Hacker!!

Given that this is in the UK, I wouldn't be surprised.

People shouldn't unplug equipment in a hospital without express permission, sure - they shouldn't do it in your home either.

If your security model relies on this, though, you have failed. Period.

It is maybe a little fuzzier in a hotel (should I be able to stream content to the TV from my device instead of paying you extra for a movie?) but similar applies.

Yes, if it's accessible, and nothing implies that you shouldn't - why not?

If a cable is not meant to be unplugged - there should either be a warning sign/message, a protection measure (even a nominal one, serving as a mere warning), or you shouldn't normally get access to it in a first place.

Obviously, there is common sense, too - you don't plug some working medical equipment, even though there may be no warnings - it's implied that it's commonly understood that disconnection would interfere with device's operation and endanger the patient. Or you don't suddenly turn off someone's PC at office just because the power outlet isn't covered by the table.

The door example is also misleading and plain wrong analogy. We're not talking about trespassing on others' property. When you rent a room, it's a common sense that you shouldn't steal the TV from it, but nothing tells you if some random Ethernet cable is some private network or just a WiFi replacement. It's the same as any other electrical socket (well, except it's a plug, not socket) - nothing implies that you can't use it, as long as you don't cause any damage to the property. If a rented room has a floor fan plugged in, I doubt you shouldn't be allowed to plug it out or even satisfy your curiosity and measure how much power it consumes. As long as you don't damage anything, of course.

There are too many people out there who want to plug in some odd lawmaking solutions (always, restrictions) that don't actually solve anything.

But what if you leave your door unlocked, or it isn't locked in a secure enough way?

Who is the guilty party?

Really, this is just social/legal understanding. It's unacceptable to open someone's door -- even if unlocked -- but acceptable (?) to wire yourself into someone's network if unguarded.

Find a way to demonstrate the flaws in various products, aim for non-consumer markets. Businesses that have an actual motivation to have secure devices like the hotel in the article would be more inclined to spend the extra money, especially if it at least eliminated a trivially hackable configuration like, again, in the article.

The problem is that the entire industry would get a bad reputation, not just the competition. You might be shooting yourself in the foot.

I think the parent post is talking about a design for security rather than fixing security bugs. A device or system designed without security in mind likely isn't going to get security as a priority at any point in its lifetime, or isn't going to be worked on by security minded folk. Any updates are likely going to be superficial, poorly implemented, or simply not a priority for the developers.

In regards to IoT devices, as the article is lamenting, many are designed with no security in mind and instead seem to be thrown together as quick as possible to achieve a function, without considering the implications that a security breach may have with said device. (e.g., IoT baby monitors, thermostats, home locking systems)

Because in practice, for the moment, there is a difference between "insecure" and "insecure and being exploited in the wild".

There's a difference in security issues due to programming bug vs insecure design.

If an application was created without security in mind in worst case it might require complete rewrite. In other cases it might be a whack-a-mole game.

For example compare ssh vs application that simply opens port and starts bash as root. You can use both to control your server, but if you want to add security it would be a lot of work (you could incrementally add authentication, encryption, maybe restrict user what s/he can do but there will be million and one ways to escape).

After fixing one issue after another without seeing the end you'll realize it would be less work to just rewrite it from scratch with security in mind.

Security is not a feature, it is a process.

You can do what Apple does and require the firmware to be signed

So we're back to a couple of comments above: suggesting that people actually upgrade firmware.

An opt-in switch is merely convenience for the incredibly thin % that bothers with this kind of thing. And that % will actually be informed enough to not opt in.

Come to think of it, that % will likely be informed enough not to buy this kind of device in the first place.

Opt-in just means nobody gets updates again. I realise this is more a techy audience but think of these things from the mainstream perspective. Especially when the tabloids and social network copypastes get the word out that hackers can turn your oven on or something if you enable updates

I think if people actually wanted the products, they'd be more likely to offer constructive solutions.

having a $3500 fridge go dumb via updates made people very unhappy

http://motherboard.vice.com/read/smart-fridge-only-capable-o...

Daquiri liquified ftw!!

First, calm down. Defrosting peas is not in absolute or relative terms a big deal.

Nothing in remote/automatic updates requires being brickable. Don't buy such a crappy fridge.

Or, call a serviceman to fixe it, just like you would today with dumb fridge.

Heck, a third-party could probably update their firmware for them!

So we're now talking about insecure devices that can recieve firmware updates remotely?

If it's a true IoT, people might not really have a choice ;)

I dislike that we live in a world where this is acceptable to people.

Nah companies want obediant placid fungible workers not free thinkering radicals. Even the hipster ones that let you work remotely and choose your own projects and stuff.

That's a puzzle question worthy of a board of ethics interview.

There's surely a Wildean quote in there somewhere.. "The only thing worse than your data being sent to people you don't know..."

Depends -- WILL I know them afterwards?

#2 I believe. Better the NSA than your auntie.

I argue to people that I'd rather have my photos on Googles servers than on the friendly local Dropbox clone.

Why? Because I know Google has systems in place to detect sysadmins browsing in data unrelated to their job and I know they have fired people over it even if was tought to have been done with good intentions.

Edit: as for tracking I wish they would up their game and stop providing ads for <insert eastern country here>-dating.<tld-of-the-day>

I wish they would take into consideration that I am happily married with more than 3kids, belongs to a subset of the population that has way less than 10% divorce rate and I might even be in the market for a new car at some point.

In fact I would even tell them if they asked.

The people you do know will purchase the information from the people you don't.

If you find yourself saying something uncomfortable under pressure, this is probably not the right place for you.

Well, coming up with that while being under pressure is still to be commended for.

I would have hired you

Smart things? Sure.

Smart, connected things? Yes, maybe.

Smart things connecting over the Internet to a corporate cloud? Hell no.

Haha.

At the interview for my current job I was asked how I'd secure a remote service. My first response was along the lines of "Ask someone who actually knows about security, because I know just enough that I'd probably mess it up".

I was thinking more of a throwaway prototype, but the answers on other threads convinced me it wasn't good advice, and I don't know what stage the OP's startup is.

In my experience, "throwaway" prototypes almost never are.

That's a totally legitimate fear.

These days, this is the kind of thing I negotiate up front. When they ask me how long something will take, I explain that they can have a prototype quickly, but only if they promise to throw it away as soon as the experiment is done. I explain that they can have me build a movie set or a real house, but that there's nothing in between. [1] And then I leave the choice up to them, explaining that it's really about their business judgement.

Generally people keep their promises on this, although sometimes it takes a little reminding. When they do, the business benefits are substantial. A good product person really benefits from doing quick, cheap experiments. And they also benefit from having a solid platform of high-reliability code for production use. But they can only get the benefits of both if they're careful not to mix the two.

[1] There is actually something between, but they don't want it: http://agilefocus.com/2009/06/22/the-3-kinds-of-code/

I'm old and have been in this industry a long time, and I'm genuinely surprised on those oh-so-rare occasions when what you describe doesn't happen.

Prototypes-become-products is a trope much like _The Mythical Man Month_. We all nod knowingly when it is mentioned, we all know how it will turn out, and then we (well, management dictates that we...) turn right around and do the opposite.

Absolutely true! I have to tell people that many attacks just try every door to see if its unlocked. They are not movie plot-style targeted attacks. And such an attack can and do lead to data breaches!

This is why I absolutely believe and publicly talk about security being a matter of developer ethics. I have used my walk away power to get a company to do the security they needed in a similar, but not quite the same type of situation.

Here is the professional ethics piece of a talk I gave last year to a developer meetup: https://www.youtube.com/watch?v=dj196NhPyWs&t=43m36s

In addition to this, my problem is usually, "I could solve that problem with $5 in discrete electronic components." :P

Absolutely - and for a light switch it's appropriate. As an example of a thing that needs internet to function, consider a heater controller that has a high power and low power mode depending on momentary cost of electricity - it fetches price data across the network, and it's important to log things like temperature at various points of the device for diagnostics. Now, it's very tempting to send the diagnostic data across the network, but this leaks usage information. It's also tempting to allow things like remote configuration, firmware updates and reading device memory for debug, but that can leak network access credentials or make the device a beachhead for access to the internal network. This is why any feature like that is to be avoided and, if present, needs to be activated from the device itself, not remotely. If you NEED remote control, see if you can limit its scope of functionality to the bare minimum, and consider who needs access to it - in the case of the heater controller, the provider of the pricing data doesn't need to know or control the state of the device, so there's no need to allow that on that connection. Where possible, make the device a CLIENT rather than a SERVER - have the device itself initiate connections, to an address that is entered by local interaction, rather than accept connections from anywhere. If you MUST break those rules and accept connections from anywhere, that's when you really need to spend a fuckton of effort securing every aspect of your device, client applications, and protocol.

Good point, seems like places get sold products that are smoke and mirrors. If they knew what was going on in the background they would be shocked. Best plan is to build up a big customer base with a smoke and mirror product and then sell out and hope you don't get sued.

I thought you were supposed to implement it in a basic way then have the investor money pay for other people to think through your project

Therac's often used as the "canonical" example, but there are more recent issues that stem from a lack of a physical interlock:

  - VW's dieselgate (although that was intentional)
  - Virgin Galactic VSS Enterprise crash
    (yes, designed for a skilled operator, but still: no interlock on the brake)
  - Pyranha Moulding's industrial oven [1]
  - Hotpoint tumble-dryers catching fire [2]

Even without network connectivity, household products still get recalled for issues such as fire risk, because they lack things like thermal cutoffs, or the cutoff is in some way inadequate.

Perhaps 35 years ago computer control was still very new, but right now, IoT is very new, so there's a whole new world of mistakes to learn from, and the evidence is very clear: serious mistakes are being made.

  [1] http://www.cps.gov.uk/news/latest_news/pyranha_mouldings_ltd/
  [2] http://www.bbc.co.uk/news/business-35744313

Yep, you have to lose all shame to be successful. See also the subthread about MIFARE cards in the "towel with RFID" submission.

mandatory: https://www.youtube.com/watch?v=9IG3zqvUqJY

You have to put things in perspective. It just have to be secure enough. It's for example hard to build anything, if it has to endure a meteor strike.

Android/iOS is an interesting idea for a business. They already have secure app distribution. A private channel in the Google play store or via app store adhoc. Communication between the devices via a server should be possible at least using HTTPS but also private/public key encryption. Doesn't have to be an actual server just one of the devices in server mode.

What could possibly go wrong?

I wish you would.

The difference between you and the dunces building things like this hotel light system is that you know that there's a problem and will work to fix it. As the market matures, security will become more important. But the only companies with the chance to fix it will be the ones with substantial market share. And the people who will fix it best will be the ones, like you, thinking about security from the beginning. But that can only happen if people like you get in early and lay down the infrastructure in a way where security will at least be possible.

I am coming to the conclusion that these devices should be treated like every other URL on the web. It should have TLs with a proper cert, a global domain name, wifi, and access controlled by something well known like Openid/oauth. With native apps and CORS firewall traversal is solvable without special protocols and adaptors.

how we are going to fix this

Lawsuits for damages, as usual.

Structural engineering solved these kinds of problems with building codes.

I'm guessing a lot of buildings and bridges had to collapse for codes to take hold. I hate to think about how many power grid shutdowns and crashing cars we will have to go through. Clearly the routine theft of personal data has not made enough of an impact to improve security.

Thanks. Exactly as bad as I expected.

Wait, doesn't everybody think about the voyeuristic implications of any new technology?

"I've got RED CODE!!!" - Queue hacking montage.

It made Tron look technically accurate.

Don't worry, this hotel also has a modbus-controlled window washer's crane on the same network.

I would say most hotels have a first floor with rooms. I was at one recently where the "balcony" was connected by a small path to the pool, so it was purposefully easy to access.

That would be hard to swallow

You or I, probably not. But just this week Erin Andrews won a $55 million legal case where somebody had intentionally booked a room next-door to her hotel room, then modified the peephole to her room, in order to film her naked. Certainly, there's people intent on prying into the private lives of others.

Pretty big deal if you are not protecting your customer's privacy http://abcnews.go.com/US/erin-andrews-jury-set-deliberate-75...

Because of this[1] Chrome extension, I wasn't sure whether you were talking about Donald Trump

[1]: http://somerichasshole.com/

Well, if lights (and the article mentioned TV) repeatedly goes on at 3 a.m. this ca give quite bad reputation to the hotel. A few bad ratings hat reservation sites can have a notable impact on the business.

Sure. I work in a large university building and can power up/down various systems from my desk for the same reason. But it doesn't require a full tablet computer in each room. These are simple network addressable devices on their own VLAN that allow me to (for example) create an interface that sends a string of commands like a remote control, provided I give proper auth. If you're a regular person in any of the rooms in the building, you can't easily gain access to the VLAN, much less connect to any of the networked controllers in the rooms.

As a result, I can shut things down from my office or set up schedules to do the same. I can monitor usage and save resources (lamp hours on projectors and lighting, etc)

The idea of using a full-on tablet computer is just silly and sounds more like something I'd do while tinkering at home and was looking for a use for some old phone or tablet sitting in a drawer. It's not something I'd put in any enterprise or commercial space.

Ask for two card keys and leave one in the room.

At least at the one I stayed at once, you didn't need your room card in the slot, just a card. YMMV.

Though I wouldn't be surprised that the cleaning staff would "clean" it up if you weren't there. Might want to put out the Do-Not-Disturb sign too.

I usually have someone's business card on me, so I'll stick that in the card slot so that I can head to dinner while stuff recharges or the room cools down (for places where the A/C is tied to the same switch). I have yet to see one that's anything more than a simple mechanical switch.

The one I ran into that did that had an outlet that would work when out of the room... in the bathroom, for a rechargeable shaver, presumably. So my laptop got plugged in there...

That's nice, if you're into that. Personally, I'd pay a bit extra not to have this.

Maybe the architects/builder forget to lay the cable for the switches and wireless lights can then be a cheaper option.

This might be more amusing:

  while true
    level = 0
      while level <= 100
        set all lights to level%
        level = level + 1
        sleep 5
      sleep 120
    set all lights to 0%
    sleep 1800

The idea is to slowly raise all the lights from 0% to 100%, hoping that because it is gradual it will not wake the person. Then you turn them all suddenly off.

If that succeeds in waking the person, they will wake up in darkness, wondering what the heck woke them up.

More fun with lights: someone at Caltech once modified the wiring of a student's room and the adjacent bathroom so that the light switches in both rooms controlled the lights in both rooms. They they waited in the courtyard that the student's room and the bathroom both overlooked to watch the hilarity that they knew would ensue.

What happened was that the occupant of the room eventually went to bed, turning off his light. Then later someone went to use the bathroom, turning on the bathroom light (and so also the student's light). That woke the student, who got up, turned off the light, and headed back to bed. The guy in the bathroom shouts something, and a few moments later gets his pants under control and goes and turns the light back on and heads back to the stall to resume his business. Meanwhile, bed boy is shouting something and getting up to turn his light back off. What I'm told then happened is that the lights flipped on and off a few more times, with the time between flips getting smaller and smaller, until both guys are just standing at their light switch flipping it repeatedly, before they both go out into the hall to try to figure out what is going on, find each other, and figure it out.

CFL ballasts can overheat if you do that.

The downvotes were worth it.

You're right that in this particular case it's not a problem. Nevertheless any type of device that can be connected to a network, will be connected to the internet. Someone somewhere will make it happen.

I doubt the hotel came up with this solution completely by themselves. Whoever installed it will probably install it elsewhere and it's only a matter of time until it goes badly.

I was thinking the same thing. A tablet with a camera on an unsecure network in the bathroom? Hell.

The silver lining of going with the lowest bidder, the tablets are unlikely to have cameras.

Perhaps the hotel was getting ahead of UK gov requirements for network backdoors.

Maybe we'll end up with a standard certification equivalent to UL or the green padlock next to the URL. Probably about 5 years in the future.

Great, now make a drone or self-driving robot to randomly run around the country messing with peoples' insecure lights. It'll be one huge party.

Just because its CAN doesn't mean its actually air gapped. If there is a Linux box on one end for SCADA use or similar, then the path is IP -> Linux spl01t -> SocketCAN

Given a completely static authentication realm like the rooms of a hotel, Modbus over TCP over IPSec would work just fine, and be transparent to the application. That sort of sounds like a good reason to be using Linux (Android) controllers in the first place; maybe they just forgot to enable it (or let go the installing contractors before their job was done, as soon as everything seemed to be "working.")

Same here - I used modbus only a few years ago, as it worked well for reading analog signals from hydroelectric turbine monitors, into a Linux box that converted them to digital for reporting. I cannot imagine actually using it on a modern network.

Modbus is an application layer protocol. Different things. It's more akin to HTTP than IP.

read the keys right out of EEPROM

Usually keys are stored in a part that is not accessible directly, think of SIM and bank cards. Actually lots of LoRaWan use SIM cards.

Don't even get me started on medical devices. Hospitals are facing a disaster they've never even conceptualized.

Moteino (arduino-based wireless dev platform) supports LoRa if anyone is interested in digging into some current sub-$10 ISM transceivers and their capabilities. http://lowpowerlab.com/moteino/#lora it's also a great project to get started with arduino if you've never worked with it before. Really solid documentation.

Modbus is still very common in ECUs. I work for a telematics company and Modbus is probably our 2nd biggest bus protocol next to CAN(J1939).

Or you could just kick the door in - and turn the lights on. Then write "HACKED" on the wall with a spray painter. (sarcasm)

Everything you said, and also that the old analog devices are future proof.

For a trendy metropolitan hotel, with a design refresh cycle of 10 years at the most, the future might not matter. But people are wanting to put these devices in homes with a refresh cycle that should be more like 30 to 50 years. Big difference.

http://archive.is/vSFf9

KNX, being one of the most sophisticated and proven building intelligent protocol, widely adopted in Europe.

If anyone interested, cross scan its default IP interface port 3671 and, say German telecom ISP IP range (and there is CSV available on www), with efficient penetration test tool like masscan, challenge it with 0x0205, look for 0x0206 on response.

Thousands of home and factories and commercial buildings welcome you with real time datagrams on all their switches/appliances/presences/sensors/cams/... Bonus point: writable!

I liked how the article gave the commands used to set up the correct networking config with the bridge.

Can anyone recommend a good reference / tutorial for learning basic network-fu in unix ?

Modbus has been installed in hotels for years and years. They are probably using it because many hotels already have infrastructure in place for it.

Except that nowadays they'll be locked up for 5 years.

I like that idea! A 21st century version of: https://41.media.tumblr.com/b56a0e413ba7869ffc4a9ec99777f132...

Not sure why this is getting downvoted. This is a big part of what happened with internet security over the years.

Back at the dawn of time, less than a billion seconds from epoch, it was considered rude to exploit obvious security holes. People would actually track down casual hackers and get them in trouble. But once script kiddies came on the scene, it became a lost cause. Once it could be any 14-year-old idiot on the planet scanning your ports and exploiting your old, unpatched software, it became clear that tacit agreements and social pressure weren't enough. The burden of security began to shift to people who created the software.

I can't wait until Random Q. Hacker can flood the lobby with blood from the elevators.

And if you wonder why the blood reservoir has to be connected to both the elevator shafts and to the Internet, I ask you this: who would want a dumb blood reservoir in their hotel? I mean, obviously you have to have one, but wouldn't you rather be able to query tank levels from your phone and automatically order refills online? Nobody wants to be the unlucky employee that has to go up there with a dipstick at midnight during a thunderstorm, right?

Stephen King magic I can handle, it's a particular Stephen Koontz tale of a mad computer nerd turning his town into cyborgs that concerns me. Great read! I think... was almost 30 years ago now....

https://en.wikipedia.org/wiki/Midnight_(Koontz_novel)

yes i was also misled by the title. You read again, android in the text as well as in the title as if something to do with the android OS is responsible especially taking into account that the guy is a security developer at CoreOS.

* "I stayed in a hotel with Android lightswitches and it was as bad as you'd think "

Another title would be:

* "CoreOS security developer stays in a hotel, and hacks the light switches to.."

I was thinking the same thing :)

For those unfamiliar: http://blinkenlights.net/

Having stayed at a similar (same) hotel don't even get me started on the guest experience. It took longer to familiarise myself with all the controls in the room than a normal stay in the hotel. Also really appreciated the slight glow all the tablets gave off at night...well they did until they got covered with cushions and gaffer tape!

Jarrod

I will defer to you re: Modbus/TCP as it is outside my area of expertise. Even if these systems are "common," I would still claim that they are not the "norm" for the simple reason that I have been in buildings that were clearly "smart" buildings and ones that were clearly not, and the latter outnumber the former. However, even if it were the norm for commercial buildings, I was thinking far more generally and that may be the source of our disagreement. Automatic doors, for example, are the norm for major retail stores (as well as airports, et cetera), but they just don't exist in private homes. It would be expensive and serve no purpose, and that is how I feel about most "Internet of Things" devices [EDIT: and most "home automation" devices].

Yes, but now it's "on the internet". Therefore it can be called Internet of Things.

IoT is an amazing, awesome, innovative and entirely new concept. Just like "The Cloud" was.

/s

Thank you. Genuinely interesting, and in my opinion, one of the few examples of the technology done right.

I would point out that the three different switches on opposites sides of the kitchen sounds more like an issue of poor switch placement (admittedly, a common problem) than anything crying out for automation, but the ability to control sets of lights with one button is intriguing.

I think the take-away is this:

Is any of this game-changing? Not really. It's interesting to me, it's not overly expensive (especially as I have built this up over time), and it's a nice albeit minor quality-of-life thing.

Which I contrast with: "Let's hook my toaster up to the internet because: Internet of Things!" which seems to be the prevailing attitude.

I believe a key to home automation is the automation part. If I have to control it manually, it's by definition not automated.

Yup, this.

I built an automated heating system. It does all the right things at the right times. I never touch it; it has some graphs if I want to see what it's doing.

The shoddy consumer systems all have manual control and an app, because you just spent all that money, you want the warm fuzzy feeling of having an app to fiddle with.

Marketing is why everything has to be networked.

I wouldn't pay a dime for most of those features, even if it worked perfectly. Where I can see the use is doing things remotely, as in when you're far away: locking/unlocking the doors, making sure the lights and appliances are off when you're traveling, turning on/off the heat remotely etc. IF you could do those things securely.

Too lazy to walk up to the light switch when I'm at home? Just no.

Hotels are under substantial competitive pressure to seem fancy. Fancy hotels can charge a lot more. Looking good is often more important than ease of use, as is demonstrated by every hotel alarm clock I've ever tried to set.

It's also partly our fault. Computer-y stuff has had poor usability for years. A standard tech response to bad user experience has been to tell people that they're doing it wrong, that they just need to learn a particular trick and it will all be great. So people often assume that when something is hard to use, it's probably their fault. Which means that a buyer of stuff like this can have a bad experience and wave it away thinking that the tech is just fine. After all, why would somebody sell a computer-controlled lighting system that is in practice worse in every way than regular switches?

"Is this solely to look "fancy"? If so, then at least get the tech right otherwise you look incompetent."

How many of their guests have thought it looked fancy? Probably a lot. How many of their guests have done something similar to what this guy did? Probably not so much.

Isn't this just a modern day equivalent of Phone Phreaking ?

There used to be party lines in villages where the whole village could listen in to anyone's phone call.

Never mind the operator could also have a sticky beak.

Now if they can change your sound system to play Kanye West... that truly is a problem worth worrying about.

Yeah, wow. Twelve years ago, I worked for a firm that built DVOD (digital video on demand) systems for hotels across Australia and UAE.

Even then, and with the limited 'damage' that could be done, each and every single room got its own VLAN. That was certainly a little ugly to manage at times, especially in a 1200 room hotel, but yes.

VLANs.

Authentication.

Something.

Anything.

I'm generally unenthusiastic about naming and shaming hotels that I'm still staying in.

That's what I've been doing.

For the local hardware, I use Arduino Nano clones, nRF24L01+ mesh networking chip, whatever sensors/actuators, and the MySensors library. Encryption and packet signing are both turned on.

On the gateway, it is just a serial console opened up to a Arduino Nano and nRF24L01+. I use Node-Red on the machine the serial gateway is plugged into. I also use the MQTT broker Mosquitto as my backing store for IoT data, from any of my machines. I design my architecture around that.

To connect between physical areas (from house to hackerspace), I use Tor Hidden Services, giving each endpoint a .onion address. With that, all my computers on the .Onion network can talk with each other as if they are on medium-high latency hub. And it also solves the problem of "staticIP/port forwarding/firewall rule change/dynDNS" crap. I drop Tor, set up a hidden service, route 22 to Tor, and off it goes. All I need do is keep track of that onion address.

And that provides me devices I have complete control over, utilizing a cloud of computers I own. I'm looking in how I can blend in IPFS as well for logging capabilities.

Well, one major problem that I see is that, we aren't required to learn about any of this stuff before we buy it and most of the people who's job it is to set this up would gladly do it for less than someone who knows what they're doing even though they know nothing about it. The entire world is set up incorrectly for something like IoT. We try to get as cheap as we possibly can with everything and we try to skimp on any labor cost but set everything up fancy as hell. That's always going to leave you with security holes because security doesn't make money. Not unless someone starts getting punished for the bullshit security they are putting into these things.

There's nothing in the article about Android, it's only in the title.

Look, the sales guy gave the president a _really_ nice lunch.

eh, It doesn't scare me because they have the name, credit card, and exclusive control over the lock on the attacker's door. You'd have to commit so many counts of fraud and hacking in order to attempt getting away with it, that the reward just doesn't seem there to me.

I work in a flagship building in France, known for its environmental compliance and automation features. It's quite nice, but there's a web app to toggle the lights, the blinds and whatnot. And guess what, the logins to other floors are trivial to guess.

Yes, there is. Touchscreens lack tactile feedback, and for stuff that one must manipulate on the dark (like a light switch), that's a very important flaw.

In a competition it's possible to wake up your competitor. I mean if you are going to play a tennis or football match the next day, you can bother your competitor to have an advantage.

but it's got a touchscreen

Of course they decided not to have it. It's not like they aren't capable of implementing simple features. I just think it's a dumb decision.

For many Twitter accounts, the top tweets are a lot more interesting than the latest tweets, especially if you've just discovered the account for the first time.

What do you think the basis of that decision is?

It's like on the pilot of Futurama. As Fry leaves the cryogenics he woke up in, the door automatically whooshes open. He stands under it and looks up, only to have it slam down into his face.

On the DVD commentary, one of the writers explained that the future will be like Star Trek, but nothing will work. It's turning out to be true.

I work in the Hotel industry making Apps for reservations and in room entertainment and engagement. Some of your statements make sense but, form the hotels perspective, some of the reasoning for implementing this stuff has little to nothing to do with making the experience better for the guest. We use the data we get from things like the lights, temperature, and other information to find ways to save money and find how to better set up properties for profit. Its a numbers game. We hope that we can use the same tech to drive user engagement and keep them within the apps so they become lifetime guests and book with us for subsequent stays. It is a marketing and management effort. All about the ability to save money while driving engagement.

My coworker asks whether you can control the channels. Can you set all of your neighbours' TVs to pay-per-view while they're out?

Hahahahahahah! "Asking for a friend."

But really, folks are talking about the nuisance of waking people up in the middle of the night and that's true. However, controlling channels could be a more significant nuisance.

If you found that you could do the same thing on a classic installation people will be like. So what? and an electrician wouldn't even be excited to try it.

But since hacking is cool, we like this stuff.

Weird thing also is that using WiFi years ago was basically giving your data, when SSL websites where so rare. And we didn't even cared for it...

https://en.m.wikipedia.org/wiki/Hearsay

what was clearly a problem before that had not been decided as being in breach

These are the signs that I always have a good chuckle with, thinking, "that sign is there because someone did that."

games that would get them smacked in any reasonable court

You're talking about a Chinese court, right? The guy you're planning to sue lives in China and is a long-time business "associate" of the judge who will decide your case.

Why would you take an untested schematic to a manufacturer and ask them to build a product based off of it? If you are asking the manufacturer to both devise the schematic and build the resulting product, then it behooves you to ask for a prototype built from their schematic in order to evaluate the production's performance.

Hey, you said you just wanted a car, you didn't say anything about an engine.

This is what makes people with so many years of experience so valuable. NetApp had a woman who would source parts from around the world and she had done it for long enough that she knew many (if not all) of the tricks in the book. Often her conversations would start with a new supplier and her requests with explicit constraints would tell them that she knew what she was talking about and that they had better play it straight. So they started out assuming none of the tricks they might use with an inexperienced buyer would work. That experience had tremendous value to the company.

Closer aligned incentives, yes. If you give someone money as gradually as possible they will need to make sure they can't pull a fast one and run off, they will actually need to perform.

This is a great point, and there's a close parallel with the way that people make similar comments about Indian developers and completely ignore the many highly-qualified developers who just won't work at lowest-payer wages.

Fair enough, however with this audience I would expect they recognize that the manufacturing contracts of China, which by their number rather than their nationality, are expressly tailored this way. It is by virtue of the Chinese success as capturing the manufacturing contracts from all other nations in the world that has helped them develop expertise and skill.

I was thinking the point would be that one reason for the low price is that the manufacturer wants your design so they can use it to build a competing product at their other factory down the road--a joint venture with the local Party boss. You'll never know, but even if you figure it out, what do you imagine you can do about it? Maybe get a court to block the product in the US (causing them a week's delay while they change labels and distributors), but if you're looking for cheap Chinese manufacturing, you won't usually have the resources for any worldwide legal battle against these guys.

And if the design you are paying them to take from you is for some IoT product, the local Party boss can even make bonus points with his superiors by offering them a chance to backdoor it.

I'll bet the cheap tablets in that hotel for tech conference attendees, the tablets with the ethernet and WiFi listening circuitry, could collect a lot of great technology for their makers, and I'll bet they were made in China.

The full history of commerce. :p I'd suggest looking at the history of food and drug regulation and testing, or weights and measures regulation if you want more. The early years of both UK and US food and pharmaceutical regulation is terrifying!

TL;DR Immature locations cut more corners. More regulation, experience and reputation helps. Consumers are naive. Manufacturers want you to buy the same things many times over your life.

In all markets, There's always going to be someone willing to cut corners to secure a place in a market, or make a fast buck in a mature market. Or maybe it's a new market that can't yet have matured. That's only part of the problem.

As markets mature regulation increases and companies tend to trade more on reputation (not always deserved of course. eg Beats headphones). Now there's an opportunity to trade on the good reputation of wherever (Proudly Made in America! / Britain! / Japan!), whilst selling you cheap crap. That's the other half of the problem. The meaningless label to tell the consumer it's made wherever they currrently believe is good.

In the early 80s most things Japanese were crap. Hifi sounded awful, but had lots of LEDs. Bolts, tools and vehicles were made of soft cheese. Their stainless steel rusted (I kid you not)! Honda made cam chains of special stretchy metal and probably accidentally invented cheese strings. Now Denon make very nice hifi, Teng make very nice tools and their cars are pretty reliable.

Why pay £50 for a Snap On or Britool[1] spanner when there's an almost identically packaged one, made in the same place, for £3 or £40? Only one will last longer than you in daily use. One risks breaking on first use.

So, it would be more accurate to say "isn't there a reason cheap tools break", "cheap materials break", "consumers naively expect $100 quality for $3.99" or "dishonest people are dishonest" than blame a specific locality.

The ONLY thing that has changed is all manufacturers adding built in obsolescence whenever possible. Now even the premium item is made to last "just long enough" (to get away with), but that doesn't make any one location especially good or bad at making stuff.

The only thing geography introduces is the further away it's made, the harder it is to audit your supply chain. Racism and nationalism has no relevance however.

[1] They're no longer British, or often made in Sheffield, they're just another meaningless brand of Stanley trading on 100 years of reputation. You're actually better served buying Teng these days.

What do you mean, Doc? All the best stuff is made in Japan.

I read the OP as making exactly your point. They were saying that the people they describe make the error you discuss, and get bad results on account of it.

I think you misread cheap. The "mistake" is assuming the low cost bids will deliver the same high quality you see in other Chinese exports,so not doing proper research / QA.

This has been an interesting conversation. I found it particularly interesting that my communication came across as disrespectful to the Chinese.

Few people that I've met have any real world experience with contract manufacturing. Of the ones I do, they have mostly dealt with Chinese manufacturers, although I do know one person who worked with a Japanese contract manufacturer and one with a Vietnamese factory. Everyone who has ever asked me about this I point to Bunnie's "Made in China" blog entries [1]. Which convey the challenges and rewards of taking manufacturing to China much more clearly than I ever could.

That said, people who have had experiences with contract manufacturing in China have all had a very similar experience, that experience was that the contract manufacturers have an exquisite expertise in squeezing costs out of manufacturing through creative techniques, not specifically disallowed by the contract. Bunnie writes about this at length in his blog.

The thing here is the law of large numbers. There are so many contract manufacturers, and their business is so competitive, the ones who develop this expertise survive and the ones who don't, they don't survive because nobody accepts their bids. It is important to understand that they are this way because they are good at what they do, not for any negative reason.

It is this exact asymmetry of information which I expect befell the hotel in its attempt to have "cool programmed light switches and TVs." This mechanism, which many people who have used contract manufacturers have experienced, is that an inadequate specifications on the final product can give the manufacturer room to economize on their costs, which increases their profit, and also increases the chance that the bidder will be around for the next bid.

And it is the large number of Chinese contract manufacturers, the ease with which they can be located and contacted via Alibaba or other web sites, that means so many people have had a chance to experience this effect first hand with them. Using Chinese manufacturers as an example of the challenge in my post was my way to communicate what I was talking about in a way that folks who might look this up could find additional resources discussing this challenge (and they would probably find Bunnie's blog too).

The leap here, was to take what I wrote and assume that I said, or believed that because something was made in China, is was cheap.

That was not what I said, and certainly not what I meant. But a mix of people have both read it both ways. So it certainly could have been written more clearly.

I really do recommend Bunnie's blog. Everyone should understand the challenges of working with contract manufacturers, regardless of their nationality. Not tightly specifying a contract (and worse not knowing how to tightly specify a contract) will create situations like the one with the Android controlled light switches.

[1] http://www.bunniestudios.com/blog/?cat=7

There was also a flip back in the 90s where "Made In Japan" denoted a better product where in the past the slogan was thought of as cheap.

Well that's just it, security is talked about but the buyer (the hotel in this case) is often not in a position to actually evaluate the vendor's claims.

But at least the buyer becomes aware that security might be an issues, and thus take it into account when making the final decision. (Even if its just "take the lowest bidder that talks about security convincingly"). OTOH, this doesn't work for buyers that don't actually care.

You can put down "device should not be hackable" but without their own competent IT arm the hotel can't possibly verify the product delivers on the security promise.

Sure, but if the vendor puts this in the contract and the hotel does get hacked, isn't the vendor then suddenly liable?

We still use locks on doors, even though they provide security theatre only

This isn't really security theater — the term refers to something which gives the illusion of security and doesn't deliver, not the failure to achieve absolute security. In general, door locks are about as secure as they're portrayed: they don't prevent someone from breaking in but they considerably increase the time, skill/tool requirements, and risk of detection. The other key part is that the threat model is obvious: people understand that if e.g. you put a Grade 1 lock on the door but leave the window open, it's not a failure of the lock.

Criminal nuisance laws are probably enough to deter anyone actually turning on all lights at 3am.

How are you going to find out who to charge?

Say you got inside a datacenter, or nuclear power plant, and pulled a cable from a control unit, you would probably be able to control stuff too, and probably more sensitive stuff then the room lights. As soon as you get access to stuff you are not meant to access, it gets exponentially hard to protect from privilege escalation.

As a security exercise, assume a malicious hacker have physical access to your LAN. (shares, KVM, IPMI, MITM)

Re "nobody would do that": here's a quote from Destiny's Shield, one of the books in the Belisarius series:

"I was just thinking of the provisions of a typical Alexandrian rental agreement. For a house or an apartment. You know, the one about—"

Zeno smiled, nodding. "Yes, I know." His voice took on a sing-song cadence: " 'At the end of the term, the tenant shall return the house to the lessor free of dung.' "

He laughed himself, now. "It was so embarrassing for me, the first time I rented an apartment in Constantinople. I was puzzled by the absence of that provision in the contract. When I inquired, the landlord looked at me as if I were crazy. Or a barbarian."

I don't understand why you use China as an example. The example you raised happens everywhere when your contract is exploitable. Pointing you finger to China does not help your case, only shows your prejudice

Don't suppose those tablets had any kind of microphone or image sensor/webcam built into them? If they're using cheap generic android tablets, they probably do.

Should be fairly simple to setup remote blackmail-material-collection. :(

Correction, he stayed in a SHITTY hotel. Not much else to report here.

Write a script to rhythmically open and close the curtains, as well as turn the lights on and off for the whole floor. Then call OK Go and tell them to bring a drone because you got their next clip idea.

What has this got to do with Android?

Not much. But Android is pluggable, Linux based, and easy to put an OTG Ethernet adapter into to divert supposedly "secure" wifi traffic.

I really think "Android" and the "as bad as you think" meme is just used here to grab attention to something which is definitely worthy of it:

About IoT and what terrible things people are doing with it.

How long did it take for the web to mature? Do we have to wait that long for IoT to settle as well?

I wonder if, with MITM devices set up on a few consecutive floors, you could make massive pixelart animations on the outside of the building by turning lights on and off...

Are physical light switches even a problem to be solved?

Seriously, I fail to see the ROI of such endeavor.

I could see a hotel system that turns off the lights at some predetermined time if the room is not rented, in case they were accidentally left on. That might save them some electricity, but it's hard to see it saving enough to pay for the system.

What's up with all the hotel hacking today? First towels [1], now light switches??

[1] https://news.ycombinator.com/item?id=11265849

I wonder if a more fruitful attack target than the lights in other rooms might be the android switches themselves. Even cheap commodity android tablets contain cameras or at least microphones. There's almost certainly a remote update interface on them of some sort.

Technology for technology's sake is a real shitshow and a big problem.

I was in my friend's Honda Pilot the other day, which has the new trendy big screen interface to replace the radio. I'm sure it is insecure junk, but more importantly it is a nightmare for humans.

I have a BS in CS, have developed some enterprise apps, run major complex tech programs successfully, and could program my dad's VCR in the early 80s. And... It took me nearly 10 minutes to figure out how to turn off the radio on the weird touchscreen.

To turn the radio on requires 4 clicks, and the key button is on the corner of the screen, where it is least responsive to touch. I would probably be safer driving with my knees and texting with two hands than controlling that radios.

Last week's episode, Ask This Old House, had something similar. They swapped a normal front door lock/handle with a Bluetooth (or WiFi) controlled unit. The phone could be used with an optional WiFi extender. My head swirled with so many scenarios where things could be bad.

1) Leave the phone in the home, you'll never be able to get in! 2) Wireshark the WiFi 3) Hijack the signal

I'm sure the dark side is waiting for us all to adopt IoT in our homes. I prefer my mechanical locks, thank you.

My favorite example of this is the evolution of volume controls in cars. These days you have all sorts of fancy and inferior alternatives that leave you wishing for a plain old-school volume knob. The worst are the purely virtual volume settings with up and down buttons on a touch screen. Or only a bit better, physical knobs that spin endlessly and just send up and down operations to a digital volume level. Reasons why the old school knob is better:

* It maintains its position across power cycles. It can even be adjusted when the car is off. So you can lower the volume knob before you turn the car on and blast loud rock into your grandmother's ears.

* It does not require you to look at a touch screen to find the volume buttons. Tactile feedback is enough. You can operate it while maintaining the other 99% of your attention on the road.

* It physically stops at the lowest and highest possible volumes. Again, no need to look at some display.

Even better would be a physical slider instead of a knob. That would let you feel out the exact position of the volume without looking. The downside would be the limited space on a car stereo dashboard. But please, a touch screen is the worst and most dangerous interface while driving.

The same goes for radio presets. In a car with physical buttons for the presets, I can switch between my favorite stations without having to look. Try doing that with a touchscreen. How is this progress?

Maybe it's just a symptom of an industry that's often more about selling status symbols than selling functional products.

This is a great example of more technology making things worse. I don't mean badly done technology, I mean that even if this were working and secure, a light switch would be cheaper, more durable, easier to repair, and easier to use.

In the hotel's defence, I'm sure he could also go toconventional hotels and chop a hole in the wall and start messing with the wiring to achieve approximately similar "security breaches". The broken implementation is more concerning to me than the security aspects.

Sorry, fanboys, but anything Android is always "as bad as you'd think"

I surprised no one's mentioned Brillo[0] or Weave[1] from Google. They're trying to solve this problem in an open, standardized way.

[0] Brillo - Embedded Android - https://developers.google.com/brillo/

[1] Weave - Communications - https://developers.google.com/weave/

I think one part of the reason is "good" developers almost never apply for jobs to work on such projects. These projects are not cool or cutting edge, and you won't learn anything new. Also the reason why a lot of outsourcing, which is boring, and tedious 'business software' type work ends up being of average to below average quality.

It happens elsewhere too. Like how poor people get public defenders who are overworked, underpaid and not as good as private lawyers.