'Smart' Electrical Socket Leaks Your Email Address, Can Launch DDoS Attacks (softpedia.com)

An anonymous reader writes from a report via Softpedia: There is an insecure IoT smart electrical socket on the market that leaks your Wi-Fi password, your email credentials (if configured), and is also poorly coded, allowing attackers to hijack the device via a simple command injection in the password field. Researchers say that because of the nature of the flaws, attackers can overwrite its firmware and add the device to a botnet, possibly using it for DDoS attacks, among other things. Bitdefender didn't reveal the device's manufacturer but said the vendor is working on a fix, which will be released in late Q3 2016. Problems with the device include a lack of encryption for device communications and the lack of any basic input sanitization for the password field. "Up until now most IoT vulnerabilities could be exploited only in the proximity of the smart home they were serving, however, this flaw allows hackers to control devices over the internet and bypass the limitations of the network address translation," says Alexandru Balan, Chief Security Researcher at Bitdefender. "This is a serious vulnerability, we could see botnets made up of these power outlets."

Comments

Re: dumbasses

[Rei]

At least they're only gaining control over an on-off switch. If this was something with a dimmer that they could alter the firmware on, that'd be a lot more concerning. Because the firmware could be the only thing preventing the varistor from doing untoward behavior - short circuiting and throwing circuit breakers in a given location (to enable other nefarious actions while the power is out), oscillating loads in many locations at once in tune with the grid to mess up phase balancing, oscillating loads very quickly (if rapidly responsive devices are connected and if the varistor can shift that fast) in many locations to send out radio signals, etc

The only nefarious thing I can picture doing with a bunch of hacked on-off switches would be trying to overload the grid and cause brownouts. Although I guess if someone had a coffeepot on one of those things and you ran it dry of water you might be able to start a fire...