Slashdot Mirror
Smart Lights, Speakers, Thermostats, Cameras and Other IoT Devices Are Being Increasingly Used as a Means For Harassment, Monitoring, and Revenge (nytimes.com)
Smart home devices are supposed to bring convenience to people's lives, but increasingly, their unintended consequences are surfacing, and are being exploited to harass others, an investigation by The New York Times has found. [Editor's note: the link maybe paywalled; syndicated source.] From the report: In more than 30 interviews with The New York Times, domestic abuse victims, their lawyers, shelter workers and emergency responders described how the technology was becoming an alarming new tool. Abusers -- using apps on their smartphones, which are connected to the internet-enabled devices -- would remotely control everyday objects in the home, sometimes to watch and listen, other times to scare or show power. Even after a partner had left the home, the devices often stayed and continued to be used to intimidate and confuse.
For victims and emergency responders, the experiences were often aggravated by a lack of knowledge about how smart technology works, how much power the other person had over the devices, how to legally deal with the behavior and how to make it stop. "People have started to raise their hands in trainings and ask what to do about this," Erica Olsen, director of the Safety Net Project at the National Network to End Domestic Violence, said of sessions she holds about technology and abuse. She said she was wary of discussing the misuse of emerging technologies because "we don't want to introduce the idea to the world, but now that it's become so prevalent, the cat's out of the bag."
For victims and emergency responders, the experiences were often aggravated by a lack of knowledge about how smart technology works, how much power the other person had over the devices, how to legally deal with the behavior and how to make it stop. "People have started to raise their hands in trainings and ask what to do about this," Erica Olsen, director of the Safety Net Project at the National Network to End Domestic Violence, said of sessions she holds about technology and abuse. She said she was wary of discussing the misuse of emerging technologies because "we don't want to introduce the idea to the world, but now that it's become so prevalent, the cat's out of the bag."
Internet of Crap. They usually are some cheap things released onto the market without serious security protection(who didn't see THAT coming ?). I'll never use them.
When spyware makers don't put security in their systems such that they can't be held responsible for being the only party capable of selling user information. They deserve what they get for using the devices.
As any Slashdotter knows, smart lights, switches, and power relays are poorly regulated and secured.
If a coordinated attack were to take place against thousands, or millions of these devices,
they absolutely could be used to shutter an electric grid in under a minute by inducing a triplen wave:
https://electricalbaba.com/tri...
Good people go to bed earlier.
It didn't make the problem MAD, it made the problem WORSE.
-Legal.Troll (a /. hero who can't post because of negative karma)
"It's coming from inside the house!"
Internet of Simple Home Invasion Tactics. That's what we need to start calling this. "IoSHIT."
Easily duped is not smart.
Hate to victim blame, but anyone who buys an IoT thingy and actually plugs it in to the internet is all but asking for it. If it can't do it's job not connected, don't buy it, and if it does, don't connect it.
Wanna buy a shirt?
https://www.redbubble.com/people/stealthfinger/shop?asc=u
You have 2 competitors and one has no security, they don't sell any products and the bar is raised.
Wtf is 2018.
You are right, it is 2018. So you have 100 competitors and one has security but costs more than the other 99 knockoffs that all came from the same factory. They don't sell any products and go out of business. That is 2018.
There are always some power-hungry fuckups that do it. At least these here are obvious about it, unlike the NSA, the GCHQ and other groups of no ethics whatsoever.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
"Increasingly", "many", "more"
How many? How do you know?
It makes a great story, but "many" of these kinds of stories don't have much to back them up, as to the size of the problem.
It might be helpful to say "X percent of DV cases in {area} in 2017 involved smart home devices" or something.
Imagine if a home had a single hub for the smart devices that acts as a VPN server. All traffic between the devices and the Internet would be mediated by that hub. Changing the password or key on the hub would automatically lock out all external devices.
Compare this to the current paradigm, where there's a cloud provider for each brand of device, with different authentication information for each. It's easily possible to forget to change some of the passwords when someone moves out/is kicked out of your home. Fragmentation is the problem here.
The traffic would of course be peer-to-peer (i.e. phone-to-hub via Internet) in my paradigm, not going through a bunch of 3rd-party servers to be mined, sliced, diced, and spied upon.
And before you say "Dynamic IP", Dynamic IP doesn't require use of a cloud intermediate. Only some type of dynamic DNS service (doesn't literally need to be DNS) to point devices to the right place.
People have attempted to gain dominion over others since the dawn of time. The whole desire to put everything you own, and everything that monitors yourself, your baby, your food, your laundry, the loks on your door, your car and make it near-public, it is expected that people will abuse the opportunities you offer. This does not mean that the owner is to blame, but it does mean that the owner puts him or herself in a lot of risk. Sometimes that goes wrong... If you roll the dice, you sometimes roll a 1. Is that so unxpected?
I've preferred that model. Have everything communicate via Z-Wave, Bluetooth, or similar to a hub, which is hardened, and has a manifest/profile for every device including what it can talk to (and 0.0.0.0/0 as a netmask is not going to be allowed.) Perhaps 2-3 hubs for redundancy, if that is what is wanted. This way, there is a hardened device doing all the Internet stuff, rather than devices made in the cheapest Chinese factories with software made by the sloppiest, "get 'er done, it builds, ship it" methods.
However, IoT makers get a lot of cash through analytics, so they want to chuck as much data as the device can glean. It isn't like anything is going to happen to them. Even the GDPR just means they do their stuff in a non-European country.
...and unexpected this is. :-|
Yes, there is someone out there making their partner a veritable slave in their home. But we've taken this so extreme you won't actually ever encounter it in life situation and act like it is everywhere and are conflating the idea with hundreds of things that aren't that to create the illusion it is everywhere and women terrified.
All spouses of all genders have suspicious and paranoid moments and everyone tries to startle others and laughs when they jump sometimes. You and your spouse ARE both entitled to not be perfect. Try to be careful not to fall into arguments based on the slippery slope fallacy that have been pushed by others with an agenda which is served by your judgement being clouded by emotion and over sensitization. 999 times out of a thousand this is harmless and just call your spouse out on it if something like this is bothering you because while you want to have a sense of privacy you aren't actually entitled to it from your partner. It is your partner who ultimately is choosing to respect your privacy on the assumption there is nothing to find and it is on you to make sure that is actually true.
A slap or a punch might do objective physical harm and under rare or exceptional circumstances could be part of an accident causing serious damage but generally speaking they aren't that big a deal which is why society accepted them as means to address extremely unacceptable and/harmful behavior when an individual refused to correct themselves. Getting rid of these options as we have means also taking on the obligation to never "lose your shit", betray your spouse, embrace an irrational philosophy which allows you to pretend emotions justify irrational behavior. The very existence of tinder shows just how good a job we are doing.
As far as the "Last person leaving the house" problem, this can be solved using a three-way switch at the door. If the switch is on, the regular thermostat is switched into the heat circuit and turns the heating on at 20C or whatever. If the switch is off, there's still a backup fixed-temp thermostat in parallel that cuts in if the temp drops below 15C or something like that. The last person out of the house turns it off, first person in turns it back on. It won't kill anyone to be in a cold house for a few minutes.
Unplug the bad device from the network... as in unplug that wire that isn't power. No wire because WiFi?... realistically 99% of the IoT stuff is WiFi, do this to keep it disconnected:
1. Change the password on your WiFi router, and do not update it on your IoT devices.
2. If you don't know how to do that, throw away your old WiFi router and buy a new one, which will force you to make a new password.
in my house. Ever. Working IT security for years and understanding how this stuff works has put me off of it long before Nest, Echo, Google Home, et al ever made the scene. To knowingly allow blatant spies into you midst is a sign of absolute carelessness. No one needs their house to be "automated" unless they're handicapped. My Honeywell HVAC system is simply good enough. I don't need or want an app to control anything in my home. I don't want or need a "connected' home. Being tethered to my on-call mobile phone is bad enough. When I'm home, I want to be away from connectivity as a whole unless I'm gaming.
...or just install a Clapper...
Hello Time Traveler! Mind if I call your answering machine and leave a message? I have this cool 5-minute recording of random clapping noises. I keep it on a cassette tape labeled Your Shit was Never Secure...
The two guys gave one another "that look" - the one that says, Ah, silly paranoid nerd.
Your name is probably in a database too. 'Refused installation of a Telescreen.'
Have gnu, will travel.
as designed. Just ask Google.
The reality is, the internet and its "things", browsers included, is a heedless goldrush where risk indifferent short sighted megalomaniacs -Jack Dorsey comes to mind as a prototype- inflict socially destructive , pointless services and gadgets on shortsighted people who are having the real consequences of their participation, subscription or purchase systematically and deliberately hidden from them.
In the end, people will sort it out, vote with their wallets and eyeballs and society will take its lesson.
In the meantime, it's tough to watch it unfold.
If you think any of this is "unintended", you are a complete moron. Unlike them. They aren't morons. They are just evil.
Uh, a default password of password sent over insecure protocols is not "evil". That's just plain stupid, and their only intent in doing so was to save cost.
Well, they do often cause physical and psychological harm....?
I think US citizens should have the right to do with their bodies as they wish, however.
And we should protect our borders from those committing the crime of crossing illegally...if they start right off breaking the law, then it would seem logical they don't have qualms about breaking other laws here.
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Moralistic moronic nonsense. The law is just a set of words written by a bunch of old farts who managed to con dumb people into voting for them.
By your argument, we should shoot speeders and pot smokers -- they've already broken the law, so they're more likely to commit murder. Might as well prevent crime before it happens.
I think the inverse is actually true with illegal immigrants. They're less likely to commit violent crimes because the consequences can often be dire. Not only jail, but deportation back to a war-torn country or one where gangs are looking to kill them.
Why do you want hackers to control your house?
I was responding to this blog post -- especially the conclusion and Marx quote at the end (quoted here):
"Return of the Slave Society"
https://thesphinxblog.com/2017...
"... There's a substantial tradition, especially in the nineteenth century, of contrasting ancient slave society with modern capitalism. I always recall the Aristotle quote with which I started from Marx's evocation of it in Das Kapital: foolish Greek, thinking that machinery would lead to a life of leisure, rather than being the surest method of lengthening the working day! Likewise, "the Roman slave was bound with chains... the modern wage-labourer is bound to his owner by invisible threads". Manifestly, Marx failed to imagine that the remorseless logic of capitalism might lead workers to be displaced rather than exploited, and that we might be better off thinking of analogies between Juvenal's "bread and circuses" snark and the joys of social media...
> "On the one hand, there have started into life industrial and scientific forces, which no epoch of the former human history had ever suspected. On the other hand, there exist symptoms of decay, far surpassing the horrors recorded of the latter times of the Roman Empire. In our days, everything seems pregnant with its contrary. Machinery, gifted with the wonderful power of shortening and fructifying human labour, we behold starving and overworking it. The new-fangled sources of wealth, by some strange weird spell, are turned into sources of want. The victories of art seem bought by the loss of character. At the same pace that mankind masters nature, man seems to become enslaved to other men or to his own infamy. Even the pure light of science seems unable to shine but on the dark background of ignorance. All our invention and progress seem to result in endowing material forces with intellectual life, and in stultifying human life into a material force. (Marx, Speech at the anniversary of the People's Paper)""
==== My own comment there: https://thesphinxblog.com/2017...
Hi Neville, Thanks for the insightful post on what can we learn about our possible future from studying a past society where "autonomous tools" were ubiquitous [Ancient Rome with slaves].
I've been wondering myself what we could learn about the future of robotic economics from the pre-Civil War US South and its slave-based economy. Given robots and AIs might have feelings in the future, that includes the previous moral justifications for what we now find abhorrent to do to people such as outlined in "Defending Slavery: Proslavery Thought in the Old South: A Brief History with Documents" by Paul Finkelman.
Thanks for expanding the picture for me to include reflections from Roman society. You might find of interest some of Marshall Brain's speculative writings on the future of robotics and economics (and the resulting concentration of wealth) like in his "Robotic Nation" essays.
I especially like your tangential point that "Marx failed to imagine that the remorseless logic of capitalism might lead workers to be displaced rather than exploited".
To go off further on that tangent (reflecting your Marx quote, including "At the same pace that mankind masters nature, man seems to become enslaved to other men or to his own infamy"), one of the saddest things about modern times is that all these advanced technologies -- technologies that could be used to liberate people's time in a post-scarcity way -- these technologies are instead being used mainly to regulate people's time via Orwellian 24X7 surveillance both at work and at home. People are even voluntary inviting Alexa, Siri, and so on into their homes to potentially eavesdrop on everything they or their children say -- like with the human slaves of old. But there is a twist now of potentially recording everything said in a home and c
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
Nice opinion. Got any facts?
Fools bought into all this stuff in the first place with blinders on not even wanting to see that they were just creating more avenues for attacks on their privacy and now you all scream bloody murder over it. I'm laughing so hard I may dislocate a rib.
Nothing can be perfect and there always exists a loop hole. Proper coordination between the devices and their security feature is not known to most of the common users.
Why is Slashdot suddenly full of luddites?
My home is full of smart stuff. My fiance has full access to that smart stuff. If she leaves... I can easily revoke her access with one (ok, two) touches of a button in the settings of my iPhone (to revoke her access to Homekit). She won't be able to do anything with my house past that point.
This has absolutely NOTHING to do with "crappy IOT security"... or any such scare mongering thing. All that's wrong here is that people don't know how their own devices work.
If you're not solely using Homekit then there is always another simple solution:
Hue bulbs that someone who has left the house can control? First: unplug the hub. The lights will still function perfectly as "dumb" lights that go on and off with the switch... but not a soul will be able to remotely control them. Want to turn them back into smart lights? Reset the hub and plug it back in and set it up as a new device... the person that's left the house will not be able to control them whatsoever.
That's pretty much the same for any smart stuff: unplug the hub first... then later if you want that capability back - just reset the Hub and set it up as a new device.
It works the same way for Caseta lighting, for Ecobee thermostats (just reset it and re-set it up), for Google Home, Alexa devices, etc.
I don't understand why people feel like they are somehow "at the mercy" of these devices. Just freaking unplug them and no one will be able to control your house... and when you have time to set them back up again - do it.
Why does every damn IOT story on here have to be followed with 1000 luddites screaming "I told you they were insecure!". This is freaking Slashdot! We're not afraid of technology here! We can talk about how to mitigate technological problems and steps to take to solve issues like these.
Jebus!
Said it 1.5 years ago, will say it again.
IoT is a fad and it will die off pretty soon because of precisely this problem mentioned in TFA.
Nobodies Toaster needs a webserver.
We suffer more in our imagination than in reality. - Seneca
You forgot to ask yourself if the law is just and if the pu ishment meets the crime. To blindly follow a law because it is alaw is like blindly follow an order.
Don't fight for your country, if your country does not fight for you.
If you don't like the law...CHANGE the law.
By they way, it is the legislators that make and pass the laws, so, tender your vote that way election time.
But until then, the law is the law.
Light travels faster than sound. This is why some people appear bright until you hear them speak.........