Slashdot Mirror
Hot Tub Hack Reveals Washed-up Security Protection (bbc.com)
Thousands of hot tubs can be hacked and controlled remotely because of a hole in their online security, BBC Click has revealed. From a report: Researchers showed the TV programme how an attacker could make the tubs hotter or colder, or control the pumps and lights via a laptop or smartphone. Vulnerable tubs are designed to let their owners control them with an app. But third-party wi-fi databases mean hackers can home in on specific tubs by using their GPS location data. Balboa Water Group (BWG), which runs the affected system, has now pledged to introduce a more robust security system for owners and said the problem would be fixed by the end of February.
Pen Test Partners -- the UK security company that carried out the research -- warned that hot tubs were not the only household items at risk. Founder Ken Munro said that many Christmas gifts people would receive this year would connect to the internet and offer remote control through apps. "Manufacturers still are not taking security seriously enough, and until they do consumers have to be very vigilant," he said. "We recommend users reset any default passwords the device has immediately with a unique one of their own."
Pen Test Partners -- the UK security company that carried out the research -- warned that hot tubs were not the only household items at risk. Founder Ken Munro said that many Christmas gifts people would receive this year would connect to the internet and offer remote control through apps. "Manufacturers still are not taking security seriously enough, and until they do consumers have to be very vigilant," he said. "We recommend users reset any default passwords the device has immediately with a unique one of their own."
IoT - the rush for every manufacture to strap a computer to their thing and connect it to the internet and their walled garden platform.
IoT guys need to get together with open standards and push for things like OTA updates and security reviewed libraries. In their rush to create walled gardens. They are creating an oasis of hacks just waiting to be found.
How bad is it? Much worse then you think. Think of protocols that are sort of standard. No encryption. No authentication. Nothing. Then go hang that out on the internet behind a password page using state of the art tech from 1995 (if your lucky). Then even *if* there is some sort of security update thing. It is for maybe 1-2 years. So suddenly my 2k in outlay for hardware hubs and repeaters is useless because it is already at EOL. I own a 'smart TV' from 2009. None of the smart features work anymore. The TV is just fine though.
Why the hell does a hot tub need blue tooth and GPS data? Answer: They don't.
I switched to -1 looking for this post and was not disappointed.
No mod points at the moment, so, bravo to you, sir! Irregardless of political position, I am happy to have seen this post. I just knew it would be here... and it was! What a time to be alive!
Beware of the Leopard.
Dilbert: Good morning, shower!
Automated Shower Machine: Good morning, Dilbert!
Dogbert: Hmm, don't you do enough engineering at work?
Dilbert: Work is just meetings, this is engineering. If this works, someday all showers will be voice activated.
Dogbert [sitting on a stool]: Is it that hard to turn the knobs?
Dilbert: It's not that it's hard, it's unnecessary. [To ASM] 99, please.
ASM: 99. [shower turns on at 99 degrees; Dilbert steps inside]
Dogbert [aside]: 400.
[The ASM does nothing]
Dilbert: Heh-heh, nice try. But the shower is calibrated to respond to my voice only.
Dogbert: Why, you think of everything!
Dilbert: I'm cautious.
Dogbert: That's why you had training wheels on your bike until you were 17.
Dilbert: I was 14.
ASM: 14. [makes the shower temperature 14 degrees]
Dilbert: AAAAAAAAHHHHHHHH! [is frozen in a block of ice] 99! 99! 99! [shower goes back to 99 degrees, as the ice melts] Don't do that!
Dogbert: Where'd you get the voice for that thing? It sounds like the voice for that stupid movie; what was it called, "something, something, a Space Odyssey"?
Dilbert: It wasn't "Something, something, a Space Odyssey", it was "2001: A Spa-" [cut to the exterior of the house, as the ASM evidently makes the shower temperature 2001 degrees] AAAAAAAAGGGGGGHHHHH!!!
[back inside, a red-skinned Dilbert wraps a towel around himself, which then catches on fire as he walks off-screen]
Dogbert: On the plus-side, you look very clean.
Get it started up before you get home, perhaps?
-=This sig has nothing to do with my comment. Move along now=-
So where’s the hack that turns the Hot Tub into a Time Machine?
#DeleteChrome
I work in IT for 23 years now and I don't understand this obsession with IoT !
:)
Are you to lazy to turn off your lights yourself? To use a simple programmable
thermostat? You really want to bug your home with a Google Home/Amazon Alexa/...
or any other IoT gadget "du jour" to be spied on 24/7? Yes I have a cell phone.
This is the only "connected" device I have. Not a single IoT device will ever
enter in my house.
On the next IoT devices hack, the next state-sponsored privacy invasion scandal
or the next Amazon/Google/Nest/... and now Hot Tub manufacturers (WTF!!) leaks
all private data collected by their connected devices, I'll open a bag of
popcorn and watch it from my "not so cool" analog but peaceful life.
Will $CURRENT_YEAR be the year of the Linux Desktop?
> Hot tubs can take days to heat up
If it takes more than 12 hours, it's either defective or large enough for 20 people!
we can hack?
No. Hot tubs can take days to heat up
No they don't. A typical electric hot tub has a 4kw heater and holds 400 gallons. That is about 5F or 3C per hour.
A gas heater is much faster.
No. Hot tubs can take days to heat up, you'd turn it up before you left your house. It's more efficient to keep it at constant temp than to raise and lower it anyhow.
I had a home hot tub in the Eighties. Worst case, with electrical heating, it would take about 4-5 hours to heat up in the winter (lowland urban Arizona). Much faster than that with gas.
That was in the Eighties, but I can see a use case for an IoT hot tub today: an attached webcam that streams all activity to an escrowed server at your lawyer's office. Then if some PoundMeTooer accuses you of creepy behavior, you have video proof or what actually happened.
Get it started up before you get home, perhaps?
Nah. My original hot tub did that, and it was a major pain in the ass. You had to plan a time that you were going into it, and if the weather was going to be bad at 10 p.m., so you thought it might be nice to go in at 7, it wasn't going to be warm enough.
My present tub is really well insulated, and we keep it at a constant 104 degrees F. The UV bacteria control needs to cycle regularly as well. Just set the control panel with the mode, no need to have it exposed on the internet.
About the only reason to put the thing on the internet is so that you can brag about it being on the internet.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
No. Hot tubs can take days to heat up, you'd turn it up before you left your house. It's more efficient to keep it at constant temp than to raise and lower it anyhow.
Everything you said is 100% wrong. Yes, i would like fries with that, Skippy.
I have had spas since the mid 1990's, and only the earliest would use that abominable thermal cycling. The manufacturer even suggested that I set it and forget it on my latest tub. Constant thermal cycling of a water appliance like a spa isn't a good idea anyhow, from the standpoint of expansion and contraction of components.
As well, modern spas that aren't cheap hold their temps well. In the winter, our new outside tub will only drop maybe 4 degrees F over a 12 hour period as long as kept closed. Discovered this during a power failure.
AC is definitely wrong about heating time. I can fill mine with 50 degree F water, start it up, and have it at 104 degrees F in about 6 hours.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
imagine the meyhem LOL
Ask and ye shall receive! http://www.therabbitvibrator.c...
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
... and have 50kg of pasta ready about 2 hours after that?
#DeleteFacebook
just don't put the date in the temp field
The only problem I see with all these IoT devices is that they insist on internet access. If it isn't online, it can't be remotely hacked. You don't need security updates if it isn't able to reach, or be reached by, the internet. Oh, you want to run it remotely yourself, say from work or while on vacation? Fine. ever hear of a VPN? I have lights, plugs, and various other devices that I firewalled off from anywhere but my local net. I can control any of them from anywhere I have internet access, just by first joining my personal, private, as secured as I can make it, VPN. Suddenly my phone or laptop are local, and I can reach my devices just fine. One attack surface, not dozens. Yes, "smart" speakers need access to work, fine, they can have it. But a hot tub? My lights? A simple plug? If it won't work without sending my usage and god knows what else back to the manufacturer, I won't buy it.
BTW, TP-Link seems to be able to be local only without a problem. Very little else out there can make that claim, but I'd very much welcome more info on that, be it other brands that can be local only, or any caveat with the TP-Link brand.
On the one hand you take life too seriously, and on the other, you do not take playful existence seriously enough. Seth
... and have 50kg of pasta ready about 2 hours after that?
Well, Ramen noodles anyhow.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
If you're stupid enough to buy a hot tub and connect it to the internet, you deserve to be boiled alive. WHY IN THE FUCK would anyone need this kind of shit?!?
--- Keep the choice with the user..
You're going to get into it. You walk out, and turn it up that morning.
But you really, really want some 16-yr-old idiot who thinks he's k3wl to turn it off, or turn it to parboil, right?
As the lady wrote, the IGCIT (pronounced id-jit), the Internet of Gratuitously Connected Insecure Things.