Slashdot Mirror
Turning the Belkin WeMo Into a Deathtrap
Okian Warrior writes "As a followup to yesterday's article detailing 50 Million Potentially Vulnerable To UPnP Flaws, this video shows getting root access on a Belkin WeMo remote controlled wifi outlet. As the discussion notes, remotely turning someone's lamp on or off is not a big deal, but controlling a [dry] coffeepot or space heater might be dangerous. The attached discussion also points out that rapidly cycling something with a large inrush current (such as a motor) could damage the unit and possibly cause a fire." In the style of Bruce Schneier's movie-plot threat scenarios, what's the most nefarious use you can anticipate such remote outlet control being used for?
Please, please, learn some common sense.
Never have a heater like that unattended, it's just not safe.
One of the worst tech support nightmares I experienced was remotely diagnosing why the Point of Sale servers kept shutting off at the same time every week. It turned out that the outlet the battery backup was plugged into was connected to a light switch that the weekly cleaning people turned off - weekly. When support came into the room, what was the first thing they did? Turn on the lights!
Imagine power cycling all the outlets in a server room - over and over and over!
Forcing someone's DVR to record and play Jersey Shore.
"Hello, 911? I am trapped in my house at 123 Main St. by a gang of armed robbers. I'll blink a lamp to let you know a good time to break down the front door. I'm hiding under a bed, so shoot anyone else."
Q: What does the "B." in Benoit B. Mandelbrot stand for? A: Benoit B. Mandelbrot
In the style of Bruce Schneier's movie-plot threat scenarios, what's the most nefarious use you can anticipate such remote outlet control being used for?
Turn off the fridge after the victim goes to work for the day, and turn it back on about an hour before they get home.
Repeat until they die... of Botulism! <Cue evil laugh>
space heater have temp and tip over switches that can trun it off.
...is that homes often house stupid people.
I haven't thought of anything clever to put here, but then again most of you haven't either.
I just visited the WeMo web pages and couldn't find any technical information about what watt or amperage limits on it are.
I have a hard time believing that it can handle a 1500 watt heater.
1500... Would that be the definition of a WeMowatt? (Beware the sleeping lion tonight.)
This space unintentionally left blank.
Would that be the definition of a WeMowatt? (Beware the sleeping lion tonight.)
Bravo, sir. You win the pun of the day award. I bow before your horrendous pun, and wish I had thought of it first.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
An early episode of "Perry Mason" (ca 1959) turned on the use of an R/C device to manipulate an antiquated gas space heater, establishing an alibi for the killing.
When the inventor of the gadget became a plausible suspect, Mason had the gas line inspected for undocumented repairs. In the end, that made it obvious the real killer had to be the first one to discover the body --- giving himself enough time to remove the device and cover his tracks.
Yes, there's probably someone out there who won't realize their appliances are online, and then these devices start doing things on their own all of a sudden. It will be ghosts, goblins, shenanigans, and lulz for all.
One day at noon a few months ago, my wife was in our kitchen watching a TV show about paranormal activity of some sort or other. At the same time, being unaware that she had gone home for lunch, I was demonstrating my home automation setup to a co-worker by flicking the kitchen lights on and off from my phone.
She is so cool. She immediately assumed I was playing with the home automation. The thought of it being ghosts synchronized with the TV show simply amused her.
I married well.
John
Turn off a co-worker's alarm before a big event. Nasty.
If your co-worker has his alarm clock on a switched outlet of any kind, that says a lot about the level of intelligence your company requires for people doing your job.
I think things like this are the tip of an emerging ice berg relating to the ip-ification of everything:
etc; etc;
To me, all Home Automation does is increase complexity and security risks for some specious conveniences.
Maybe it's just me, but I would rather have to remember that I'm out of Mayo, than have an ip'd fridge send a message to my Android that I need to pick it up at the store.
We play the game with the bravery of being out of range
"She is so cool. She immediately assumed I was playing with the home automation. The thought of it being ghosts synchronized with the TV show simply amused her.
I married well."
Yeah, rub it in harder, will you?
My wife's a programmer.
Do not mock my vision of impractical footwear
All wives are programmers.
Kid-proof tablet..
1. Root these devices, and synchronize their clocks
2. Turn them all off
3. Monitor the power network for a temporary increase in voltage (since load was suddenly shed)
4. Just as the voltage gets back to normal, turn all the devices on.
5. Watch the power network for a temporary decrease in voltage (since load was suddenly added)
6. Just as the voltage gets back to normal, turn all the devices off.
7. Once you have found the resonant frequency of corrections to the electrical grid, tell all the devices to cycle at that frequency.
8. If there is enough load handled by these devices, the system may oscillate so heavily that voltage is far outside of normal, causing overheating or fires (either too high voltage for resistive loads or too low voltage for inductive loads), excessive vibration, design parameter excursions, etc.
All wives are programmers.
Programmer?!
I hardly know her!