Slashdot Mirror
'Smart' Electrical Socket Leaks Your Email Address, Can Launch DDoS Attacks (softpedia.com)
An anonymous reader writes from a report via Softpedia: There is an insecure IoT smart electrical socket on the market that leaks your Wi-Fi password, your email credentials (if configured), and is also poorly coded, allowing attackers to hijack the device via a simple command injection in the password field. Researchers say that because of the nature of the flaws, attackers can overwrite its firmware and add the device to a botnet, possibly using it for DDoS attacks, among other things. Bitdefender didn't reveal the device's manufacturer but said the vendor is working on a fix, which will be released in late Q3 2016. Problems with the device include a lack of encryption for device communications and the lack of any basic input sanitization for the password field. "Up until now most IoT vulnerabilities could be exploited only in the proximity of the smart home they were serving, however, this flaw allows hackers to control devices over the internet and bypass the limitations of the network address translation," says Alexandru Balan, Chief Security Researcher at Bitdefender. "This is a serious vulnerability, we could see botnets made up of these power outlets."
This is exactly what happens when you lay off all the real programmers and replace them with coders. Enjoy your cost savings at the price of lawsuits for security breaches.
I'm getting ready to replace all the switches and outlets in my 1982 era house.
IoT will not be present. I want an outlet to do 2 things. Connect to the circuit breaker box, and provide electricity to my stuff without blowing up.
Can't leak what doesn't exist.
Full article with vendors here
What kind of bullshit click bait story is this. 'Be afraid of the scary vulnerability! But, we won;t tell you which device has it.'
Name names or GTFO!
If it says Softpedia GTFO!
You can not be hacked by everything electrical on Earth. This is all lies.
You can however be spied on by anything Microsoft distributes.
That's what the IoT is, the Internet of Terrors.
Mark my words- this is only going to get worse and worse and worse, and eventually somebody will die from some shoddy piece-of-shit consumer crap that's been weaponized by some asshole hacker.
Just cruising through this digital world at 33 1/3 rpm...
How many more stories will there be like this as more IOT stuff comes to market?
People just buy the lowest priced garbage they can find on Amazon... Most of which are unreliable Chinese garbage dumped on the market, completely unsecured, loaded with or vulnerable to malware, broadcasting information back to who-know-who, or rely on a fly-by-night company whose dodgy server in China might go offline tomorrow.
Sounds like a really great thing, truly.
Any company fielding products that dangerously amateurish deserves to be ridiculed and forced out of business.
For some reason many people seem to question internet related technology less and less, when they obviously they should be questioning it more and more. Most things do not need to be hooked to the internet. The dubious benefits do not even come close to compensating for the potential downsides.
A brain is a terrible thing to waste... Mind? That's debatable.
Didn't take too long to figure out it was Edimax...
If you want to keep up with a very smart person who does some really interesting analysis on the security of "smart" devices, try Matthew Garret. He posts most of his finding in conversational format on twitter at
@mjg59.
You can see more of his "reported" results on his website at
http://mjg59.dreamwidth.org/.
Enjoy!
remove nospam. to email!
I never got this concept, why should ANYTHING in my home be on the WWW? What the fuck for? For Google to sell more advertising?
Please put the brakes on this shit.
This is advanced stupid. It takes a whole lot of bad decisions and a high-grade lack of skill to manage a remote exploit via a password field.
I'm gonna go out on a limb and say that, in lieu of hashing and salting the password, and/or using one of the many freely available tools to sanitize inputs, it drops the password field directly into a database query of SELECT * FROM PWNED WHERE PASSWORD = x. Because IoT means cheap crap developed by the cheapest programmers. Hell, even doing a plain text comparison of if (passwordInput == passwordStoredInPlainText) would have been more secure!
In related news, I will never install an IoT device into my house that I didn't design and program myself.
http://www.atlanticforest.com/wp-content/uploads/2013/04/SmartLog.jpg
I've tried doing some research on this, and didn't come up with anything substantial. What is the practical purpose of a smart electrical socket?
Smart, as in, smartER than the idiot dumb enough to use it.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
That's because they don't know the first thing about it. The internet, that's that nebulous thing they plug into their computer (seriously, there are people who absolutely believe "the internet", that's the router they got from their ISP) where the porn and Facebook lives.
And somehow this can in some way also do stuff with your toaster now. That this could be a security issue does not occur to them for a simple reason: Nothing else does. Everything else in their life has been foolproofed. Cars, appliances, even whatever they do at their job has so many safeguards and protections that they really would have to go out of their way to be in harm's way.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
These articles about insecure IoT devices are published so frequently as to no longer be newsworthy.
I'd like to read an article about an IoT device following security best practices. Now THAT would be newsworthy.
Ho hum. Seems like every other day we get news of yet another crapulent, badly designed, "Internet of Things" device with piss poor security.
Seriously, anyone putting *any* of these shitty things in their house must have a hole in the head.
You'd be at less risk of something bad happening by putting scorpions in your underwear than you would bringing *ANY* IOT device into your home. They're being designed by clowns for clowns.
That's offending! Other Americans are just as smart as that swimmer bloke and his friends.
It's becoming disturbingly obvious that all that stupid crap like murdering people through their internet connections like we see in old cyberpunk is being deliberately worked towards, no matter how inefficient and idiotic it may be.
People are actively making design decisions in hopes that we *will* get hacked to death.
Now let's all pay twice as much for an IoT lawnmower and its patented "bad timing blows it up" wifi fuelcells!
It's the Edimax: http://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/au/home_automation_smart_plug/sp-1101w/
I read the report, all of the vulnerabilities require the attacker to be in physical range of your wi-fi router to carry out a direct connection to your smart device when the device creates a hotspot for initial configuration. Nothing in the report indicates something that could be infiltrated by someone over the Internet from anywhere in the world. So, unless you have shitty neighbors or see a white van parked outside, you have nothing to worry about.
Edimax is the manufacturer of these devices.
-=/\- Jizzbug -/\=-
The hidden meaning of "smart" in "smart phone" and "smart light switch" actually implies something different, taken from the hard drive industry:
Self-Monitoring, Analysis and Reporting Technology (SMART)
The purpose of these devices seems to be total monitoring of its users. A "smart" home usually means the vendor knows the state of every light switch, every door sensor, every movement down to the millisecond. I'm just waiting for a group of burglars to break into such a database to determine when and where to break into houses.