News for hackers. Stuff that matters.

A comment on Airbnb's preferred smart lock vendor accidentally bricks 500 door-locks. Parent comment

Re:Airbnb's preferred smart lock vendor accidentally bricks ... by technofiend on Monday August 14, 2017 @02:16PM (#15011028)
Well, good points I suppose. On the other hand if you have a USB port on the thing, what's to keep someone from flashing an update that backdoors the lock? Wait a few weeks, rob the place, rinse, repeat.

Now that I think about it, I hope these devices are validating the certificate of publisher and the updates are signed.

[ Parent | on HN ]
Re:Airbnb's preferred smart lock vendor accidentally bricks ... by jacquesm on Monday August 14, 2017 @02:29PM (#15011159)
> I hope these devices are validating the certificate of publisher and the updates are signed.

You're joking right? Really, the vast majority of this iot stuff is ridiculously bad in this respect. Plain text data transfer, unsigned updates from any source based on a text message and so on. It's a disaster waiting to happen.

[ Parent | on HN ]
Re:Airbnb's preferred smart lock vendor accidentally bricks ... by stupidstupid1 on Monday August 14, 2017 @03:40PM (#15012058)
A disaster that has already and continues to happen, you mean.
[ Parent | on HN ]
Re:Airbnb's preferred smart lock vendor accidentally bricks ... by jacquesm on Monday August 14, 2017 @04:21PM (#15012476)
No, I'm thinking along the lines of large vehicle manufacturer doing an over the air update of the firmware of their vehicles bricking all of them, including the ones on the road. That kind of disaster.
[ Parent | on HN ]
Re:Airbnb's preferred smart lock vendor accidentally bricks ... by raverbashing on Monday August 14, 2017 @02:47PM (#15011352)
> what's to keep someone from flashing an update that backdoors the lock?

> from which a signed payload can be loaded

All updates should be digitally signed by the lock manufacturer

[ Parent | on HN ]
Re:Airbnb's preferred smart lock vendor accidentally bricks ... by jlgaddis on Monday August 14, 2017 @06:44PM (#15013702)
From a security perspective, absolutely they should.

But then we complain because we don't "own" the hardware and can't hack around on it.

[ Parent | on HN ]