Slashdot Mirror
The Spamming Refrigerator
puddingebola writes "The 'Internet of Things' is as susceptible to malware and spam as the rest of the net. From the article, 'A fridge has been discovered sending out spam after a web attack managed to compromise smart gadgets...The spam attack took place between 23 December 2013 and 6 January this year, said Proofpoint in a statement. In total, it said, about 750,000 messages were sent as part of the junk mail campaign. The emails were routed through the compromised gadgets. About 25% of the messages seen by Proofpoint researchers did not pass through laptops, desktops or smartphones, it said.' Read Proofpoint's statement here."
in the era of the 'Internet of things'.
Spam from a refrigerator? That's COLD!
Still think that hooking everything up to the intertubes is a great idea? I can't wait to see what happens with all those home alarms systems that are getting hooked up this way as well.
Om, nomnomnom...
According to Dan Goodin (Arstechnica), who wrote "Is your refrigerator really part of a massive spam-sending botnet?", there are all sorts of problems with Proofpoint's statement. The last paragraph sums it up pretty well:
"Knight said he would check to see if missing evidence—including a malware sample, documentation of a command-and-control server, and samples of the spam and phishing messages—are available for publication. Again, I'm open to the possibility the botnet reported by Proofpoint exists. But until these smoking guns are produced, I'm maintaining a healthy amount of skepticism."
Link: http://arstechnica.com/security/2014/01/is-your-refrigerator-really-part-of-a-massive-spam-sending-botnet/
is what the compromised software really was. I am guessing that these "devices" all used the same opensource embedded WWW server that had a vulnerability.
Probably the biggest issue is that the fridge makers embed this stuff and don't bother to test it for vulnerabilities, assuming that someone else has already done the testing.
While I am a big fan of opensource, blindly using it in a commercial product will lead to all sorts of these types of incidents.
With automatic software updates giving the manufacturer the ability to take away features any time or move the data about your fridge's content to the cloud just for the heck of it? Because that's the alternative to vulnerable appliances, unless you forgo all remote connections, which is the real alternative.
Just because you can, doesn't mean you should. My TV doesn't have internet access and neither will my refrigerator. They are black boxes transmitting untold things. No thanks.
Brave Sir Robin ran away. ("No!") Bravely ran away away. ("I didn't!")
The articles are not backed by any facts, and leave out all technical details. Read this article for more info :Arstechnica
Slashdot: stuff for news, nerds that matter, matter for news, stuff that nerd
Greaybeards can surely recall the longstanding problem of fridges that sent out spam in our youth. usually the payload was cloaked, sandwiched unknowingly in our lunchboxes between two slices of bread or interleaved undetected in the dinnertime protocols frequent 'casserole' traffic. Even worse, the fridge administrator commonly ignored the issue! it wasnt until we had the option to provision and deploy our own refrigerators that we correctly addressed this problem.
Good people go to bed earlier.
Does seems like a bit of a disconnect that we're worried about the electronic security of our net-connected fridges when much of the world is more concerned with the existence of food, let alone what device it goes into let alone how well that device monitors the rfid chips of each bit of it.
I wish I could go back in time to 2005. I wish I could. I would warn the world about Ruby on Rails. I would warn the world about JavaScript. I would warn the world about the hipsters who come preaching those shitty, shitty "technologies". I would warn the world about the destruction these freaks would bring to our industry.
Would anyone listen? I don't know. Intelligent people probably would. They can inherently sense the stupidity of hipsters, JavaScript and Ruby on Rails, even without seeing them in action. But even if nobody listened, at least I could sleep knowing that I tried my best; that I wasn't complacent.
Hipsters and their web fanaticism has caused so much trouble. Website design is utter shit today (just look at the Slashdot beta website for proof of this). All sorts of devices are now "web-enabled" for no good reason at all, with disturbing consequences. Personal and private data harvesting is at an all-time high. Hipsters killed the GNOME desktop project with their half-assed GNOME 3 release.
I wish I could say that I'm an old man, screaming at the kids to "get off my lawn". But I'm just in my 30s! The computing industry truly has been destroyed so quickly by these hipsters, it's quite unbelievable.
I feel immense shame for not having noticed the hipster plague earlier. I feel self disappointment for not having spoken out sooner. It didn't have to come to this.
Oh, wait! I got it: feed the RFID chips to the cows and chickens. That way your milk and eggs will have built-in expiration tags.
Luckily my toaster runs Linux, so that will NEVER be possible.
Don't fight for your country, if your country does not fight for you.
I though it would produce edible spam automatically... nothing to read here... move along, move along
How long for the malware on your Frigidaire spreads to your other GM products?
News Headline: "Chevy Volt leading SPAMMER in America!"
Anyone else more concerned about the frivolous power consumption to which the "internet of things" will contribute?
Spam is a nuisance, but it can be mitigated by simple technological measures, such as spam filters (I won't get into the other security implications, which can be way more serious than spam). However, the effects arising from excessive, needless power consumption, are likely to be much more difficult to mitigate.
Yet another reason not to buy/network these "smart" appliances. I'm all for more use of the internet & connectivity, but not with basic utilities (HVAC, Electric, Water, Fridge/Freezer, Septic, maybe TV). Maybe some basic outputs, like sending out an email warning that your furnace is malfunctioning or your water pressure has dropped but only through unidirectional protocols that are impossible to hack or secondary health monitoring systems that even if hacked would be physically unable to effect the operation of the appliance. I don't want my fridge to try to talk me into helping out a Nigerian prince, my furnace being held for ransom by a piece of malware or my TV flashing male enhancement/porn advertisements when the kids are trying to watch a Disney show/film.
If you give someone the opportunity to make money without holding them to account for the consequences of their actions, don't be surprised when they create, market and sell crappy insecure products to the public.
THIS is what Ralph Nader was talking about in his book "Unsafe At Any Speed". The car makers were putting unsafe, crappy cars (like the early Chevy Corsair) on the road to make money and deliberately rejecting any moral or legal responsibility to make the cars safe. It's happening again: Now we have software makers all over the world from the largest to the smallest that are making crappy insecure software and getting out of any responsibilities through EULAs that let them off the hook. And the software is insecure garbage that allows malicious attackers to screw with the gadget or computer you just bought, so they can rip you off or steal your identity or whatever they like.
And they are going to keep on doing this until there is legislative or other pressure put on them to take responsibility for their actions. You decide how likely that is.
Sometimes the "writing on the wall" is blood spatter...
"Refrigerator Full of Spam"
UTF-8: There and Back Again
Just last week I bought a Fridgidaire Dishwasher.
It has a mechanical timing control, though. Spammers ain't gonna infect a shaded-pole synchronous motor...