Re:I stayed in a hotel with Android lightswitches and it was...
by z3t4 on Saturday March 12, 2016 @05:59AM
(#11272332)
This is a nice hacking story. But when you have physical access and expertise you can hack anything. So I don't understand what's so sad about it. I do advocate security in depth, and they should probably have added a few more "layers" of security, like hide the cables and encrypt the network traffic. But then he could just use a screwdriver or pull the encryption key from the device, etc. But they probably judged that stopping kids from playing with it would be enough. The guy is a freaking firmware developer and security expert!
[ Parent
| on HN ]
Re:I stayed in a hotel with Android lightswitches and it was...
by sciurus on Saturday March 12, 2016 @09:46AM
(#11273056)
He doesn't have physical access to the other rooms on the floor, yet he can (probably) control their lights.
Re:I stayed in a hotel with Android lightswitches and it was...
by z3t4 on Monday March 14, 2016 @03:04AM
(#11281436)
Say you got inside a datacenter, or nuclear power plant, and pulled a cable from a control unit, you would probably be able to control stuff too, and probably more sensitive stuff then the room lights.
As soon as you get access to stuff you are not meant to access, it gets exponentially hard to protect from privilege escalation.
As a security exercise, assume a malicious hacker have physical access to your LAN. (shares, KVM, IPMI, MITM)