Slashdot Mirror
Tattling Kettles Help Researchers Crack WiFi Networks In London (pentestpartners.com)
New submitter campuscodi writes: Security researchers at Pen Test Partners have found a security vulnerability in the iKettle Wi-Fi Electric Kettle that allows attackers to crack the password of the WiFi network to which the kettle is connected. Researchers say that using this simple trick and information about iKettles, they drove around London, cracked home WiFi networks, and created a map of insecure WiFi networks across the city. The same researchers cracked a Samsung smart-fridge this summer to disclose Gmail passwords. If you have 6 minutes, there's a YouTube video you can watch.
...I gotta go google what the fuck an iKettle is? Is this like a crockpot wired to the internet for some reason?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
When will you learn a Wi-Fi enable Tea Kettle is a horrible Idea.
Oh I just got a message from my Wi-Fi enabled coffee machine that my coffee is done.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
This is a case of the pot calling the kettle hacked.
[Puts on sunglasses] Yeah!
This is like Talkie the Toaster, but it's a tea kettle?
And all modern crackpots are wired to the internet these days.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Are you seriously telling me people would buy this and connect it to their wifi and then "manage" it via an app on their phone.
That has to be the epitome of laziness...
Here is the best part:
Invite friends with the new social features. Send messages and invites through the Smarter app via Twitter, Facebook and more. Get together with friends and family and have a tea together. Make drink requests or ask a friend how they would like their tea or coffee before you forget to add the sugar.
We play the game with the bravery of being out of range
Only X'ers and Boomers are going to get that reference...
Good one though.
We play the game with the bravery of being out of range
...not everything needs to be a smart device. The only secure devices are those not connected to the internet at all. The more devices people keep inventing that connect to everything else, including the internet, the less secure everything becomes.
STOP adding wi-fi to everything! It's not necessary for things like this. If you're too lazy to boil some water you've got bigger issues to worry about.
Bite my shiny metal ass!
Security is a) expensive b) requires sustained effort to maintain. There is absolutely no way to make this work with a market of cheap disposable consumer electronics.
Researchers say that using this simple trick and information about iKettles, they drove around London, cracked home WiFi networks, and created a map of insecure WiFi networks across the city.
How much more click baity can you get?
And how is this a surprise? EVERY device you allow to connect to your wifi network is allowed to do so. Did you know your phone has a file in it that STORES YOUR WIFI PASSWORDS?!
Remember back in the 90's when those virus hoaxes would go around saying Bill Gates was going to reset the thermometer in your freezer and melt all your ice cream? I see a new rash of those emails going around, about how hackers can make your tea steep at 80C. Oh the horror!!
Nonetheless, you need to get file access to such devices to read the passwords. The trick here was that they managed to get the kettle to, effectively, spit out the WiFi password. Until you compromise the network, lots of things may have lots of files inside them, but without physical access you can do nothing. This allowed them to compromise the network without physical access.
Consciousness is an illusion caused by an excess of self consciousness.
I'm a teapot
How much more click baity can you get?
Since you asked.
A group of strange men non-consensualy force their way onto your WiFi. Are your teenage daughters in danger?
I suppose WPA2 would not go through full re-authentication and instead try to re-establish connection using a shared secret, but I am not certain. Excellent question.
At the very least you will have to spoof SSID and MAC and find a way to effectively jam legitimate router while being further out. This is not a trivial step because legitimate router will keep broadcasting and interfering with your imposer handshake.
Why the actual fuck does anyone need a gods-be-damned WiFi-enabled kettle in the first place? Too lazy to walk ten steps to the kitchen to turn the thing on? Really? Seriously, we've come to this?
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
I assume these WiFi-enabled kettles are from the Useless As Tits On A Boar range.
Seriously, no "418 I'm a teapot" error?
Add most of Germany onto your list of kettle users. I don't know anyone who doesn't own one.
No. You can get taps that deliver not-boiling water. It's hot and steamy, but certainly not boiling, resulting in substandard tea. You also need a sink. An electric kettle can go anywhere there's a plug.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
A simple pre-shared password makes sense if you intend the network to be publicly accessible. e.g. You run a cafe and want the guests to be able to use your wifi network for Internet access. You can tell each of them the password. Ease of use outweighs security in this use case.
For home and corporate use, a public/private key system makes a lot more sense. There are only a few devices which you intend to give permanent wifi access to your home network (visitors can use your guest network which is protected by a simple password). Authenticate each of these devices with their own credentials using a key or certificate physically stored on the device and never transmitted over the network (the private key). If a device is ever compromised ("I lost my phone!"), you can simply revoke the credentials for that one device (delete the public key from the router) without having to make changes to every other device. This capability is already in most wifi routers - WPA2 Enterprise.
The downside is you need to be running some sort of server to handle these authentication requests. RADIUS seems to be the common one. Routers with a RADIUS server built in are rare, but since the software is free (FreeRAIUS) I expect it'll become more common, easier to use, and eventually replace WPA2 Personal (PSK) as the default security for home wifi routers.
Of course internet-connected beverage machines are hackable! Read about this back seven years ago! http://www.cnet.com/news/inter...
I have one and used it a lot. The water is hot but not boiling (low 90s Celsius). The problem with them is that there is a small tank under the sink which keeps the water hot so you are paying electricity to keep the water hot even if you aren't using it (over the night) and if you want more than a couple of mugs the temperature starts to drop quickly as the hot water gets diluted with the cooler incoming water.
It has been about 10 years since I've looked into them so maybe they have changed since then. I haven't used it in a couple of years since I've found a better solution for my needs. I've got a dedicated tea maker which can also double as a kettle.
It's not as hard as it was before it was boiled.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Basically the overwhelm the poor tea kettle with directional antenna and jam it to drop its wifi connection. Then when it tries to reestablish contact they spoof the wi-fi access point and grab the credentials. Why would this not work with other devices? How do the client devices authenticate the wi-fi access point before divulging the network password?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
They were so quick to go after Google for riding around mapping open wifi networks, while these guys are actually hacking router passwords! Yet all people talk about is the WTF factor of a network-enabled electric kettle.
Hmm... Brother makes an inexpensive branded coffee pot and, I think, electric kettles. You might be on to something!
"So long and thanks for all the fish."
General-purpose cord-and-plug connected items are allowed to use the full 15A. (This is why power tools can be 15A.) 14AWG copper conductors are actually rated for 20A for static loads like electric heat, they just downrate them to 15A for general circuits because of the possibility of multiple devices being plugged in at once and to allow for motor loads.
As for why appliances don't use the full allowed amperage...most people don't care so they manufacturers don't either.
That said, it is possible to get 1800W toasters, toaster ovens, coffee makers, etc. in the USA. They're just hard to find and you'll likely end up paying more.