Slashdot Mirror
Samsung Smart Home Flaws Let Hackers Pick Connected Doors From Anywhere In the World (arstechnica.com)
Researchers have discovered flaws in Samsung's Smart Home automation system, which if exploited, allows them to carry a range of remote attacks. These attacks include digitally picking connected door locks from anywhere in the world. The flaws have been documented by researchers from the University of Michigan ahead of the 2016 IEEE Symposium on Security and Privacy. "All of the above attacks expose a household to significant harm -- break-ins, theft, misinformation, and vandalism," the researchers wrote in a paper. "The attack vectors are not specific to a particular device and are broadly applicable." Dan Goodin, reports for Ars Technica: Other attacks included a malicious app that was able to obtain the PIN code to a smart lock and send it in a text message to attackers, disable a preprogrammed vacation mode setting, and issue a fake fire alarm. The one posing the biggest threat was the remote lock-picking attack, which the researchers referred to as a "backdoor pin code injection attack." It exploited vulnerabilities in an existing app in the SmartThings app store that gives an attacker sustained and largely surreptitious access to users' homes. The attack worked by obtaining the OAuth token that the app and SmartThings platform relied on to authenticate legitimate users. The only interaction it required was for targeted users to click on an attacker-supplied HTTPS link that looked much like this one that led to the authentic SmartThings login page. The user would then enter the username and password. A flaw in the app allowed the link to redirect the credentials away from the SmartThings page to an attacker-controlled address. From then on, the attackers had the same remote access over the lock that users had.
... are belong to us!
"The one posing the biggest threat was the remote lock-picking attack"
No, the one posing the biggest threat is the false fire alarm, which could divert firefighting resources from a real fire, causing the loss of life.
I'm shocked! SHOCKED!
this shit is not funny any more, in the sense that it's embarrassing to be a computer programmer now. I've been coding for dozens of years and the shit we churn out now is worse than it ever was.
goddamn it, CSI:Cyber was right!
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
You call them flaws the NSA calls them government mandated back doors.
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
Oh, wait, I didn't say that, wait...it was a hacker, stay out of my house..... It's amazing how people don't seem to get the fact that if you make a keyhole everyone can access, regardless of distances, it's so much easier (and fun) to pick the lock.Plus these things weren't exactly designed to be all that secure as much as cheap/convenient. From harded coded passkeys in firmware and up, the IOT things are not security they are convenience...at the price of security.
"Imagination is more important than knowledge" - Einstein
All of this requires spoofing the Smart Things website which is no different than someone spoofing your bank website. In other words, absolutely nothing new or scary about it. Less than 0.1% of people using Smart devices will ever, if ever, be affected by this. More Millenials trying to spread FUD for pageviews and ego stroking.
The flaw is that users who click a link that takes them to some OTHER web site, where they then provide their credentials, are then vulnerable to OTHER people using their credentials? How is this even news?
Don't disappoint your bird dog. Go to the range.
This "research" is overblown hyperbole based upon tricking the user into falling for a phishing attack or by installing malware. But this big news because this shows that IOT is unsafe!
Now excuse me, I have email from PayPal telling me to update my account, so I have to go click the link they conveniently sent me.
SmartThings is so flaky it doesn't work for authorized users so no worries here.
It can tell you with cryptographic certainty with whom you are talking to and that no one else can eavesdrop on your conversation. It can't tell jack about whether that's actually the entity that you want to talk to -- that's your job :-P
I mean, HTTPS://BANKOFAMERlCA.COM looks pretty legit right? And if it's a valid certificate (for the owner of bankofamerLca.com, which is totally legit) then there's not a whole lot a browser can do besides blacklist 'known phishing sites' one at a time.
This just in...
A man is found trapped in his new Samsung smart-house tied up in a basement closet with two pieces of toast stuffed in his mouth, covered in ice cubes.
Apparently a burnt toast hacker, found and exploited a security flaw in every electrically powered device in his home. After refusing to pay the ransom his microwave demanded. The microwave ordered the owners toaster to eject the toast into the owners mouth while the Dyson wireless battery powered vacuum cleaner snuck up from behind. The "possessed" cleaning appliance wrapped him up in a magnetically detachable charging cord.
This new Dyson model, well known for its ability to remove facial hair from across the room made easy prey of the 45 year old computer programmer. The man was literally drug across his own kitchen floor kicking and sobbing, spit on by the ice maker as he frantically willed the fridge to help him, he had never done the fridge wrong. The basement door opened itself and the vacuum quickly went from suck to blow, ejecting him at near critical velocity into the open closet. The closet door self-closed.
He was only found because the UPS deliverer, heard the commotion while passing this haunted house.
In other news, Apple Inc. buys Microsoft, settling the largest online debate about which platform is superior...
Explain to me again how the Internet of Things is a good idea?
"Grab them by the pussy" -- President of the United States of America
Leave it to the mods to replace a perfectly explained HelpNet article with a convoluted bullshit ArsTechnica report. You should really stop shoving this site down everyone's throats.
It requires compromising the phone with the app on it.
So they have to compromise your PHONE first, then they can. that requires a Rooted phone, so they need to convince you to root your phone then install their app.
Nothing to see here....
Get it right and stop with the fucking Fox News headlines.
Rilly, it could! Be! Haxx0rz!
working as intended. nothing to see here. move along and keep your damn mouth shut. it took three years to get someone on the inside to do this.
-nsa/cia/fbi