Slashdot Mirror
Trane Takes 2 Years To Remove Hard-Coded Root Passwords From IoT Thermostat (softpedia.com)
An anonymous reader writes: It took 22 months for Trane to patch three security bugs in its ComfortLink II XL950 smart Wi-Fi thermostat product, the ComfortLink II XL950, a modern IoT device along the lines of Google Nest, which offers a simple way to manage your apartment's or building's internal temperature. Researchers contacted Trane about their three issues in April 2014, the company fixed the RCE flaws in April 2015 and recently released a firmware update at the end of January to fix the last issue. During all this time, the company barely answered emails and continued to sell an exposed product.
This has always been a severe issue with specific hardware produced by companies that aren't technology focused (and even some that are). These little debugging/service backdoors worked when there wasn't a vast resource of easy information sharing - and the device wasn't able to be accessed from anywhere. One day these product engineers will figure that out - maybe.
I would be more concerned about the sub 32 degree house
The cesspool just got a check and balance.
How many thermostat controllers do you need?
Apparently more than I thought I would, as I'm looking at buying my 6th and 7th ones, and possibly another 3.
The cesspool just got a check and balance.
its also hard to get a train GOING.
Im sure the actual patch writing time was minimal but
15 different managers had to be consulted/bribed to sign off on the code
there were 50 different meetings to sort out what the bugs were exactly
somebody had to be assigned the task of writing the code (and this was a busy person)
the code had to be audited for serious bugs like nonPC variables
then it had to be tested
and packaged for deployment
do i need to go on??
At what point is a professional body going to be setup so that we can get a certification like "Ain't Totally F'd Up" for any device that connects to the interwebs?!?
Surely someone has some kind of idea of how to do interweb connected things anti-ass-backwards (and stop calling me Shirley).
Okay, this is just too hilarious. It's like the movie "War Games" when the computer engineer left his dead son's name as a password before he disappeared. This sort of thing tends to happen when a non-engineer want to ensure absolute control in a quick dirty way. Of course anyone with any foresight (AKA IT/Engineering professionals or even Philosophers/Historians I expect) would have pointed out how easy a back door this would be. We already have tons of historical precedence. And then take two years to undo it? Probably a 3rd party pointed out they could be sued for negligence and said "get this fixed...now". The usual reactive crap when sales/iron grip overrides good judgement for short terms savings. Of course why anyone would want a device like this in their home giving people a potential back door for any hacker to get in through the Internet and play poltergist is slightly puzzling. People need to learn that "Convenience comes at the price of Security". Kind of sounds like: "With Great Power comes great responsibility". Of course nobody seems to learn from either phrase. And here's another one: "Those who forget their history are doomed to repeat it"...whoops...too late...
"Imagination is more important than knowledge" - Einstein
I imagine it does some of the same stuff my new lennox one does. Health checks etc. Mine for example validates temp outside before kicking in the compressor to avoid destroying it. Also checks static pressures in air flow to check filter flow rate. Keeps track of any error codes thrown by other units (furnace, A/C, etc). And I imagine the trane is also like the lennox. Don't give it your wifi password and it will not go on the interwebs. I like the extra stuff my Tstat can do, but do not want it on the WAN/LAN, so I just don't set it up.
"there's nothing like a Trane" unless it's a nest. Damn good thing.
> It took 22 months
"Nothing Starts a Trane(tm)"
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
No its not. "Legacy" thermostats were essentially a few relays and some operator controls. 24VAC is fed to the thermostat terminal "R" from the furnace or air handler. When it wants the fan to run, it switches 24V to its terminal "G", when it wants heat it puts 24V on terminal "W", Cooling is terminal "Y".
These new "communicating" thermostats are a CANBUS network similar but much more poorly documented than the OBD one in your car. However it does things like send you an email when the furnace is failing, or when the temperature in your house has fallen to where you might have to worry about freezing pipes etc. It can tell you that it failed to ignite several times so you might want to book service before it fails completely.
I wish there was some online presence for people hacking these things. Inside my Lennox iComfort thermostat I found an SD card containing an OS called "MQX RTOS", and a i.MX287 processor.
Now, something short of a power outage is enough to freeze your water pipes... say a wifi outage or low voltage interruption to the Nest.
Buy some insurance. Wire in an Accustat as a backup that kicks heat on at 10 degrees Celsius.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
Or, don't use a Nest to begin with. Why on earth does Google need to know the temperature settings in my house at any given time?
The cesspool just got a check and balance.
Mansion? Who said they were all for one house? I've replaced a lot of these over the years, I'm pretty sure the number is higher than what I stated, I just recall changing out at least 5. As for the last 3, I would use them for single room zone controls. I've been looking at the duct work, and believe that I can actually use them to control the heat better and only cool/heat the areas I wish.
The cesspool just got a check and balance.
Seriously? what kind of noob idiots are they?
Unless (like my den) someone decided to save a few bucks (basically the price of the transformer and a relay) and installed a high voltage thermostat, and then you have 110 volts right on the stat. You'd think...
Has caused me enough issues that I think come this spring, I'll do it (Dad would be laughing - he was an HVAC mechanic, and would do it 'whenever' - and of course, I don't have a spare relay...)
-- 73 de KG2V For the Children - RKBA! "You are what you do when it counts" - the Masso
Oh nice, I worked with Precise/MQX and its RTCS stack, I implemented SNMP v2c for our products running this OS.
"Science will win because it works." - Stephen Hawking
Most of those points wouldn't be controlled by the thermostat (I would hope), but by the internal controls in the equipment. Even if they were accessible thru the thermostat, you shouldn't be able to change things like the anti-short cycle timer or the compressor low ambient lock-out.
Every manufacturer seems to be doing it now at least in the higher end models. Lennox has iComfort, Trane has this POS from the topic, Carrier has Infinity. The thermostats are connected to the furnace with 4 wires. R = 24v, C = Common, "i+", and "i-". There's those same terminals at the Air Conditioner. The gas valve has Tx and Rx blinky lights, the blower motor too. The thermostat reads the outdoor temp from the air conditioner's thermistor through the bus, all sorts of sensors in the furnace are readable in the thermostat, CFM of the blower, pressure in the ductwork, supply and return temperatures, etc..
This patent is the best reference I've found so far. It's all proprietary though, Lennox thermostats won't work on a Carrier furnace or air conditioner, etc. And the software seems to be really terrible on all of them.