Slashdot Mirror
Think Twice About Buying Internet-connected Devices Off Ebay (qz.com)
If you're thinking about buying gadgets from auction sites such as Ebay, you will want to consider the potential risks. From a report: When you're buying from a third-party seller, it's a lot more difficult to tell where products have come from, whether you're getting exactly what you think you're getting, and if anything has been done to the product since it was manufactured. "It is possible for internet-connected devices to be tampered with and resold on the web," Leigh-Anne Galloway, lead cybersecurity resilience analyst at the cybersecurity firm Positive Technologies, told Quartz. "It's similar to buying a secondhand cellphone without it being restored to factory settings." In fact, buying a second hand gadget can potentially expose the user to some pretty extreme scenarios. "Cameras and IoT devices can contain spyware and malware, which can cause a plethora of problems for the user," Galloway added. "These devices could possibly listen to you, watch your every step, communicate with and attack other devices connected to the same local network, such as PCs, laptops, and TVs." Galloway said devices could also be used to perform botnet attacks -- where an unsecured internet-connected device is accessed by another computer and used along with other breached devices to take down websites or internet services, as what happened with the Mirai botnet attack in 2016.
It's all devices. Hell, most of them are designed to spy on the users. Do you trust anything coming from China?
The sad fact is you've already agreed to be spied on when you agree to use almost any Internet connected device. There's really nothing that changes with this article.
"A plan fiendishly clever in its intricacies"- Homer Simpson
When you gaze long into an abyss, the abyss also gazes into you.
So, when you buy that spycam, be informed that it might also be spying on you.
Chat with other atheists http://secularchat.org
I always buy in Alibaba, some Russian named seller in a Bulgarian store fulfills my Alibaba order that gets shipped straight from China.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Has anyone really trusted eBay in the last 10 years, electronic device or not?
You should think twice before buying any internet connected device, and twice again before buying anything of Alleybobo. By my reckoning that's four times - at least.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Show of hands, who here doesn't immediately reflash everything with updatable firmware? Usually there's an update anyway, by the time you get it in your hot little hands.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
ANYTHING you buy that connects to the internet should first and foremost go through a thorough audit. You and your habits are marketable data, being able to get that for free AND make you pay for it ... And you don't even get a (fire)wall out of it.
But seriously. You shouldn't trust ANY device that gets hooked to the internet. Even and especially when it is from a "reputable" hardware manufacturer. All that means is that they're more likely to be longer in business to siphon your data.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Fixed the summary for you. Even if you can get an internet-connected device that doesn't tout spying as a feature, the supply chain is full of counterfeits and tampered items.
...IoT devices you buy at Amazon, Walmart and similar places is 100% safe, NSA approved.
The warning and the advice is good, but Leigh-Anne Galloway (and the article author) provides no data if that is happening or not. It would be interesting to know that from 10 devices bought X came with modified firmware with spyware. But no data is provided.
Think Twice About Buying Anything Off Ebay
"It's similar to buying a secondhand cellphone without it being restored to factory settings". Well, if that happens, it's not MY data that is at risk, but the data of the previous owner. I can easily reset it to factory defaults, and maybe flash the firmware.
I was looking at a cheap Mini PC, labeled an "industrial PC" on newegg, from a Chinese seller, obviously, and the one review said the version of windows pre-installed was pirated, and there was software installed that simulated the license authentication, but as soon as you installed anti-virus it would detect that software and quarantine it, and then your windows copy realizes it's a pirated copy. Caveat emptor.
"I have never let my schooling interfere with my education." - Mark Twain
So many devices no matter where you buy them have 'security flaws' and be at risk to expose sensitive data or spy etc etc.
This sounds more like "Oh god, instead of us buying it from China for 10$ then selling it in north america for 110$, people are directly buying it for 10$" Ah noooo what do we do!
Just sounds like a campaign to try to convince people to pay higher prices.
Uplink Hosting - Web/email at an affordable price with high performance - https://uplinkhosting.ca/link.php?id=3
"Think twice about buying ANY Internet-connected devices, from ANYWHERE"
>Do you trust anything coming from USA ?
Hell No.
aaaaaaa
You should be worried about at least 3 things: 1) Intel Management Engine that could be present in some Intel-based books, 2) Something inside a BIOS, for instance a theft prevention mark that is automatically recognized by Windows (Have forgotten the exact name). I have such a Thinkpad and just don't care since I don't use Windows and have a proof of purchase, 3) BIOS password which in Thinkpads is NOT erased by CMOS battery removal.
>> NSA approved vendors.
Like HP ?
HAHAHAHAHAHAHA
Backdoors included.
aaaaaaa
Fixed the summary for you. Even if you can get an internet-connected device that doesn't tout spying as a feature, the supply chain is full of counterfeits and tampered items.
There is one key benefit. With counterfeits and tampered items it is likely they may have broken the spying features.
There are reputable sellers from US companies like trade in companies and phone insurance companies that refurbish and resell devices on e-bay vs whole sale . An unknown seller might tamper with a device but iPhones harder for spyware. Non authentic parts such as knock off cheaper battery could also be a concern. Apple CPO = Certified PreVious Owned which are supposed to be from certified Apple supply chain partners. Buying from Apple or Carriers while might be more expensive lower risk of unauthorized parts or spyware / malware.
My ROKU remote app would disagree with you but it's too busy watching Netflix.
The problem with finding pr0n on cheap computers is that it's usually old, and thus low-bitrate... I mean, music.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
You had me at 'Think'.
Thanks for the warning. It *is* quite concerning that someone other than Google/Facebook/Apple/Amazon/NSA/<otherGiantCorp> might be listening. Quite concerning indeed. One would never know what *those* unscrupulous actors might do with one's data.
Requiem for the American Dream