Slashdot Mirror
Tattling Kettles Help Researchers Crack WiFi Networks In London (pentestpartners.com)
New submitter campuscodi writes: Security researchers at Pen Test Partners have found a security vulnerability in the iKettle Wi-Fi Electric Kettle that allows attackers to crack the password of the WiFi network to which the kettle is connected. Researchers say that using this simple trick and information about iKettles, they drove around London, cracked home WiFi networks, and created a map of insecure WiFi networks across the city. The same researchers cracked a Samsung smart-fridge this summer to disclose Gmail passwords. If you have 6 minutes, there's a YouTube video you can watch.
...I gotta go google what the fuck an iKettle is? Is this like a crockpot wired to the internet for some reason?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Life imitates art, except that the people who own the pot aren't the ones using it.
When will you learn a Wi-Fi enable Tea Kettle is a horrible Idea.
Oh I just got a message from my Wi-Fi enabled coffee machine that my coffee is done.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
This is a case of the pot calling the kettle hacked.
[Puts on sunglasses] Yeah!
This is like Talkie the Toaster, but it's a tea kettle?
And all modern crackpots are wired to the internet these days.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Are you seriously telling me people would buy this and connect it to their wifi and then "manage" it via an app on their phone.
That has to be the epitome of laziness...
Here is the best part:
Invite friends with the new social features. Send messages and invites through the Smarter app via Twitter, Facebook and more. Get together with friends and family and have a tea together. Make drink requests or ask a friend how they would like their tea or coffee before you forget to add the sugar.
We play the game with the bravery of being out of range
Oh noes, you'll need to get up off your arse to turn the kettle on. Then you'll need to get up and make your tea once the kettle is done..
I'm not sure why you need wifi to run your kettle. I really don't get it. Boiling water is HARD!
...not everything needs to be a smart device. The only secure devices are those not connected to the internet at all. The more devices people keep inventing that connect to everything else, including the internet, the less secure everything becomes.
STOP adding wi-fi to everything! It's not necessary for things like this. If you're too lazy to boil some water you've got bigger issues to worry about.
Bite my shiny metal ass!
This just shows why the whole "internet of things" idea just needs to be killed! Most if not all of these appliances will not be secure. My computer and my tablet will be the only things in my home to be connected to the Internet. Nothing else needs an internet connection to function. The only reason that this silly "Internet of things" idea is being pushed so hard is that these devices will collect a variety of personal information about people and report it to god know who! Its just another way for Big Brother to know what you are doing and when you are doing it!
Security is a) expensive b) requires sustained effort to maintain. There is absolutely no way to make this work with a market of cheap disposable consumer electronics.
Researchers say that using this simple trick and information about iKettles, they drove around London, cracked home WiFi networks, and created a map of insecure WiFi networks across the city.
How much more click baity can you get?
And how is this a surprise? EVERY device you allow to connect to your wifi network is allowed to do so. Did you know your phone has a file in it that STORES YOUR WIFI PASSWORDS?!
Maybe not the most secure but if they had to crack them then they where at least somewhat secured. I mean clearly they could have been more secure but at the end of the day locks only really keep honest people out.
Remember back in the 90's when those virus hoaxes would go around saying Bill Gates was going to reset the thermometer in your freezer and melt all your ice cream? I see a new rash of those emails going around, about how hackers can make your tea steep at 80C. Oh the horror!!
You can get taps that produce boiling water instantly, so if you do not use the temperature setter to get different heats from the same kettle (why?) then somthing you need to remember to ask for water is an inferior product, also look no internet required....
http://www.quooker.co.uk/enuk
is an example, there should be more out there though
Nonetheless, you need to get file access to such devices to read the passwords. The trick here was that they managed to get the kettle to, effectively, spit out the WiFi password. Until you compromise the network, lots of things may have lots of files inside them, but without physical access you can do nothing. This allowed them to compromise the network without physical access.
Consciousness is an illusion caused by an excess of self consciousness.
I'm a teapot
How much more click baity can you get?
Since you asked.
A group of strange men non-consensualy force their way onto your WiFi. Are your teenage daughters in danger?
I want to know how this is limited to the iKettle. It sounds like they just jammed the wi-fi connection, spoofed the SSID of the WAP, then waited for the device to try to reconnect to their own router. Why wouldn't this technique work for ANY wi-fi device that tries to auto-connect after dropping?
Almost $200 to boil water a little more conveniently? Are these people insane. Buy one of those on demand under sink hot water dispensers and you can have a near unlimited amount of hot water at the temperature you want (most can handle a cup a minute at just under boiling). With all of these internet enabled devices I wonder if router manufactures should add a third network in addition to the main and guest networks. A "devices" network that would be clamped down tightly and allow significant monitoring but still let devices talk with the main network.
Morons pushed 120V down our throats instead of allowing us a decent voltage that would allow us to use one of those nice kettles.
I suppose WPA2 would not go through full re-authentication and instead try to re-establish connection using a shared secret, but I am not certain. Excellent question.
At the very least you will have to spoof SSID and MAC and find a way to effectively jam legitimate router while being further out. This is not a trivial step because legitimate router will keep broadcasting and interfering with your imposer handshake.
Why the actual fuck does anyone need a gods-be-damned WiFi-enabled kettle in the first place? Too lazy to walk ten steps to the kitchen to turn the thing on? Really? Seriously, we've come to this?
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
I assume these WiFi-enabled kettles are from the Useless As Tits On A Boar range.
Seriously, no "418 I'm a teapot" error?
Add most of Germany onto your list of kettle users. I don't know anyone who doesn't own one.
A simple pre-shared password makes sense if you intend the network to be publicly accessible. e.g. You run a cafe and want the guests to be able to use your wifi network for Internet access. You can tell each of them the password. Ease of use outweighs security in this use case.
For home and corporate use, a public/private key system makes a lot more sense. There are only a few devices which you intend to give permanent wifi access to your home network (visitors can use your guest network which is protected by a simple password). Authenticate each of these devices with their own credentials using a key or certificate physically stored on the device and never transmitted over the network (the private key). If a device is ever compromised ("I lost my phone!"), you can simply revoke the credentials for that one device (delete the public key from the router) without having to make changes to every other device. This capability is already in most wifi routers - WPA2 Enterprise.
The downside is you need to be running some sort of server to handle these authentication requests. RADIUS seems to be the common one. Routers with a RADIUS server built in are rare, but since the software is free (FreeRAIUS) I expect it'll become more common, easier to use, and eventually replace WPA2 Personal (PSK) as the default security for home wifi routers.
Of course internet-connected beverage machines are hackable! Read about this back seven years ago! http://www.cnet.com/news/inter...
Where I live the predominant stove type is the electric stove.
Nowadays the ceran field stoves react pretty quickly, but the previously used electric stoves were slow to heat up a hot plate, and once hot cooled down very slowly. Heating a kettle on such a stove could easily take 10min.
A dedicated electric kettle was much faster and safer too (no hot hot plate for you to touch or accidentally place something made of plastic on).
It's not as hard as it was before it was boiled.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
I bet the same people saying how stupid this Ikettle is or asking why someone would need such a device don't think the wireless remote is so stupid. Even though the tv is just a yard away. :/
Basically the overwhelm the poor tea kettle with directional antenna and jam it to drop its wifi connection. Then when it tries to reestablish contact they spoof the wi-fi access point and grab the credentials. Why would this not work with other devices? How do the client devices authenticate the wi-fi access point before divulging the network password?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
They were so quick to go after Google for riding around mapping open wifi networks, while these guys are actually hacking router passwords! Yet all people talk about is the WTF factor of a network-enabled electric kettle.
u can using Backtrack 5 to re password wifi .backtrack 5 Linux Os
Phán mám quá£n lÃ
General-purpose cord-and-plug connected items are allowed to use the full 15A. (This is why power tools can be 15A.) 14AWG copper conductors are actually rated for 20A for static loads like electric heat, they just downrate them to 15A for general circuits because of the possibility of multiple devices being plugged in at once and to allow for motor loads.
As for why appliances don't use the full allowed amperage...most people don't care so they manufacturers don't either.
That said, it is possible to get 1800W toasters, toaster ovens, coffee makers, etc. in the USA. They're just hard to find and you'll likely end up paying more.
The Internet of Things is seriously getting out of control.