Slashdot Mirror
Hackers Make the First-Ever Ransomware For Smart Thermostats (vice.com)
Lorenzo Franceschi-Bicchierai, writing for Motherboard: One day, your thermostat will get hacked by some cybercriminal hundreds of miles away who will lock it with malware and demand a ransom to get it back to normal, leaving you literally in the cold until you pay up a few hundred dollars. This has been a scenario that security experts have touted as one of the theoretical dangers of the rise of the Internet of Things, internet-connected devices that are often insecure. On Saturday, what sounds like a Mr. Robot plot line came one step closer to being reality, when two white hat hackers showed off the first-ever ransomware that works against a "smart" device, in this case, a thermostat. Luckily, Andrew Tierney and Ken Munro, the two security researchers who created the ransomware, actually have no ill intention. They just wanted to make a point: some Internet of Things devices fail to take simple security precautions, leaving users in danger. "We don't have any control over our devices, and don't really know what they're doing and how they're doing it," Tierney told Motherboard. "And if they start doing something you don't understand, you don't really have a way of dealing with it." Tierney and Munro, who both work UK-based security firm Pen Test Partners, demonstrated their thermostat ransomware proof-of-concept at the hacking conference Def Con on Saturday, fulfilling the pessimistic predictions of some people in security world.
COMPLETELY impossible to unscrew the smart thermostat from the wall, unwire it, and (temporarily) install a traditional non-networked thermostat so you could operate your heat (or AC) while you contact the vendor or manufacturer of the smart thermostat for help.
Hmm... Pay you hundreds of dollars, or replace the damn thing with a $20 model you can't hack remotely. Seems an easy choice for me.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
This is why I don't understand the rush to have all these IOT devices in the house. I have a couple, but they are isolated, and if they were hacked I could still function without them. There seems to be a rush to have everything, from the washing machine, to the microwave, to the toaster hooked to the internet, and there seems to be even a push to build these devices so that they do not function without an internet connection. I used to be baffled as to why consumers would even want such things. But, of course, it is not the consumers who want all this IOT, but the vendors who sell the devices and the services, trying to turn us into the product.
Proverbs 21:19
Sure, there are malicious cases for this. But most IoT devices like smart thermostats are a bit too dumbed down and don't even operate correctly without an external Internet connection. Their broken security is about the only way to get a proper level of functionality.
You can send me 1 bitcoin to get a +1 score
Be or ben't
It's not difficult to imagine California deciding they need the ability to throttle your AC to combat brownouts/global warming/whatever
You forgot "cloud."
I've fallen off your lawn, and I can't get up.
Do you have any idea what a licensed installer charges for an emergency visit on a Sunday morning? That $25 thermostat is $50 because you don't get to buy the one that's on sale at Home Depot, and the cost to knock on your door is going to be close to $150, and then the rate ticks forward at $100/hr. And at the end of your $300 emergency service call, you'll be left with a dumb thermostat and a $200 paperweight.
Is it just my observation, or are there way too many stupid people in the world?
No he didn't. Bitcoin and tor work against vested interests and therefore 'need' to be outlawed. The Cloud doesn't.
"Trump!!", the new Godwin.
It's an opt in and it supposed to help costs and availability during peak hours... They even have those programs in the mid-west.
Governments will love this for a completely different reason. When "hackers" start to bother normal people, normal people will ask for laws that stop this. And they'll get the laws. Not that they stop anything, but you know how it is, once a law is passed, it stays.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
One day, your thermostat will get hacked by some cybercriminal
No, it won't: I'm not falling for the 'Internet of Things' troll/meme. You won't be hacking my thermostat, lightbulbs, dishwasher, microwave oven, clothes washer, clothes dryer, television, or any other household appliance because there's not a single damned good reason why these NEED to be connected to the Internet.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
embedded stuff needed to have os updates that are on there own that come out faster then the app update.
At least some embedded stuff is ARM with cut down linux based os's. But others are full pc's running a big linux install or even windows with a custom app on top of it. And if them alot for the time you need to wait from the app part to be updated before the under lining os get's fixed even for just os security fixes. As the updates just come as full install images.
Some embedded systems have sd cards that can have there os hacked and the hack can stay on the system even after power off. Unlike others where it's flashed with a small nvram area that just holds settings / logs.
"Smart" thermostats ofter communicate with the furnace / cooling via a cat-6 or some other type of communications cable, they are rarly just a switch.
No they do not. Retrofitting a cat6 (overkill) cable to run to the HVAC in an existing house would be prohibitively expensive and/or time consuming. They communicate with the HVAC via the same set of wires a "dumb" thermostat would use and gets power over the same cables. They generally communicate with the network via wifi. Nest even kindly color codes everything so that someone who isn't a a licensed technician can do the job.
Errr....Tor was (and still is) supported by the U.S. Naval Research Laboratory which, last we checked, was under the Office of Naval Research of the U.S. Navy. So Tor is being developed to work against which vested interest exactly? Maybe if you took a fixed point in the right space, you'd get the answer you want to believe, but I doubt it.
Yeah, he did. The cloud is the perfect petri dish for fraud, and that's exactly how it's used most of the time, to suck money and/or information out of bewildered users.
"We'll just keep "your" music and "your" video in the cloud for you"
uh-huh...
I've fallen off your lawn, and I can't get up.