Slashdot Mirror
Smart Lights, Speakers, Thermostats, Cameras and Other IoT Devices Are Being Increasingly Used as a Means For Harassment, Monitoring, and Revenge (nytimes.com)
Smart home devices are supposed to bring convenience to people's lives, but increasingly, their unintended consequences are surfacing, and are being exploited to harass others, an investigation by The New York Times has found. [Editor's note: the link maybe paywalled; syndicated source.] From the report: In more than 30 interviews with The New York Times, domestic abuse victims, their lawyers, shelter workers and emergency responders described how the technology was becoming an alarming new tool. Abusers -- using apps on their smartphones, which are connected to the internet-enabled devices -- would remotely control everyday objects in the home, sometimes to watch and listen, other times to scare or show power. Even after a partner had left the home, the devices often stayed and continued to be used to intimidate and confuse.
For victims and emergency responders, the experiences were often aggravated by a lack of knowledge about how smart technology works, how much power the other person had over the devices, how to legally deal with the behavior and how to make it stop. "People have started to raise their hands in trainings and ask what to do about this," Erica Olsen, director of the Safety Net Project at the National Network to End Domestic Violence, said of sessions she holds about technology and abuse. She said she was wary of discussing the misuse of emerging technologies because "we don't want to introduce the idea to the world, but now that it's become so prevalent, the cat's out of the bag."
For victims and emergency responders, the experiences were often aggravated by a lack of knowledge about how smart technology works, how much power the other person had over the devices, how to legally deal with the behavior and how to make it stop. "People have started to raise their hands in trainings and ask what to do about this," Erica Olsen, director of the Safety Net Project at the National Network to End Domestic Violence, said of sessions she holds about technology and abuse. She said she was wary of discussing the misuse of emerging technologies because "we don't want to introduce the idea to the world, but now that it's become so prevalent, the cat's out of the bag."
Internet of Crap. They usually are some cheap things released onto the market without serious security protection(who didn't see THAT coming ?). I'll never use them.
When spyware makers don't put security in their systems such that they can't be held responsible for being the only party capable of selling user information. They deserve what they get for using the devices.
As any Slashdotter knows, smart lights, switches, and power relays are poorly regulated and secured.
If a coordinated attack were to take place against thousands, or millions of these devices,
they absolutely could be used to shutter an electric grid in under a minute by inducing a triplen wave:
https://electricalbaba.com/tri...
Good people go to bed earlier.
It didn't make the problem MAD, it made the problem WORSE.
-Legal.Troll (a /. hero who can't post because of negative karma)
Stupid people hook up cheap Chinesium crap to the internet and it ends badly.
Whoda thunk?!?
They don't want to introduce the idea to the world?
Then people won't stop buying this crap. It's not an issue of "make a law" it's an issue of "let consumers know so the market can work correctly"
You have 2 competitors and one has no security, they don't sell any products and the bar is raised.
Wtf is 2018.
"It's coming from inside the house!"
Internet of Simple Home Invasion Tactics. That's what we need to start calling this. "IoSHIT."
Easily duped is not smart.
Hate to victim blame, but anyone who buys an IoT thingy and actually plugs it in to the internet is all but asking for it. If it can't do it's job not connected, don't buy it, and if it does, don't connect it.
Wanna buy a shirt?
https://www.redbubble.com/people/stealthfinger/shop?asc=u
If you're too lazy to stand up and close the light yourself... or just install a Clapper, you deserve this.
The 'S' in 'IoT' stands for security. ....I'll be here all night.
If you think any of this is "unintended", you are a complete moron. Unlike them. They aren't morons. They are just evil.
There are always some power-hungry fuckups that do it. At least these here are obvious about it, unlike the NSA, the GCHQ and other groups of no ethics whatsoever.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
"Increasingly", "many", "more"
How many? How do you know?
It makes a great story, but "many" of these kinds of stories don't have much to back them up, as to the size of the problem.
It might be helpful to say "X percent of DV cases in {area} in 2017 involved smart home devices" or something.
Imagine if a home had a single hub for the smart devices that acts as a VPN server. All traffic between the devices and the Internet would be mediated by that hub. Changing the password or key on the hub would automatically lock out all external devices.
Compare this to the current paradigm, where there's a cloud provider for each brand of device, with different authentication information for each. It's easily possible to forget to change some of the passwords when someone moves out/is kicked out of your home. Fragmentation is the problem here.
The traffic would of course be peer-to-peer (i.e. phone-to-hub via Internet) in my paradigm, not going through a bunch of 3rd-party servers to be mined, sliced, diced, and spied upon.
A couple of years back, I was getting my annual boiler service done. The two guys from British Gas went about inspecting everything and then asked if I was interested in getting Hive. They talked up the benefits of it: being able to control my central heating when I'm not in, the system intelligently switching on the heating when it notices I'm heading home from work, the system switching stuff off when it notices the last person leave the house (all via their smartphone).
I told them no. When they asked why not, I told them that not everything needs to be connected to the internet. Besides, my heating is on a timer and if I want to change the temperature, I can walk the five steps from my sofa to the thermostat and adjust it that way. At the end of the day, it would only take one hack to bugger up all the Hive-connected central heating systems and so I wasn't interesting.
The two guys gave one another "that look" - the one that says, Ah, silly paranoid nerd. No, not silly nerd, I think I'm being very sensible. Why I imagine Hive has a manual override and such hacks have yet to occur, it's not a matter of if, it's a matter of when. Imagine going away for two weeks to discover your central heating has been running full blast 24/7, or during the coldest week of the year the system simply won't stay on because it's being ordered not to.
No thanks. I'll stick to the old fashioned methods of turning on my lights, running my kettle, and checking to see how the food in the oven is doing (I mean, ffs who the hell needs a wifi camera in a fucking oven?!!!)
And before you say "Dynamic IP", Dynamic IP doesn't require use of a cloud intermediate. Only some type of dynamic DNS service (doesn't literally need to be DNS) to point devices to the right place.
did you say something dave? is something bothering you? phewww... no heart no spirit no life.. recycle along.. https://www.youtube.com/watch?v=q0o_0b5abwA
"law-enforcement officials said the technology was too new to have shown up in their cases"
I'm fed up with this excuse. Heard it so many times before - when is someone with a budget going to address this kind thing?
People have attempted to gain dominion over others since the dawn of time. The whole desire to put everything you own, and everything that monitors yourself, your baby, your food, your laundry, the loks on your door, your car and make it near-public, it is expected that people will abuse the opportunities you offer. This does not mean that the owner is to blame, but it does mean that the owner puts him or herself in a lot of risk. Sometimes that goes wrong... If you roll the dice, you sometimes roll a 1. Is that so unxpected?
I've preferred that model. Have everything communicate via Z-Wave, Bluetooth, or similar to a hub, which is hardened, and has a manifest/profile for every device including what it can talk to (and 0.0.0.0/0 as a netmask is not going to be allowed.) Perhaps 2-3 hubs for redundancy, if that is what is wanted. This way, there is a hardened device doing all the Internet stuff, rather than devices made in the cheapest Chinese factories with software made by the sloppiest, "get 'er done, it builds, ship it" methods.
However, IoT makers get a lot of cash through analytics, so they want to chuck as much data as the device can glean. It isn't like anything is going to happen to them. Even the GDPR just means they do their stuff in a non-European country.
...and unexpected this is. :-|
This is not about some unknown person controlling crap. This is about an abusive spouse who installs stuff to spy/control/annoy their spouse at home. Think I put my wife in a cage when I leave and screw with her remotely while watching on the remote camera to get my rocks off. Better security is not going to help. May hurt as these sick individuals will be safe as no one can see what demented things they are doing to their spouse.
Yes, there is someone out there making their partner a veritable slave in their home. But we've taken this so extreme you won't actually ever encounter it in life situation and act like it is everywhere and are conflating the idea with hundreds of things that aren't that to create the illusion it is everywhere and women terrified.
All spouses of all genders have suspicious and paranoid moments and everyone tries to startle others and laughs when they jump sometimes. You and your spouse ARE both entitled to not be perfect. Try to be careful not to fall into arguments based on the slippery slope fallacy that have been pushed by others with an agenda which is served by your judgement being clouded by emotion and over sensitization. 999 times out of a thousand this is harmless and just call your spouse out on it if something like this is bothering you because while you want to have a sense of privacy you aren't actually entitled to it from your partner. It is your partner who ultimately is choosing to respect your privacy on the assumption there is nothing to find and it is on you to make sure that is actually true.
A slap or a punch might do objective physical harm and under rare or exceptional circumstances could be part of an accident causing serious damage but generally speaking they aren't that big a deal which is why society accepted them as means to address extremely unacceptable and/harmful behavior when an individual refused to correct themselves. Getting rid of these options as we have means also taking on the obligation to never "lose your shit", betray your spouse, embrace an irrational philosophy which allows you to pretend emotions justify irrational behavior. The very existence of tinder shows just how good a job we are doing.
Unplug the bad device from the network... as in unplug that wire that isn't power. No wire because WiFi?... realistically 99% of the IoT stuff is WiFi, do this to keep it disconnected:
1. Change the password on your WiFi router, and do not update it on your IoT devices.
2. If you don't know how to do that, throw away your old WiFi router and buy a new one, which will force you to make a new password.
in my house. Ever. Working IT security for years and understanding how this stuff works has put me off of it long before Nest, Echo, Google Home, et al ever made the scene. To knowingly allow blatant spies into you midst is a sign of absolute carelessness. No one needs their house to be "automated" unless they're handicapped. My Honeywell HVAC system is simply good enough. I don't need or want an app to control anything in my home. I don't want or need a "connected' home. Being tethered to my on-call mobile phone is bad enough. When I'm home, I want to be away from connectivity as a whole unless I'm gaming.
as designed. Just ask Google.
The reality is, the internet and its "things", browsers included, is a heedless goldrush where risk indifferent short sighted megalomaniacs -Jack Dorsey comes to mind as a prototype- inflict socially destructive , pointless services and gadgets on shortsighted people who are having the real consequences of their participation, subscription or purchase systematically and deliberately hidden from them.
In the end, people will sort it out, vote with their wallets and eyeballs and society will take its lesson.
In the meantime, it's tough to watch it unfold.
Why do you want hackers to control your house?
This has jack shit to do with poorly maintained/cheap stuff, and it's all about these things being correctly configured to answer to their intended (at the time) master .. who happens to move out but still retains control of things to mess with their ex.
(How you got modded up, instead of down to -1 Off Topic, is a testament to the moderators' incompetence. No thinking person would have modded you up, unless their goal was to maliciously pollute the discussion with distractions. You are a waste.)
If there's a lesson here, it's that things need obvious reset buttons available to whoever has physical access, so that possession, not whoever-set-the-password-first, becomes the primary means of deciding to whom it should ultimately answer.
I was responding to this blog post -- especially the conclusion and Marx quote at the end (quoted here):
"Return of the Slave Society"
https://thesphinxblog.com/2017...
"... There's a substantial tradition, especially in the nineteenth century, of contrasting ancient slave society with modern capitalism. I always recall the Aristotle quote with which I started from Marx's evocation of it in Das Kapital: foolish Greek, thinking that machinery would lead to a life of leisure, rather than being the surest method of lengthening the working day! Likewise, "the Roman slave was bound with chains... the modern wage-labourer is bound to his owner by invisible threads". Manifestly, Marx failed to imagine that the remorseless logic of capitalism might lead workers to be displaced rather than exploited, and that we might be better off thinking of analogies between Juvenal's "bread and circuses" snark and the joys of social media...
> "On the one hand, there have started into life industrial and scientific forces, which no epoch of the former human history had ever suspected. On the other hand, there exist symptoms of decay, far surpassing the horrors recorded of the latter times of the Roman Empire. In our days, everything seems pregnant with its contrary. Machinery, gifted with the wonderful power of shortening and fructifying human labour, we behold starving and overworking it. The new-fangled sources of wealth, by some strange weird spell, are turned into sources of want. The victories of art seem bought by the loss of character. At the same pace that mankind masters nature, man seems to become enslaved to other men or to his own infamy. Even the pure light of science seems unable to shine but on the dark background of ignorance. All our invention and progress seem to result in endowing material forces with intellectual life, and in stultifying human life into a material force. (Marx, Speech at the anniversary of the People's Paper)""
==== My own comment there: https://thesphinxblog.com/2017...
Hi Neville, Thanks for the insightful post on what can we learn about our possible future from studying a past society where "autonomous tools" were ubiquitous [Ancient Rome with slaves].
I've been wondering myself what we could learn about the future of robotic economics from the pre-Civil War US South and its slave-based economy. Given robots and AIs might have feelings in the future, that includes the previous moral justifications for what we now find abhorrent to do to people such as outlined in "Defending Slavery: Proslavery Thought in the Old South: A Brief History with Documents" by Paul Finkelman.
Thanks for expanding the picture for me to include reflections from Roman society. You might find of interest some of Marshall Brain's speculative writings on the future of robotics and economics (and the resulting concentration of wealth) like in his "Robotic Nation" essays.
I especially like your tangential point that "Marx failed to imagine that the remorseless logic of capitalism might lead workers to be displaced rather than exploited".
To go off further on that tangent (reflecting your Marx quote, including "At the same pace that mankind masters nature, man seems to become enslaved to other men or to his own infamy"), one of the saddest things about modern times is that all these advanced technologies -- technologies that could be used to liberate people's time in a post-scarcity way -- these technologies are instead being used mainly to regulate people's time via Orwellian 24X7 surveillance both at work and at home. People are even voluntary inviting Alexa, Siri, and so on into their homes to potentially eavesdrop on everything they or their children say -- like with the human slaves of old. But there is a twist now of potentially recording everything said in a home and c
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
It's clear that a lot of people (you, for example) not only decided against reading the article, but also didn't read the Slashdot summary or even the headline. But felt compelled to post.
Boy and girl's eye meet. One thing leads to another, smoochy smoochy, let's play house. Girl says "I'm a girl so I'm going to dork out on makeup." Boy says "I'm a boy so I'm going to dork out on computers."
Boy can actually do a good job. He may be able to perfectly maintain everything, and it's all secured and inaccessible from the Internet. His and her phones are on a VPN that talks to homeassistant or whatever, and things are correct.
Boy smooches wrong girl. Original girl says "You're a bad boy. Move out." Boy angrily moves out, but maybe doesn't take all the computers with him (maybe she paid for some of them, or maybe he wants to leave his agents in the house). Boy still has access. He can clicky clicky and things happen that girl doesn't want to happen.
Girl has gear that used to be good, perfectly designed, but now answers to someone else. She's no longer better off than someone who had put Apple or Google in charge of the computers. And like an Apple or Google user, girl loses. Gotta chuck it, or else take control of it. Maybe she can do that, and maybe she can't. But it's one more thing to worry about when she's also changing the door locks (unless they're part of this, grrr), updating her insurance stuff, telling the neighbors "call me if you see that creep hanging around here", etc.
This almost has nothing to do with smart switches; the same situation can happen simply with a word processor. Boy sshs in, change resume to mention cock-sucking skills, girl sends to prospective employer quickly without noticing the sabotage, and bad thing happened. Boy sshs in and simply deletes girl's whole project folders, oh and by the way, I took the backup system with me when I moved out. All the usual bullshit is still on the table, but now it also includes the TV (not just on/off but maybe even the list of shows that sickbeard gets for showing on the TV), light switches, HVAC, etc. It's just more stuff, overall, so the stakes are higher.
And that's really what it comes down to. More things are centrally controlled by computer instead of physical presence, which can be a good thing .. until it's not. Until the computers' loyalties become out-of-date.
Fools bought into all this stuff in the first place with blinders on not even wanting to see that they were just creating more avenues for attacks on their privacy and now you all scream bloody murder over it. I'm laughing so hard I may dislocate a rib.
That is not the current paradigm; it's just one of them. I think most reasonably-intelligent people realize that "cloud providers" are usually one of the worst ways to handle most applications. (Do you know anyone who uses Google Docs or Office 365? I don't.)
If your home automation uses cloud providers, it's because you chose to put some random strangers in charge of your stuff instead of having your own hass (or OpenHab or whatever) talking z-wave to your stuff.
But either approach has the same problem, once you decide to allow remote control of things (e.g. hubby and wife's phones). If there's a break up, then someone needs to revoke someone else's access. But that's the same whether we're talking about light switches, the car or the kid or the house itself. People have had this IoT problem for thousands of years, figuratively. It's just that now, it has grown to include more things, such as light switches. Talk to a 1968 divorcee, though, and you'll near similar stories. ("What?! He terminated the milk delivery! What? He was spotted sneaking into the back yard, unlocking the shed with his own key, and he took something out! Hey, where's my car?! My son didn't come home from school and I called and they said his father picked him up!!")
Breakups are a hard problem to solve.
How about unplugging it?
Nothing can be perfect and there always exists a loop hole. Proper coordination between the devices and their security feature is not known to most of the common users.
You're here to bitch about creimer. Meanwhile, creimer posted two dozen AC comments over the weekend. You don't need a user account to promote your agenda.
Whew! Close call. The typical computer-illiterate here on slashdot would NEVER have thought to change the password.
Why is Slashdot suddenly full of luddites?
My home is full of smart stuff. My fiance has full access to that smart stuff. If she leaves... I can easily revoke her access with one (ok, two) touches of a button in the settings of my iPhone (to revoke her access to Homekit). She won't be able to do anything with my house past that point.
This has absolutely NOTHING to do with "crappy IOT security"... or any such scare mongering thing. All that's wrong here is that people don't know how their own devices work.
If you're not solely using Homekit then there is always another simple solution:
Hue bulbs that someone who has left the house can control? First: unplug the hub. The lights will still function perfectly as "dumb" lights that go on and off with the switch... but not a soul will be able to remotely control them. Want to turn them back into smart lights? Reset the hub and plug it back in and set it up as a new device... the person that's left the house will not be able to control them whatsoever.
That's pretty much the same for any smart stuff: unplug the hub first... then later if you want that capability back - just reset the Hub and set it up as a new device.
It works the same way for Caseta lighting, for Ecobee thermostats (just reset it and re-set it up), for Google Home, Alexa devices, etc.
I don't understand why people feel like they are somehow "at the mercy" of these devices. Just freaking unplug them and no one will be able to control your house... and when you have time to set them back up again - do it.
Why does every damn IOT story on here have to be followed with 1000 luddites screaming "I told you they were insecure!". This is freaking Slashdot! We're not afraid of technology here! We can talk about how to mitigate technological problems and steps to take to solve issues like these.
Jebus!
"we don't want to introduce the idea to the world"
When will people ever learn that vulnerabilities need to be made public right away? Oh, that's right... it will never happen because it will negatively affect public perception and consumer ignorance, uhm, I mean consumer confidence.
Said it 1.5 years ago, will say it again.
IoT is a fad and it will die off pretty soon because of precisely this problem mentioned in TFA.
Nobodies Toaster needs a webserver.
We suffer more in our imagination than in reality. - Seneca
There are no IoT (Internet of Threats) devices here, and never will be.
You don't need a user account to promote your agenda.
See this is why nobody likes you. A good Slashdot poster is here to have a multi-sided discussion and not to promote an agenda.
We don't want to be advertised to you idiotic psychopath
OMFG. This 2018. Why the fuck are you still using hubs? Better yet, where the hell are you buying them?
Now I like that "smart" idea you have. If we take a hub, and make it "smart" then that could work...but we gotta come up with a name for it. Not too cool to attract attention though. I'm thinking something along the lines of a word that is common parlance, but to that very same commoner, doesn't appear to do what it really does.
Something like "switch" maybe...
If all of that crap you typed in your two posts is any indication, you are the person, the ABUSER, tfa is talkin about. You dedicated your last paragraph to glories of slappin a bitch around and why that's really ok. Furthermore, just to be extra Deplorable, you followed that up with since you can't beat your wife, you now have to "betray your spouse, embrace an irrational philosophy which allows you to pretend emotions justify irrational behavior" which that last piece doesn't even make fucking sense. I guess you mean "become a libtard" or some such other vulagarity, I don't fucking know.
A monitoring device that you leave on in your home and is attached to the interwebs could be used to monitor you?
Fake news.