Slashdot Mirror
Trane Takes 2 Years To Remove Hard-Coded Root Passwords From IoT Thermostat (softpedia.com)
An anonymous reader writes: It took 22 months for Trane to patch three security bugs in its ComfortLink II XL950 smart Wi-Fi thermostat product, the ComfortLink II XL950, a modern IoT device along the lines of Google Nest, which offers a simple way to manage your apartment's or building's internal temperature. Researchers contacted Trane about their three issues in April 2014, the company fixed the RCE flaws in April 2015 and recently released a firmware update at the end of January to fix the last issue. During all this time, the company barely answered emails and continued to sell an exposed product.
Thanks for the post, I'll check it out!
This has always been a severe issue with specific hardware produced by companies that aren't technology focused (and even some that are). These little debugging/service backdoors worked when there wasn't a vast resource of easy information sharing - and the device wasn't able to be accessed from anywhere. One day these product engineers will figure that out - maybe.
Sounds like I get to have some fun tonight!
It's a thermostat. It controls current into a resistor nailed to your wall. What the hell do you need an OS in there for??
* Please try to keep posts on topic.
* Try to reply to other people's comments instead of starting new threads.
* Read other people's messages before posting your own to avoid simply duplicating what has already been said.
* Use a clear subject that describes what your message is about.
* Offtopic, Inflammatory, Inappropriate, Illegal, or Offensive comments might be moderated. (You can read everything, even moderated posts, by adjusting your threshold on the User Preferences Page)
* If you want replies to your comments sent to you, consider logging in or creating an account.
Modern app appers know that ONLY apps can app apps, which is why Trane's LUDDITE Internet of Things is insecure! If Trane used the Appernet of APPS, it would be 100% appy!
Apps!
... why do they care?
Repeat sales? How many thermostat controllers do you need?
// TODO: Add comments
Oh My GOD! A possibly exploitable-if-you-know-or-bother-to-look-for-it bug in a device that will change the room temperature! On something that doesn't really need to be connected to the internet in the first place, and would slightly inconvenience you if it were pwn'ed! Bring back the guillotine because this is worse than 9/11!
If you are super-paranoid, just pull the ethernet cable, then you can live your life without the existential dread of coming home to a 78 degree house.
Trane would've had it fixed in 2013. At least given the "research" in the previous article.
its also hard to get a train GOING.
Im sure the actual patch writing time was minimal but
15 different managers had to be consulted/bribed to sign off on the code
there were 50 different meetings to sort out what the bugs were exactly
somebody had to be assigned the task of writing the code (and this was a busy person)
the code had to be audited for serious bugs like nonPC variables
then it had to be tested
and packaged for deployment
do i need to go on??
At what point is a professional body going to be setup so that we can get a certification like "Ain't Totally F'd Up" for any device that connects to the interwebs?!?
Surely someone has some kind of idea of how to do interweb connected things anti-ass-backwards (and stop calling me Shirley).
Okay, this is just too hilarious. It's like the movie "War Games" when the computer engineer left his dead son's name as a password before he disappeared. This sort of thing tends to happen when a non-engineer want to ensure absolute control in a quick dirty way. Of course anyone with any foresight (AKA IT/Engineering professionals or even Philosophers/Historians I expect) would have pointed out how easy a back door this would be. We already have tons of historical precedence. And then take two years to undo it? Probably a 3rd party pointed out they could be sued for negligence and said "get this fixed...now". The usual reactive crap when sales/iron grip overrides good judgement for short terms savings. Of course why anyone would want a device like this in their home giving people a potential back door for any hacker to get in through the Internet and play poltergist is slightly puzzling. People need to learn that "Convenience comes at the price of Security". Kind of sounds like: "With Great Power comes great responsibility". Of course nobody seems to learn from either phrase. And here's another one: "Those who forget their history are doomed to repeat it"...whoops...too late...
"Imagination is more important than knowledge" - Einstein
"there's nothing like a Trane" unless it's a nest. Damn good thing.
> It took 22 months
"Nothing Starts a Trane(tm)"
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Seriously? what kind of noob idiots are they?
That's how I initially misread the headline.
I'm very well aware of all of the possible risks of a backdoored thermostat. I'm looking at one on my wall right now, but frankly, I don't care either. I've got a better shot at winning the PowerBall than of someone impacting me in any way via that thermostat.
A thermostat has a backdoor. So fucking what? That's what consumers say, that's what the manufacturer says, that's what casual observers say. So fucking what? I don't care if there is some insanely small and HIGHLY unlikely chance that someone might change the setpoint on my thermostat.
It's not their fault that they aren't network security professionals and can't see the broader risk. Since you aren't showing them the risk, they look at you like you're a conspiracy lunatic. Which, in fairness to them, you really are.
The only way you can effectively get people with no understanding to appreciate such a risk is to let them suffer from it, at least a little bit. Trane didn't and still doesn't give a rat's ass about it. They suffered no risk. In their mind, there was never any risk at all. They need a demonstration that shows the risk to them.
Someone needs to turn up the heat on all the Trane thermostats and run up everyone's electric bills. When Trane gets slapped with a class action law suit for their lax security, they'll care.
Use a Trane thermostat as a jumping off point to compromise home networks and steal people's banking information. Don't just point it out as the extra ordinarily unlikely possibility that it is. Do it.
There will likely be someone in this thread that presents some insane CSI scenario of elderly people being killed by evil anonymous hackers turning off their heat in the nursing homes during the dead of winter. Possible? Yes, technically possible. Likely? I'm pretty sure I'll have a flying car long before that that happens, so no, not likely.
Nobody cares if their thermostat gets rooted! Get over the sky is falling attitude.
Sure, the passwords allow random strangers to set your temperature. But it doesn't suffer from the hardware flaw the Nest does. That hardware flaw being that the Nest is advertised as not requiring a grounding wire, and thus instead randomly turning your furnace or air conditioner on to power an internal battery. You can take the Trane thermostat offline and worry not about hacking. The Nest, though, is going to fuck up no matter what you do!
Now, I understand why it's always too hot in my office...