big deal most IOT devices don't even use wifi, they run their own protocol specific networks like zigbee and zwave.

People freak out because they imagine a voyeur watching them through their security cameras or listening to what they're saying.

In reality the biggest threats are things like smart tvs and set top boxes that use technologies like UPNP to open ports and make themselves directly accessible to public networks. These hubs that control your lights and stuff are quite a bit harder to exploit since they're not directly accessible. You'd have to hack the service provider and then also find an exploit that would give the hacker a way to execute arbitrary code on the devices since that's not how the hubs normally work.

But also like you said, having your lights not work properly is pretty minor compared to your bank credentials being captured and used.

I wouldn't trust the opinions of most of the people in this thread, they've watched a few too many singularity YouTube videos and see themselves as automation experts.

Owlofcreamcheese
May 22, 2005
Probation
Can't post for 9 years!
Buglord

A Buttery Pastry posted:

The issue is that IoT poo poo might be especially poorly secured.

Bad things are bad. But that already applies to everything ever. What if they added computers to telephones? It could be really bad if they added bad computers. But instead they added mostly good computers and it's mostly been good. Mostly.

Like I get it that some companies might release bad products that are bad, that will definitely happen but it seems like such a weird thing to worry about. We have managed to use computers for all sorts of things and had it gone pretty well, hacking isn't a fake problem that never happens but we have gotten good enough at dealing with it that the idea of using a computer for a thing isn't unthinkable. "what if my shower temperature control is programmed BAD" doesn't seem like a more intractable problem than "what if my email client is programmed BAD" or any higher stakes.

SpaceCadetBob
Dec 27, 2012
Right now IoT objects tend to run on normal wifi because there isn't enough unique smart home gear to make ownership of a specific smart home hub worth purchasing for most people. As these standards develop and devices proliferate I'm sure the tech will smooth out and a smart home hub running @ 900 mhz or whatever freq they decide to go with will become as ubiquitous in a home as a wifi router is today.

I really don't see turning back the clock on home automation. Between the few smart lights and Echo's scattered through my house life with a small baby is just plain easier. I could not see ever going back to dumb light bulbs.

Owlofcreamcheese
May 22, 2005
Probation
Can't post for 9 years!
Buglord

SpaceCadetBob posted:

I really don't see turning back the clock on home automation. Between the few smart lights and Echo's scattered through my house life with a small baby is just plain easier. I could not see ever going back to dumb light bulbs.

Yeah, I just have a few smart home and connected devices and it feels so natural to just have multiple ways to control things and to use IFTTT type stuff to hook up little simple scripts. Like no one function is super earth shattering or life changing but it's easy to see how just having the inputs and outputs available to a couple different things ends up being really useful.

Tei
Feb 19, 2011

We had recently a huge DDoS that affected half the internet because these devices uses telnet for access and default passwords like admin and 12345. There are million of these.

Once the original company have sell the toaster with the CPU and firmware, theres not economic interest in mantaining that thing. So it will run like a ship withouth a captain, until some malicious hackers find it.
Thats the main problem, it has not economic sense to patch and do some maintenance in these devices, so they will grown old, accumulate know bugs. They will become vectors for worse things as a way to create a lot of destruction.

A toaster can start a fire, a refreigerator can stop mantaining foods. A army of toasters of refrigerators can stop the economy of a small city.

We fear and need a laws to stop this before it growns to big a problem. And is already pretty big with all these taiwanese IP cameras and so on.

Tei fucked around with this message at 19:48 on Jul 10, 2017

Mozi
Apr 4, 2004

Forms change so fast
Time is moving past
Memory is smoke
Gonna get wider when I die
Nap Ghost
I got Hue lights and an Echo and all I do is tell the Echo to turn the lights on or off, which works less well than flipping the switch. Communicating with the Echo just drives me up the wall; anything I'd want to do is easier on a computer.

My Mom loves her Echo so maybe it's a generational thing?

All I've done is add complexity and cost. And the lights come on full brightness after a power outage.

OK, the Echo is also handy for doing measurement conversions when your hands are full or covered with stuff. But that's not really IoT-related.

ElCondemn
Aug 7, 2005


Tei posted:

We had recently a huge DDoS that affected half the internet because these devices uses telnet for access and default passwords like admin and 12345. There are million of these.

Once the original company have sell the toaster with the CPU and firmware, theres not economic interest in mantaining that thing. So it will run like a ship withouth a captain, until some malicious hackers find it.
Thats the main problem, it has not economic sense to patch and do some maintenance in these devices, so they will grown old, accumulate know bugs. They will become vectors for worse things as a way to create a lot of destruction.

A toaster can start a fire, a refreigerator can stop mantaining foods. A army of toasters of refrigerators can stop the economy of a small city.

We fear and need a laws to stop this before it growns to big a problem. And is already pretty big with all these taiwanese IP cameras and so on.

First off the "huge DDoS that affected half the internet" didn't do poo poo, it was a minor blip and most people didn't notice a thing, because these kinds of attacks are happening constantly on the internet. Secondly, this wasn't caused by "IoT devices", unless you consider home routers and security cameras IoT now.

Your connected toaster problem implies that by hacking it you will then be able to turn on the toaster and make it heat up past it's normal operating parameters, care to explain how that will actually happen? The mirai exploit didn't do poo poo that isn't already being done to insecure linux systems on the internet today. It's not like these "hackers" did anything interesting or exceptionally nefarious, they didn't cause any havoc that a normal DDoS as we see every day does. Even if you're talking about something with actual impact like a car you're still way off base, it's just you have a fundamental misunderstanding of how these computers work and what they can and can't do.

Mozi posted:

I got Hue lights and an Echo and all I do is tell the Echo to turn the lights on or off, which works less well than flipping the switch. Communicating with the Echo just drives me up the wall; anything I'd want to do is easier on a computer.

My Mom loves her Echo so maybe it's a generational thing?

All I've done is add complexity and cost. And the lights come on full brightness after a power outage.

OK, the Echo is also handy for doing measurement conversions when your hands are full or covered with stuff. But that's not really IoT-related.

The cool stuff happens when you add in sensors and smart remotes and stuff, I don't have to even think about lighting in my house anymore and I save money doing it too. Also talking to echo to do unit conversion is exactly what IoT stuff is all about.

ElCondemn fucked around with this message at 20:15 on Jul 10, 2017

Tei
Feb 19, 2011

ElCondemn posted:

Your connected toaster problem implies that by hacking it you will then be able to turn on the toaster and make it heat up past it's normal operating parameters, care to explain how that will actually happen?

By ignoring the temperature? checks that are done in the firmware will be ignored. We don't live in the perfect world where this is imposible.

ElCondemn
Aug 7, 2005


Tei posted:

By ignoring the temperature? checks that are done in the firmware will be ignored. We don't live in the perfect world where this is imposible.

Again you're just so loving wrong about how these systems work. How do you make that happen? Explain how you write code and get it onto a single device which you don't have any physical access to? How does your connected toaster turn itself on?

Guavanaut
Nov 27, 2009

Looking At Them Tittys
1969 - 1998



Toilet Rascal
What's the use of IoT devices that can't be told to do things remotely?

Or are we talking pure telemetry, like I put the toaster on manually and it sends me an app push when my toast is almost done?

Tei
Feb 19, 2011

ElCondemn posted:

Again you're just so loving wrong about how these systems work. How do you make that happen? Explain how you write code and get it onto a single device which you don't have any physical access to? How does your connected toaster turn itself on?

You download the firmware from SmartToasters.com.tw , then use a deassembler to get the assembler code. That you read. There you find theres a default password 12345 and you can connect to it trough POST commands in port 80.

Theres also many buffer overflows. Because the code seems programmed in C or other language withouth memory handling, and the manual memory handling is bad.

You don't find this toasters on the internet, because don't actively open ports. But you have other attack vector inside some poorly programmed smart TV or home router that you use to find automatically toasters like this one. So once a toaster is found, you use the buffer overflow and the admin password to run some code that force the toaster to load a new firmware you made.

The newfirmware ignore temperature checks, you can activate "infinite maximum heat" and once is feed some bread, it will continue heating it forever at maximum temperature.

Oh, SmartToasters Taiwan has closed doors. Now your job is even easier, you buy the domain SmartToasters.com.tw, and you can directly upload your new firmware to the 4 million toasters in the world made by STT.

The firmware is "digitally signed", but is some retarded CRC sign by blocks, and theres a bug in the firmware, and only checks the first block. Now you can cause small fires in 4 million homes.

ElCondemn
Aug 7, 2005


Guavanaut posted:

What's the use of IoT devices that can't be told to do things remotely?

Or are we talking pure telemetry, like I put the toaster on manually and it sends me an app push when my toast is almost done?

a) The software you use to control the toaster is not the same software that is used to actually "make the toast". There's a level of abstraction there, the toaster "chip" has all the functions built in like how to turn the toaster on and off (which for a toaster is literally the only thing it does). To make a toaster heat up beyond it's specifications you'd have to somehow force a hardware voltage regulator to heat up the heating element hotter than its hardware was designed to do. If there is nothing in the toaster and it's on for 12 hours it will not keep getting hotter until it sets the home on fire, it only gets as hot as its hardware was designed to.

b) I doubt that toasters will have access to the "on" function, since that is usually a spring loaded mechanism that requires manual setting. Certainly a connected toaster could spring your toast but I would seriously doubt any time in the near future we'll have toast machines that can load the toast, toast it and remove it without human interaction. There would literally be no point in adding a connected "on" button unless it can do the whole process end to end on its own.

c) Most IoT devices are low power devices that respond to a limited set of commands, to make them perform any action outside of those commands would require writing new firmware. To install firmware to a device you either need physical access to connect to specific headers on the board, or you have to have an online update process. In either case your firmware is going to have a chip that contains a public key on it, and only software signed with the private key will be allowed to be run on that hardware. Remote code execution is more of a concern for the connected software part of the code, since it typically includes binaries that aren't signed and that are designed to run arbitrary code (like a linux kernel running a web server). But again, there isn't much concern there unless you're afraid of your router being used to DDoS people or spy on you, which can be easily mitigated by not running a web server and using technologies like websockets and message queues to trigger actions on these IoT devices (which most of them do).

Guavanaut
Nov 27, 2009

Looking At Them Tittys
1969 - 1998



Toilet Rascal
There is no hardware voltage regulator in a toaster, the element just has a resistance designed not to draw more than a certain current, like an electric fire. So if it could be kept on for more than the designed time, pumping heat into the toaster space at a constant rate, it's feasible that it could overheat the toaster beyond the materials spec.

Hopefully whoever designed one would keep the bimetallic strip as a hardware trip on the element power supply and spring latch, which is the current workaround for that. If they tried getting fancy and replacing it entirely with a solenoid controlled by the on/off chip then it would open up other control loop issues not even needing malicious remote toast actors.

Why do we want bidirectional control of a toaster over the internet again? One that makes something else beep so I can tell when it's done from another room would be cool enough.

Bar Ran Dun
Jan 22, 2006




If we expect individuals/groups in the future to be able to do what nationstates can do in the present. That's a pantshittingly dangerous future.

ElCondemn
Aug 7, 2005


Tei posted:

You download the firmware from SmartToasters.com.tw , then use a deassembler to get the assembler code. That you read. There you find theres a default password 12345 and you can connect to it trough POST commands in port 80.

Assuming your toaster runs a web server instead of a client that opens a socket to smarttoasters.com.tw like most IoT devices do. Most of these devices are behind a NAT or firewall and it doesn't make sense to run a web server at all, again the big fear people had was over routers and ip cameras that are running web servers and explicitly open up access to the public internet.

Tei posted:

Theres also many buffer overflows. Because the code seems programmed in C or other language withouth memory handling, and the manual memory handling is bad.

Again, you're assuming there's a server running somewhere to be exploited. A client doesn't accept connections remotely to be overflowed.

Tei posted:

You don't find this toasters on the internet, because don't actively open ports. But you have other attack vector inside some poorly programmed smart TV or home router that you use to find automatically toasters like this one. So once a toaster is found, you use the buffer overflow and the admin password to run some code that force the toaster to load a new firmware you made.

Yes, if your TV runs a web server and opens ports externally and has the ability to run arbitrary code and has network access. How many hoops do we jump through again?

Tei posted:

The newfirmware ignore temperature checks, you can activate "infinite maximum heat" and once is feed some bread, it will continue heating it forever at maximum temperature.

Ok, so assuming you somehow found a way to install firmware remotely that can turn off a temperature check feature, chances are you still wont be able to turn it on remotely but even if you do you're assuming that these toasters have heating elements and power supplies that catch fire if they're left on at max temp forever. I would argue that there we have consumer testing companies that do things like "leave the toaster on at max temp for days at a time" to ensure that won't happen today.

Tei posted:

Oh, SmartToasters Taiwan has closed doors. Now your job is even easier, you buy the domain SmartToasters.com.tw, and you can directly upload your new firmware to the 4 million toasters in the world made by STT.

Again these types of devices use a client with a limited protocol, but say you own the domain and you know the command you need to send to force it to download new firmware... did you forget that we have signed software? Did you forget that these clients have a client cert and only trust the CA for smarttoasters.com.tw that's been signed by the same cert? They are designed this way to prevent man in the middle attacks, whats stopping you from pointing your DNS to your own web server today to hijack your own device? Give it a try and tell me how much luck you have doing that!

Tei posted:

The firmware is "digitally signed", but is some retarded CRC sign by blocks, and theres a bug in the firmware, and only checks the first block. Now you can cause small fires in 4 million homes.

So if you somehow own the domain, own a valid cert, know how to make the client download firmware from your host and find a bug that allows you to exploit CRC to install firmware that hasn't been signed by an authorized CA... well then you got me man, you are a 1337 hacker and have proven that running any connected device is insecure and a bad idea... that is unless you look at the effort required and compare that to actual exploits in the wild...

Locks on your front door don't protect your home, they just increase the amount of effort it takes a criminal from entering your home. The same is true of software security.

Owlofcreamcheese
May 22, 2005
Probation
Can't post for 9 years!
Buglord

Tei posted:

We had recently a huge DDoS that affected half the internet because these devices uses telnet for access and default passwords like admin and 12345. There are million of these.

Bad things are bad.

This is exactly like saying cell phones could never work because they might make really bad ones and that would be awful. It turns out they did make some bad phones then later they made some phones people generally have decided work okay and it all worked out fine.

Just buy an apple brand toaster when those come out if you don't want to use some early possibly bad model by a company you don't like and if you don't trust apple then worry that they already made your computer/phone (or microsoft or dell or google or whoever) which already gave them something a trillion times more important and powerful they could mess up.

Owlofcreamcheese
May 22, 2005
Probation
Can't post for 9 years!
Buglord

Guavanaut posted:

Why do we want bidirectional control of a toaster over the internet again?

IFTTT doesn't have any toasters yet but looking at ovens the most popular scripts all seem reasonably useful and some of them are actually super clever like "turn on the vent hood fan", "turn off the oven if your smoke alarm is going off" and "turn off the oven if you leave the house" as well as various alerts.



People are generally really good at finding super clever links to set up. "turn off the oven when the smoke alarm goes off" seems an actually good and smart feature to have if nothing else.

ElCondemn
Aug 7, 2005


Guavanaut posted:

There is no hardware voltage regulator in a toaster, the element just has a resistance designed not to draw more than a certain current, like an electric fire. So if it could be kept on for more than the designed time, pumping heat into the toaster space at a constant rate, it's feasible that it could overheat the toaster beyond the materials spec.

Hopefully whoever designed one would keep the bimetallic strip as a hardware trip on the element power supply and spring latch, which is the current workaround for that. If they tried getting fancy and replacing it entirely with a solenoid controlled by the on/off chip then it would open up other control loop issues not even needing malicious remote toast actors.

I'm not a toaster expert but it seems like a problem that's been solved in the 100+ years toasters have been around. Either way I think a toaster is just a stand-in for whatever scary device that's in everyone's home that could go nuts and kill you, I'm just trying to point out how it's an irrational fear. Like I think we're both saying it doesn't make a lot of sense to have a solenoid controlled on button on a toaster since it opens itself up to catastrophic failure, while a bimetallic strip is a simple low tech solution that prevents that poo poo.

Guavanaut posted:

Why do we want bidirectional control of a toaster over the internet again? One that makes something else beep so I can tell when it's done from another room would be cool enough.

But it'll get hacked! Do you really want some shady hacker to know how dark you like your toast?

Adbot
ADBOT LOVES YOU

ElCondemn
Aug 7, 2005


Owlofcreamcheese posted:

IFTTT doesn't have any toasters yet but looking at ovens the most popular scripts all seem reasonably useful and some of them are actually super clever like "turn on the vent hood fan", "turn off the oven if your smoke alarm is going off" and "turn off the oven if you leave the house" as well as various alerts.



People are generally really good at finding super clever links to set up. "turn off the oven when the smoke alarm goes off" seems an actually good and smart feature to have if nothing else.

These are really cool and I'm sure your oven won't catch fire if it's left on all day. What they most likely did was just add a computer to this thing and wire up the control interface to the computer, that way they can control it via the physical interface or a virtual one. I doubt there's even any way to update the firmware that operates the actual oven, what could they possibly update in the possibly non-existent firmware to improve an oven that can't be done via the connected computer?

  • Locked thread