Slashdot Mirror
Smart Lights, Speakers, Thermostats, Cameras and Other IoT Devices Are Being Increasingly Used as a Means For Harassment, Monitoring, and Revenge (nytimes.com)
Smart home devices are supposed to bring convenience to people's lives, but increasingly, their unintended consequences are surfacing, and are being exploited to harass others, an investigation by The New York Times has found. [Editor's note: the link maybe paywalled; syndicated source.] From the report: In more than 30 interviews with The New York Times, domestic abuse victims, their lawyers, shelter workers and emergency responders described how the technology was becoming an alarming new tool. Abusers -- using apps on their smartphones, which are connected to the internet-enabled devices -- would remotely control everyday objects in the home, sometimes to watch and listen, other times to scare or show power. Even after a partner had left the home, the devices often stayed and continued to be used to intimidate and confuse.
For victims and emergency responders, the experiences were often aggravated by a lack of knowledge about how smart technology works, how much power the other person had over the devices, how to legally deal with the behavior and how to make it stop. "People have started to raise their hands in trainings and ask what to do about this," Erica Olsen, director of the Safety Net Project at the National Network to End Domestic Violence, said of sessions she holds about technology and abuse. She said she was wary of discussing the misuse of emerging technologies because "we don't want to introduce the idea to the world, but now that it's become so prevalent, the cat's out of the bag."
For victims and emergency responders, the experiences were often aggravated by a lack of knowledge about how smart technology works, how much power the other person had over the devices, how to legally deal with the behavior and how to make it stop. "People have started to raise their hands in trainings and ask what to do about this," Erica Olsen, director of the Safety Net Project at the National Network to End Domestic Violence, said of sessions she holds about technology and abuse. She said she was wary of discussing the misuse of emerging technologies because "we don't want to introduce the idea to the world, but now that it's become so prevalent, the cat's out of the bag."
Internet of Crap. They usually are some cheap things released onto the market without serious security protection(who didn't see THAT coming ?). I'll never use them.
As any Slashdotter knows, smart lights, switches, and power relays are poorly regulated and secured.
If a coordinated attack were to take place against thousands, or millions of these devices,
they absolutely could be used to shutter an electric grid in under a minute by inducing a triplen wave:
https://electricalbaba.com/tri...
Good people go to bed earlier.
"It's coming from inside the house!"
You have 2 competitors and one has no security, they don't sell any products and the bar is raised.
Wtf is 2018.
You are right, it is 2018. So you have 100 competitors and one has security but costs more than the other 99 knockoffs that all came from the same factory. They don't sell any products and go out of business. That is 2018.
"Increasingly", "many", "more"
How many? How do you know?
It makes a great story, but "many" of these kinds of stories don't have much to back them up, as to the size of the problem.
It might be helpful to say "X percent of DV cases in {area} in 2017 involved smart home devices" or something.
Yeah, these IoT devices are so very difficult for anyone in the home to deal with.
I mean, if you have physical access, it's just waaaaaay to difficult too just unplug/disconnect something without understanding exactly how it works. Probably need a contractor for that...
The party of stupid and the party of evil get together and do something both stupid and evil, then call it bipartisan.
Imagine if a home had a single hub for the smart devices that acts as a VPN server. All traffic between the devices and the Internet would be mediated by that hub. Changing the password or key on the hub would automatically lock out all external devices.
Compare this to the current paradigm, where there's a cloud provider for each brand of device, with different authentication information for each. It's easily possible to forget to change some of the passwords when someone moves out/is kicked out of your home. Fragmentation is the problem here.
The traffic would of course be peer-to-peer (i.e. phone-to-hub via Internet) in my paradigm, not going through a bunch of 3rd-party servers to be mined, sliced, diced, and spied upon.
Well some stuff is so leaky it's stupid. Look at the recent bit with baby monitors for example. We're not talking about a lack of passwords, but rather that the devices are so badly designed that any form of protection is easy to bypass, much like all of those "smart locks" that idiots have been pushing.
Om, nomnomnom...
Hate to victim blame, but anyone who buys an IoT thingy and actually plugs it in to the internet is all but asking for it.
Not all victims bought or installed the IoT devices in the first place. This is often a case of an abusive person that installs an IoT device in their (ex) home to keep their (ex) partner under surveillance or to harass them.
FTA:
The victim didn't buy this stuff, the perp did, installed it, and the left, leaving the victim with unknown tech in the house. So there is nothing to blame the victim for. If "he" installed the internet router and other geek IoT things, how is "she" supposed to know what it is without paying an electrician $100+ to go through and explain what the junk is. "She" knows if she touches anyhting herself the internet and tv probably stop working.
This is abuse of secret knowledge by a geek "he" over a non-geek "she".
And yes, I know couples where she changes the light-bulbs and he is clueless, because he doesn't know the difference between 20W and 40W and doesn't know which way to screw in the lightbulb (clockwise?? counterclockwise??)
Unplug the bad device from the network... as in unplug that wire that isn't power. No wire because WiFi?... realistically 99% of the IoT stuff is WiFi, do this to keep it disconnected:
1. Change the password on your WiFi router, and do not update it on your IoT devices.
2. If you don't know how to do that, throw away your old WiFi router and buy a new one, which will force you to make a new password.
in my house. Ever. Working IT security for years and understanding how this stuff works has put me off of it long before Nest, Echo, Google Home, et al ever made the scene. To knowingly allow blatant spies into you midst is a sign of absolute carelessness. No one needs their house to be "automated" unless they're handicapped. My Honeywell HVAC system is simply good enough. I don't need or want an app to control anything in my home. I don't want or need a "connected' home. Being tethered to my on-call mobile phone is bad enough. When I'm home, I want to be away from connectivity as a whole unless I'm gaming.
...or just install a Clapper...
Hello Time Traveler! Mind if I call your answering machine and leave a message? I have this cool 5-minute recording of random clapping noises. I keep it on a cassette tape labeled Your Shit was Never Secure...
Yes, there is someone out there making their partner a veritable slave in their home. But we've taken this so extreme you won't actually ever encounter it in life situation and act like it is everywhere
The easier it becomes to do a thing, the easier it becomes to do an uncharacteristic thing in a moment of weakness. Little girls don't lock their diaries because even they think the lock can't be broken, any more than people lock their front doors because they think their lock can be broken. It's because lots of people will just walk in, and plenty of people will just take something that isn't nailed down. A simple lock that's easily defeated stops the impulsive, if not the determined.
These systems are so vulnerable that they practically invite snooping. If someone can get into your camera just by googling the stuff written on it, the odds go way up that they will. This is actually true of malicious actors as well as the bored and curious; a notable portion of them are incompetent.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Hate to victim blame, but anyone who buys an IoT thingy and actually plugs it in to the internet is all but asking for it. If it can't do it's job not connected, don't buy it, and if it does, don't connect it.
Except in this case if the victim protested they were liable to get punched.
This isn't a story about devices being hacked. This is a story about abusers installing smart home tech in order to control and monitor their partner.
I stole this Sig
Said it 1.5 years ago, will say it again.
IoT is a fad and it will die off pretty soon because of precisely this problem mentioned in TFA.
Nobodies Toaster needs a webserver.
We suffer more in our imagination than in reality. - Seneca