Re:IoT goes nuclear: creating a ZigBee chain reaction
by erdemozg on Thursday June 22, 2017 @08:32AM
(#14611754)
People don't bother to update even their home router's firmware. IoT ecosystem will be one of the biggest holes in cyber security and a heaven for black-hat hackers.
Re:IoT goes nuclear: creating a ZigBee chain reaction
by Freak_NL on Thursday June 22, 2017 @08:39AM
(#14611807)
Economically vendors have little to no incentive to fix this mess either, so it will haunt us for some time to come. Introducing a slew of devices that all need security updates into each household that falls for them doesn't seem all that clever.
A light bulb that can change its brightness and colour shouldn't be smart; it should be dumb as a brick and expose only those parameters that can sensibly and safely be set by a user — kind of like a normal light bulb does.
Re:IoT goes nuclear: creating a ZigBee chain reaction
by eriknstr on Thursday June 22, 2017 @08:34AM
(#14611767)
> Try buying plain TV (without YouTube and Internet)
If you leave the smart-TV without a network connection it'll be mostly like a plain TV.
> try buying non-smart phone
There are some feature phone Nokia models available, I use one such.
The thing I miss the most about having a smartphone is GPS and a map app. For everything else except mobile internet, which I can do without, that a smartphone would give me I have an iPod touch.
Re:IoT goes nuclear: creating a ZigBee chain reaction
by kbart on Thursday June 22, 2017 @09:07AM
(#14611929)
"Try buying plain TV (without YouTube and Internet), try buying non-smart phone..."
Disable data connection for both and you have "dumb" counterparts. Of course, you still pay for unnecessary features, but it's the price to pay if you value your privacy.
Re:IoT goes nuclear: creating a ZigBee chain reaction
by farzadb82 on Thursday June 22, 2017 @09:48AM
(#14612185)
If only it were that simple.
Unless you've physically removed or disconnected the wireless interface, there's still a chance that a firmware vulnerability could lead to your TV being hacked via a remote and/or side-channel attack similar to what was demonstrated in the article.
Re:IoT goes nuclear: creating a ZigBee chain reaction
by leeoniya on Thursday June 22, 2017 @08:38AM
(#14611792)
does anyone know a good Zigbee-capable smoke/co alarm listener that can be hooked up to send alert emails without relying on third-party servers? i was looking at openHAB and their Zigbee support is meh it seems :(
https://news.ycombinator.com/item?id=12893793 (309, 98 comments)
A light bulb that can change its brightness and colour shouldn't be smart; it should be dumb as a brick and expose only those parameters that can sensibly and safely be set by a user — kind of like a normal light bulb does.
I think you meant "is" here.
2. vendors mix feature changes/removals and security updates.
3, better the devil you know...
Still scary as hell.
It helps(a bit) with user friendliness but throws AES security of Zigbee out the window...
I hope IKEA removes Touchlink in future: https://www1.cs.fau.de/content/zigbee-security-research Specially since IKEA uses power on-off pattern to reset bulbs https://www.youtube.com/watch?v=mJm9YpPrGzk
"Correlation Power Analysis (CPA) attack against the CCM encryption mode used to encrypt and verify firmware updates"
Fascinating work. Working direct .PDF: https://pdfs.semanticscholar.org/b457/e4b95a70f8d1726ba70885...
If you leave the smart-TV without a network connection it'll be mostly like a plain TV.
> try buying non-smart phone
There are some feature phone Nokia models available, I use one such.
The thing I miss the most about having a smartphone is GPS and a map app. For everything else except mobile internet, which I can do without, that a smartphone would give me I have an iPod touch.
Disable data connection for both and you have "dumb" counterparts. Of course, you still pay for unnecessary features, but it's the price to pay if you value your privacy.
Unless you've physically removed or disconnected the wireless interface, there's still a chance that a firmware vulnerability could lead to your TV being hacked via a remote and/or side-channel attack similar to what was demonstrated in the article.
Doest thy hardware has't the beshrew? Software demonic exoc'rzisms and beshrew removal! The doct'r is in.