Slashdot Mirror
The Spamming Refrigerator
puddingebola writes "The 'Internet of Things' is as susceptible to malware and spam as the rest of the net. From the article, 'A fridge has been discovered sending out spam after a web attack managed to compromise smart gadgets...The spam attack took place between 23 December 2013 and 6 January this year, said Proofpoint in a statement. In total, it said, about 750,000 messages were sent as part of the junk mail campaign. The emails were routed through the compromised gadgets. About 25% of the messages seen by Proofpoint researchers did not pass through laptops, desktops or smartphones, it said.' Read Proofpoint's statement here."
in the era of the 'Internet of things'.
Spam from a refrigerator? That's COLD!
Still think that hooking everything up to the intertubes is a great idea? I can't wait to see what happens with all those home alarms systems that are getting hooked up this way as well.
Om, nomnomnom...
According to Dan Goodin (Arstechnica), who wrote "Is your refrigerator really part of a massive spam-sending botnet?", there are all sorts of problems with Proofpoint's statement. The last paragraph sums it up pretty well:
"Knight said he would check to see if missing evidence—including a malware sample, documentation of a command-and-control server, and samples of the spam and phishing messages—are available for publication. Again, I'm open to the possibility the botnet reported by Proofpoint exists. But until these smoking guns are produced, I'm maintaining a healthy amount of skepticism."
Link: http://arstechnica.com/security/2014/01/is-your-refrigerator-really-part-of-a-massive-spam-sending-botnet/
is what the compromised software really was. I am guessing that these "devices" all used the same opensource embedded WWW server that had a vulnerability.
Probably the biggest issue is that the fridge makers embed this stuff and don't bother to test it for vulnerabilities, assuming that someone else has already done the testing.
While I am a big fan of opensource, blindly using it in a commercial product will lead to all sorts of these types of incidents.
With automatic software updates giving the manufacturer the ability to take away features any time or move the data about your fridge's content to the cloud just for the heck of it? Because that's the alternative to vulnerable appliances, unless you forgo all remote connections, which is the real alternative.
Just because you can, doesn't mean you should. My TV doesn't have internet access and neither will my refrigerator. They are black boxes transmitting untold things. No thanks.
Brave Sir Robin ran away. ("No!") Bravely ran away away. ("I didn't!")
The articles are not backed by any facts, and leave out all technical details. Read this article for more info :Arstechnica
Slashdot: stuff for news, nerds that matter, matter for news, stuff that nerd
Greaybeards can surely recall the longstanding problem of fridges that sent out spam in our youth. usually the payload was cloaked, sandwiched unknowingly in our lunchboxes between two slices of bread or interleaved undetected in the dinnertime protocols frequent 'casserole' traffic. Even worse, the fridge administrator commonly ignored the issue! it wasnt until we had the option to provision and deploy our own refrigerators that we correctly addressed this problem.
Good people go to bed earlier.
Does seems like a bit of a disconnect that we're worried about the electronic security of our net-connected fridges when much of the world is more concerned with the existence of food, let alone what device it goes into let alone how well that device monitors the rfid chips of each bit of it.
I wish I could go back in time to 2005. I wish I could. I would warn the world about Ruby on Rails. I would warn the world about JavaScript. I would warn the world about the hipsters who come preaching those shitty, shitty "technologies". I would warn the world about the destruction these freaks would bring to our industry.
Would anyone listen? I don't know. Intelligent people probably would. They can inherently sense the stupidity of hipsters, JavaScript and Ruby on Rails, even without seeing them in action. But even if nobody listened, at least I could sleep knowing that I tried my best; that I wasn't complacent.
Hipsters and their web fanaticism has caused so much trouble. Website design is utter shit today (just look at the Slashdot beta website for proof of this). All sorts of devices are now "web-enabled" for no good reason at all, with disturbing consequences. Personal and private data harvesting is at an all-time high. Hipsters killed the GNOME desktop project with their half-assed GNOME 3 release.
I wish I could say that I'm an old man, screaming at the kids to "get off my lawn". But I'm just in my 30s! The computing industry truly has been destroyed so quickly by these hipsters, it's quite unbelievable.
I feel immense shame for not having noticed the hipster plague earlier. I feel self disappointment for not having spoken out sooner. It didn't have to come to this.
Oh, wait! I got it: feed the RFID chips to the cows and chickens. That way your milk and eggs will have built-in expiration tags.
Luckily my toaster runs Linux, so that will NEVER be possible.
Don't fight for your country, if your country does not fight for you.
I though it would produce edible spam automatically... nothing to read here... move along, move along
The jokes. They write themselves.
How long for the malware on your Frigidaire spreads to your other GM products?
News Headline: "Chevy Volt leading SPAMMER in America!"
Anyone else more concerned about the frivolous power consumption to which the "internet of things" will contribute?
Spam is a nuisance, but it can be mitigated by simple technological measures, such as spam filters (I won't get into the other security implications, which can be way more serious than spam). However, the effects arising from excessive, needless power consumption, are likely to be much more difficult to mitigate.
Yet another reason not to buy/network these "smart" appliances. I'm all for more use of the internet & connectivity, but not with basic utilities (HVAC, Electric, Water, Fridge/Freezer, Septic, maybe TV). Maybe some basic outputs, like sending out an email warning that your furnace is malfunctioning or your water pressure has dropped but only through unidirectional protocols that are impossible to hack or secondary health monitoring systems that even if hacked would be physically unable to effect the operation of the appliance. I don't want my fridge to try to talk me into helping out a Nigerian prince, my furnace being held for ransom by a piece of malware or my TV flashing male enhancement/porn advertisements when the kids are trying to watch a Disney show/film.
If you give someone the opportunity to make money without holding them to account for the consequences of their actions, don't be surprised when they create, market and sell crappy insecure products to the public.
THIS is what Ralph Nader was talking about in his book "Unsafe At Any Speed". The car makers were putting unsafe, crappy cars (like the early Chevy Corsair) on the road to make money and deliberately rejecting any moral or legal responsibility to make the cars safe. It's happening again: Now we have software makers all over the world from the largest to the smallest that are making crappy insecure software and getting out of any responsibilities through EULAs that let them off the hook. And the software is insecure garbage that allows malicious attackers to screw with the gadget or computer you just bought, so they can rip you off or steal your identity or whatever they like.
And they are going to keep on doing this until there is legislative or other pressure put on them to take responsibility for their actions. You decide how likely that is.
Sometimes the "writing on the wall" is blood spatter...
Nuke the fridge!
I realize that the "Internet of Thins" is the latest trend/b/b/b/b/b fad, but why??? Why do I really want my refrigerator communicating over the Internet?
I just want it to keep my food cold. If the temperature is not right, I want a dial to turn to adjust it.That's all folks!
Will that simple temperature adjustment dial be replaced by monthly service charges, firmware upgrades, and "Norton Refrigerator Antivirus"?
WHY?
While NSA bulk collection of all communications is legal and protected by US Federal law and anyone else can do the same there is still the question of 'Intent To Do Evil By Who And To Who.'
Answering the 'intent' question is easy. We already know for sure that Obama is evil and any other 'head of state' is evil as well, goes with the job.
The good news is embedding all sorts of appliances, like the fridge, washer, lamps, dinning table and chairs, bed, toilet, walls etc with internet enables communications devices that can be co-oped for spam on a 'Planetary Scale.'
That throws a beautiful monkey wrench into NSA's and Obama-Evil-Dooer's game plans.
In the near future our communications that we really care about will be hidden in a Terr-byte cloud of chaff as they glide along the internet to where ever destination they are to go.
Just like in WWII, chaff is cheap and effective.
Good news for us, bad news for evil-dooers like Obama.
"Refrigerator Full of Spam"
UTF-8: There and Back Again
Just last week I bought a Fridgidaire Dishwasher.
It has a mechanical timing control, though. Spammers ain't gonna infect a shaded-pole synchronous motor...
How much longer until a can of spam has an IP address?
Nearly all the comments in this thread are either buying the troll, or the flamebait that ensues... no one seems to be arguing against the basic premise that IoT is inherently insecure. Yes, it's true, firewalls should secure such devices unless you are doing it horribly, horribly wrong, but that's not why IoT is not inherently insecure. There would be no ability for viruses or to even send fake emails if they didn't create a needlessly huge attack surface. The most complex OS the thing should be running is linux, and no, not redhat or debian, or some desktop version of linux. There should not be a mail server (client only if necessary). There should not be any other services running. Ideally, for cost, energy efficiency, and a few 100 other reasons I won't get into here, they should be running a custom firmware flashed onto an ARM chip or similar, that does nothing other than what you want the fridge to do. Only unskilled morons would do otherwise.
*IF* this story is even true, the failure is not IoT, but some clueless company thinking you can just run a Refrigerator-"App" on top of Windows CE, or Android, or some other very-ill-suited commodity OS.
Surely wouldn't most home routers block incoming attacks? Or were these devices all setup using port forwards on victims firewalls?
Who in their right mind would listen to anyone who killed Hitler instead of Stalin or Mao (or why not go for the source: Marx).
How dumb are you?
Maybe killing an infant Mohammed would be even better for humanity but like a brain perfectly formed by a cookiecutter your aim is the least common denominator instant political correctness meta bad guy Hitler? "Bad socialist, bhhaaaad!"
Your neurons should be dying from shame.