Slashdot Mirror
Oops: Security Holes In Belkin Home Automation Gear
chicksdaddy writes "The Security Ledger reports that the security firm IOActive has discovered serious security holes in the WeMo home automation technology from Belkin. The vulnerabilities could allow remote attackers to use Belkin's WeMo devices to virtually vandalize connected homes, or as a stepping stone to other computers connected on a home network. IOActive researcher Mike Davis said on Tuesday that his research into Belkin's WeMo technology found the 'devices expose users to several potentially costly threats, from home fires with possible tragic consequences down to the simple waste of electricity.' IOActive provided information on Davis's research to the US Computer Emergency Readiness Team (CERT), which issued an advisory on the WeMo issues on Tuesday. There has been no response yet from Belkin."
Apparently to fix your Linksys, I hear all you need to do is disable: Remote Administration
God spoke to me
As soon as you start having something poking holes through your firewall to allow inbound traffic, this is pretty much a predictable outcome.
The internet of things, smart home monitoring, and thermostats you can adjust from the web ... all of these are things which are going to cause security problems, because most companies doing these kinds of things seem to completely ignore security, or when they try, still do a piss poor job.
I view the whole thing as a big "what did you expect?".
Lost at C:>. Found at C.
...you say Belkin,
let's watch your house get hacked.
John
...from Belkin
What is it with these guys? Every piece of gear of theirs I've tried over the years has been flaky or just plain crap. I realize I don't have a large sample size but I've seen other people make similar comments about their gear. Their stuff just always seems to have some sort of problem.
The hackers got into the home security system and caused it to mis-identify the homeowners as intruders. This caused the home security system to activate its laser targeted rifle and shoot (to kill) one of the homeowners.
Ooops .. sorry .. that was last nights episode of Almost Human
(and its pretty sad when Fox has better Scif-Fi on than the Sy-Fy channel)
I am Slashdot. Are you Slashdot as well?
Remember when this company did this to their routers?
Liberty in your lifetime
Why is anyone surprised? The more stuff you have online, the more targets you have on your back. This reminds me of the arguments after Stuxnet when people were asking why equipment was online that had no business being online. People are trying to set up their house like the Jetson's with everything automated and controllable from their smart phone. Just because you can, doesn't mean you should! http://www.businessinsider.com... http://online.wsj.com/news/art...
IETF made everything possible, but has unfortunately been somewhat abandoned, or at least isn't functioning as a mooring-of-sanity as it used to. In some ways, this is inevitable, since the e-world is big enough that even a small company can do its own thing, and still succeed big.
This matters for IoT, since most cloud-enabled IoT devices do totally random things: poke through firewalls with UPNP, shove your private data into some random website, potentially over insecure protocols. (Or protocols that could be secure, but are implemented poorly or are simply in need of an update.) At some level, the problem is really that the easy path, for any given cloud vendor, is to set up their own cloud infrastructure (though it might be layered on Amazon, etc). This is bad for the customer because what happens when the company crashes, or gets bought and dissolved, or when the company just decides to stop supporting the device?
IETF should be thinking along the lines of a *local* data hub that you own, that your devices talk to over a simpler, standard protocol. Not that security can be ignored just because traffic is local, but an extra level of indirection makes all the difference in hardware as well as software. Whether that local hub is intelligent, whether it has storage - open question. And maybe devices need to fall back to trying to talk to the external cloud. But customers will eventually realize that they should want their own data to at least potentially be under their own control, not inherently subject to the vagaries of some whispy, transient external cloud. You don't want your fire alarm dependent on random external sites, or your internet-enabled door locks, or your thermostat, etc.
That explains all the Black Friday sales on this product. Get them sold before the vulnerability is public. I'm betting they knew about this.
"WeMo dumb, we just got our customers robbed."
Additionally, our mothers are rather large.
Latest firmware contained security fixes.
Any automated control should have a local override to disconnected it from the control loop. This is normal practice in process plants. That way when a hacker takes over your thermostat, you put it in override until the access problem is fixed.
Second, fires by software should not be possible. Protections should be baked into the hardware for home control things that can have e consequences to people.
Not to sound like I'm a crotchety old man telling kids to "stay off my lawn" and eschewing technology, but the Internet of Things really is opening Pandora's box... Currently, manufacturers tend to make a product, find bugs/get user complaints & make a new product. They might produce a few bug/security fixes--but then ignore that product in very short order. But the IoT really changes things, and not for the better...
Here's an example... Walk around your house and figure out the age of all of your appliances. You probably have a few items (e.g. refrigerator) that are pushing 20 years old??? Now, imagine you buy a few shiny new IoT appliances & they're all connected to the Internet--15+ years from now. Seriously, this is a disaster waiting to happen & a hacker's wet dream... Imagine what support will exist 15 years from now for current versions of Android 4.x, Linux 3.x, Apache, PHP, MySQL, etc. Or better yet, what 1999-era software still receives even security patches or bug fixes? (Win9x--nope. Linux 2.2--nope. IIS4--nope. W2K--nope. SQL Server 7--nope... You get my point...)
Ultimately, with the IoT, we're trusting that companies will be willing to support their products, including OS kernel patching on FOSS platforms that were long-abandoned by their progenitors, 25-odd years??? Dream on... I don't intend to replace my fridge or washer in a few years because it got "bricked" because of a security hole the manufacturer chose to ignore...
Belkin's problems are only the beginning...
Windows 3.1x calc: 3.11 - 3.10 = 0.00
If you control your Belkin WeMo's locally like I do (Shell Script To Control Belkin WeMo’s - http://moderntoil.com/?p=839), the answer is as simple as a few firewall rules to stay safe. First, when I read this, I panicked and blocked all outgoing requests from the IP's of my WeMo's, then watched the firewall log to see what they were trying to do. Mine were pinging my LAN default gateway, trying to connect to "184.73.174.14:3478", and trying to connect to multiple IP's on UDP port 123. I adjusted my rules to allow them to hit the default gateway directly (but not NAT through it), since this is probably some check by the local OS on the WeMo's to see if the network is up. I also allowed them to hit anything on UDP 123 (NTP), since without the current time, they can be useless with a schedule. Looking at my logs now, all I see blocked is the constant requests to "184.73.174.14:3478". Local control resumed normally with these changes in place.
So, you're predicting this'll happen to everyone running Teredo-capable Microsoft windows systems (like Win7 for example) that hasn't manually disabled uPnP on their routers, then? Since those systems can (and do!) open incoming ports on most commercial routers and APs without the system owner knowing anything about it...
I wounder why the fridge calls me fat ass all the time?
Or better yet, what 1999-era software still receives even security patches or bug fixes? (Win9x--nope.
Funny that around August 2001 good ol' XP came out, and extended-support-we-really-mean-it-now was applied to its support deadline on this end of of the long rope to 2014 (48.98 days from now).
IE6, managed to achieve a close second in longevity with ~7 years of updates (wikipedia says May 2008 was the latest stable release), but I don't know if they patch it with Windows Updates. It is funny how litte people care that certain devices
Ultimately, with the IoT, we're trusting that companies will be willing to support their products, including OS kernel patching on FOSS platforms that were long-abandoned by their progenitors, 25-odd years??? Dream on... I don't intend to replace my fridge or washer in a few years because it got "bricked" because of a security hole the manufacturer chose to ignore...
I am pretty bitter about industry collusion to destroy old tech via attrition. I'm pretty sure one day you'll walk into the store and just have to buy IoT devices. I mean, try and find monocrome dumbphone this day and age (even ten years ago it was a dying breed). All you can do is buy the tech and try to find a reason NOT to plug it in. But they'll find something tempting to put there, such as FB or tweet feed readers, and presto. I mean, Cat-5 and video-game consoles don't match... DIDN'T until PSNetwork and XBox brought online play into the living room. Lastly, if people distrust their cat 5 and wifi, the companies will just roll their own, or shoehorn it into infant tech. wifi-ac standard can probably jump through the "DRAFT!" ropes with labeling. Wireless N has only been "final" for like 3 years
Please tell me the browser cache is screwing with me. Please tell me that my wife wants to have sex more often ( ok that isn't going to happen, I have a 12 and 15 year old) Do we really have Slashdot.org back?
Security holes in a Belkin something? Go on, you can't possibly be serious.
This is a hacked account, for which the owner can not be held responsible.
Self,
Disconnect chainsaw from home network.
Having to work for a living is the root of all evil.
'The cloud' should not have any access to these devices AT ALL. At most, a hole in the firewall should allow external connections to a server running on the LAN that can then talk to the devices (and that should be entirely optional). They should never even try to phone home for any reason. It's nobody's business but mine which lights are turned on.
That is especially true since according to TFA, Belkin leaked the keys to the kingdom.
Just reconnected my two switches. Let's see.