Slashdot Mirror
Trane Takes 2 Years To Remove Hard-Coded Root Passwords From IoT Thermostat (softpedia.com)
An anonymous reader writes: It took 22 months for Trane to patch three security bugs in its ComfortLink II XL950 smart Wi-Fi thermostat product, the ComfortLink II XL950, a modern IoT device along the lines of Google Nest, which offers a simple way to manage your apartment's or building's internal temperature. Researchers contacted Trane about their three issues in April 2014, the company fixed the RCE flaws in April 2015 and recently released a firmware update at the end of January to fix the last issue. During all this time, the company barely answered emails and continued to sell an exposed product.
This has always been a severe issue with specific hardware produced by companies that aren't technology focused (and even some that are). These little debugging/service backdoors worked when there wasn't a vast resource of easy information sharing - and the device wasn't able to be accessed from anywhere. One day these product engineers will figure that out - maybe.
Sounds like I get to have some fun tonight!
It's a thermostat. It controls current into a resistor nailed to your wall. What the hell do you need an OS in there for??
* Please try to keep posts on topic.
* Try to reply to other people's comments instead of starting new threads.
* Read other people's messages before posting your own to avoid simply duplicating what has already been said.
* Use a clear subject that describes what your message is about.
* Offtopic, Inflammatory, Inappropriate, Illegal, or Offensive comments might be moderated. (You can read everything, even moderated posts, by adjusting your threshold on the User Preferences Page)
* If you want replies to your comments sent to you, consider logging in or creating an account.
Modern app appers know that ONLY apps can app apps, which is why Trane's LUDDITE Internet of Things is insecure! If Trane used the Appernet of APPS, it would be 100% appy!
Apps!
Trane would've had it fixed in 2013. At least given the "research" in the previous article.
I would be more concerned about the sub 32 degree house
The cesspool just got a check and balance.
How many thermostat controllers do you need?
Apparently more than I thought I would, as I'm looking at buying my 6th and 7th ones, and possibly another 3.
The cesspool just got a check and balance.
its also hard to get a train GOING.
Im sure the actual patch writing time was minimal but
15 different managers had to be consulted/bribed to sign off on the code
there were 50 different meetings to sort out what the bugs were exactly
somebody had to be assigned the task of writing the code (and this was a busy person)
the code had to be audited for serious bugs like nonPC variables
then it had to be tested
and packaged for deployment
do i need to go on??
It isn't the prospect of having a somewhat warm house that is bothering people -- if you live anywhere that dips below freezing, a hacker turning off the heat completely could cause the pipes in your house to burst, causing huge amounts of damage. That is not something that will "slightly inconvenience you"...
At what point is a professional body going to be setup so that we can get a certification like "Ain't Totally F'd Up" for any device that connects to the interwebs?!?
Surely someone has some kind of idea of how to do interweb connected things anti-ass-backwards (and stop calling me Shirley).
Okay, this is just too hilarious. It's like the movie "War Games" when the computer engineer left his dead son's name as a password before he disappeared. This sort of thing tends to happen when a non-engineer want to ensure absolute control in a quick dirty way. Of course anyone with any foresight (AKA IT/Engineering professionals or even Philosophers/Historians I expect) would have pointed out how easy a back door this would be. We already have tons of historical precedence. And then take two years to undo it? Probably a 3rd party pointed out they could be sued for negligence and said "get this fixed...now". The usual reactive crap when sales/iron grip overrides good judgement for short terms savings. Of course why anyone would want a device like this in their home giving people a potential back door for any hacker to get in through the Internet and play poltergist is slightly puzzling. People need to learn that "Convenience comes at the price of Security". Kind of sounds like: "With Great Power comes great responsibility". Of course nobody seems to learn from either phrase. And here's another one: "Those who forget their history are doomed to repeat it"...whoops...too late...
"Imagination is more important than knowledge" - Einstein
I'd be more concerned about the nuclear warheads pointed at the house when it gets used as a staging ground for an attack on some other nation's army.
"there's nothing like a Trane" unless it's a nest. Damn good thing.
Oh My GOD! A possibly exploitable-if-you-know-or-bother-to-look-for-it bug in a device that will change the room temperature!
There are multiple ways to damage structures and or equipment by screwing with thermostats especially fancy models controlling expensive equipment or more than just a basic furnace.
- Intentional rapid cycling of compressors
- Running compressors below lockout temperature
- Deep freeze - frozen pipes - water damage
- Condensation and mold growth within structure
- Condensation and rusting within ducting
- Operating 90% efficiency heaters below temperature where condensate forms in the interface of secondary exchanger (Normally >50 f)
I love technology but I love the KISS principal more.
If there is little reason to connect something to the Internet then don't do it. If a component is unnecessarily complex then due diligence may be wise to consider all costs of ownership including relative risk of failure.
For most people IoT simply does not deliver the goods for what it costs.
> It took 22 months
"Nothing Starts a Trane(tm)"
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Now, something short of a power outage is enough to freeze your water pipes... say a wifi outage or low voltage interruption to the Nest.
Buy some insurance. Wire in an Accustat as a backup that kicks heat on at 10 degrees Celsius.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
Or, don't use a Nest to begin with. Why on earth does Google need to know the temperature settings in my house at any given time?
The cesspool just got a check and balance.
Mansion? Who said they were all for one house? I've replaced a lot of these over the years, I'm pretty sure the number is higher than what I stated, I just recall changing out at least 5. As for the last 3, I would use them for single room zone controls. I've been looking at the duct work, and believe that I can actually use them to control the heat better and only cool/heat the areas I wish.
The cesspool just got a check and balance.
Seriously? what kind of noob idiots are they?
That's how I initially misread the headline.
I'm very well aware of all of the possible risks of a backdoored thermostat. I'm looking at one on my wall right now, but frankly, I don't care either. I've got a better shot at winning the PowerBall than of someone impacting me in any way via that thermostat.
A thermostat has a backdoor. So fucking what? That's what consumers say, that's what the manufacturer says, that's what casual observers say. So fucking what? I don't care if there is some insanely small and HIGHLY unlikely chance that someone might change the setpoint on my thermostat.
It's not their fault that they aren't network security professionals and can't see the broader risk. Since you aren't showing them the risk, they look at you like you're a conspiracy lunatic. Which, in fairness to them, you really are.
The only way you can effectively get people with no understanding to appreciate such a risk is to let them suffer from it, at least a little bit. Trane didn't and still doesn't give a rat's ass about it. They suffered no risk. In their mind, there was never any risk at all. They need a demonstration that shows the risk to them.
Someone needs to turn up the heat on all the Trane thermostats and run up everyone's electric bills. When Trane gets slapped with a class action law suit for their lax security, they'll care.
Use a Trane thermostat as a jumping off point to compromise home networks and steal people's banking information. Don't just point it out as the extra ordinarily unlikely possibility that it is. Do it.
There will likely be someone in this thread that presents some insane CSI scenario of elderly people being killed by evil anonymous hackers turning off their heat in the nursing homes during the dead of winter. Possible? Yes, technically possible. Likely? I'm pretty sure I'll have a flying car long before that that happens, so no, not likely.
Nobody cares if their thermostat gets rooted! Get over the sky is falling attitude.
Sure, the passwords allow random strangers to set your temperature. But it doesn't suffer from the hardware flaw the Nest does. That hardware flaw being that the Nest is advertised as not requiring a grounding wire, and thus instead randomly turning your furnace or air conditioner on to power an internal battery. You can take the Trane thermostat offline and worry not about hacking. The Nest, though, is going to fuck up no matter what you do!
Now, I understand why it's always too hot in my office...
Most of those points wouldn't be controlled by the thermostat (I would hope), but by the internal controls in the equipment. Even if they were accessible thru the thermostat, you shouldn't be able to change things like the anti-short cycle timer or the compressor low ambient lock-out.