The Internet of Things is Not Secure / Ready (IOT)

[Certaindeaf]

Thing 1 and thing 0.

 

[Flopsweat]

Thing 1 and thing 0.

If you liked it that much you shouldn't have put a thing on it.

 

[RicInOR]

Toyota Made Its Key Fob Remote Start Into a Subscription Service

Subscription-based features are taking over the automotive industry—and now they're coming for your key fob.

www.thedrive.com

 

[RicInOR]

https://www.theepochtimes.com/inter...-over-new-software-vulnerability_4156484.html


""Given that Log4j has been a ubiquitous logging solution for Enterprise Java development for decades, Log4j has the potential to become a vulnerability that will persist within Industrial Control Systems (ICS) environments for years to come,""

Log4j –

logging.apache.org

 

[Flopsweat]

https://www.theepochtimes.com/inter...-over-new-software-vulnerability_4156484.html


""Given that Log4j has been a ubiquitous logging solution for Enterprise Java development for decades, Log4j has the potential to become a vulnerability that will persist within Industrial Control Systems (ICS) environments for years to come,""

Log4j –

logging.apache.org

For a couple of years on one exceptionally large internal network where I used to work, if you logged a machine onto the network with an old enough OS version, it would become infected within a matter of minutes. If you really needed an older OS version for some reason, you kept it on a private network with either no connection to the corporate net, or a very limited and highly secure connection set up in a very particular way. If you didn't, within less than an hour of you getting infected, IT would block your machine from the network. If you did it a few times, they would come find you.

 

[RicInOR]

"The cloud" is just a fancy way of saying "someone else's hard drive."

So if it's something you don't want someone else to take away, lose, or look at, then don't store it on somebody else's hard drive.

 

[RicInOR]

Their Bionic Eyes Are Now Obsolete and Unsupported. Second Sight left users of its retinal implants in the dark.

Instapundit » Blog Archive » 21st CENTURY HEADLINES: Their Bionic Eyes Are Now Obsolete and Unsupported. Second Sight left users…

21st CENTURY HEADLINES: Their Bionic Eyes Are Now Obsolete and Unsupported. Second Sight left users of its retinal implants in the dark. Barbara Campbell was walking through a New York City subway station during rush hour when her world abruptly went dark. For four years, Campbell had been using...

instapundit.com

 

[Alexx1401]

Their Bionic Eyes Are Now Obsolete and Unsupported. Second Sight left users of its retinal implants in the dark.

Instapundit » Blog Archive » 21st CENTURY HEADLINES: Their Bionic Eyes Are Now Obsolete and Unsupported. Second Sight left users…

21st CENTURY HEADLINES: Their Bionic Eyes Are Now Obsolete and Unsupported. Second Sight left users of its retinal implants in the dark. Barbara Campbell was walking through a New York City subway station during rush hour when her world abruptly went dark. For four years, Campbell had been using...

instapundit.com

Sounds like an idea that did not make money so its now gone. Not quite sure what the article is trying to get at. Like a Co going bankrupt is something new. What is it they want done here? Maybe Black Lives Matter could fund the Co going back online with the 60 million or so they don't know what happened to?

 

[RicInOR]

Sounds like an idea that did not make money so its now gone. Not quite sure what the article is trying to get at. Like a Co going bankrupt is something new. What is it they want done here? Maybe Black Lives Matter could fund the Co going back online with the 60 million or so they don't know what happened to?

If I buy a pistol and the manufacturer goes out of business it still works.

If I buy a cell phone, the tech can still work, even when the manufacturer went under.
If the tech evolves, it may no longer work due to bureaucracy, or stopping of support-- 3G cell phone service as an example.

But, if I have a device, that must connect to something over the internet, that is the internet of things, then who knows if when it may choose to work. Which is why I say it is not ready yet.

If you had a device and it just got turned off? You'd be p-o'd right? A medical device?

At the least, if the company went under, the devices should continue to work until they fail.
And the user/owner would expect plenty of fair warning, like the 3G folks have gotten.

 

[ma96782]

Blame the hacking on some "independent criminal enterprise" and you could practically get away with most anything. Rrrright.......I remember when it was called.......

Plausible Deniability

Ask Russia, China, N. Korea, the US Govt?

Aloha, Mark

 

[Alexx1401]

If I buy a pistol and the manufacturer goes out of business it still works.

If I buy a cell phone, the tech can still work, even when the manufacturer went under.
If the tech evolves, it may no longer work due to bureaucracy, or stopping of support-- 3G cell phone service as an example.

But, if I have a device, that must connect to something over the internet, that is the internet of things, then who knows if when it may choose to work. Which is why I say it is not ready yet.

If you had a device and it just got turned off? You'd be p-o'd right? A medical device?

At the least, if the company went under, the devices should continue to work until they fail.
And the user/owner would expect plenty of fair warning, like the 3G folks have gotten.

Would I be mad? Sure. Still not sure who I am supposed to be mad at? Was this a private Co? Yes? So the people who decided to take a chance on this new tech thought what? I guess what they really want is for the Government to invent what they want and stand behind it whether it makes money or not. If that's what they want they may be waiting a good long time.

 

[RicInOR]

https://www.bbc.com/news/uk-england-hampshire-61006816

Isle of Wight: Council's electric vehicle chargers ... show porn site

Well, charging takes a while, I'd prefer a movie to advertisements.


ps, Security.

 

[ma96782]

WTF?
Blame......AL GORE.

Aloha, Mark

 

[Flopsweat]

https://www.bbc.com/news/uk-england-hampshire-61006816

Isle of Wight: Council's electric vehicle chargers ... show porn site

Well, charging takes a while, I'd prefer a movie to advertisements.


ps, Security.

If they're going to play porn they should at least put up curtains.

 

[RicInOR]

https://arstechnica.com/gadgets/2022/04/shameful-insteon-looks-dead-just-like-its-users-smart-homes/

Insteon

"The entire company seems to have abruptly shut down just before the weekend, breaking users' cloud-dependent smart-home setups without warning.
"The app and servers are dead. The CEO scrubbed his LinkedIn page. No one is responding.



If it is not on your hard drive, then it is not yours.

 

[RicInOR]

Samsung will shut down the v1 SmartThings hub this month

 

[Flopsweat]

https://arstechnica.com/gadgets/2022/04/shameful-insteon-looks-dead-just-like-its-users-smart-homes/

Insteon

"The entire company seems to have abruptly shut down just before the weekend, breaking users' cloud-dependent smart-home setups without warning.
"The app and servers are dead. The CEO scrubbed his LinkedIn page. No one is responding.



If it is not on your hard drive, then it is not yours.

Samsung will shut down the v1 SmartThings hub this month

When smart devices first came out, I figured I would eventually have blinds, windows, heat/ac and lights set up to operate remotely, maybe even close some things automatically based on schedules and weather. I never did get around to it. I may do something home-made at my next place - an Arduino seems like a great way to make that happen - but it will certainly not rely on external connections.

 

[RicInOR]

" Bluetooth hack compromises Teslas, digital locks, and more. "Using what's known as a 'link layer relay attack,' security consulting firm NCC Group was able to unlock, start, and drive vehicles and unlock and open certain residential smart locks without the Bluetooth-based key anywhere in the vicinity." "

 

[RicInOR]

PRIVACY: Mega says it can't decrypt your files. New POC exploit shows otherwise.

In the decade since larger-than-life character Kim Dotcom founded Mega, the cloud storage service has amassed 250 million registered users and stores a whopping 120 billion files that take up more than 1,000 petabytes of storage. A key selling point that has helped fuel the growth is an extraordinary promise that no top-tier Mega competitors make: Not even Mega can decrypt the data it stores.
On the company's homepage, for instance, Mega displays an image that compares its offerings to Dropbox and Google Drive. In addition to noting Mega's lower prices, the comparison emphasizes that Mega offers end-to-end encryption, whereas the other two do not.
…
Research published on Tuesday shows there's no truth to the claim that Mega, or an entity with control over Mega's infrastructure, is unable to access data stored on the service. The authors say that the architecture Mega uses to encrypt files is riddled with fundamental cryptography flaws that make it trivial for anyone with control of the platform to perform a full key recovery attack on users once they have logged in a sufficient number of times. With that, the malicious party can decipher stored files or even upload incriminating or otherwise malicious files to an account; these files look indistinguishable from genuinely uploaded data.

Remember, "the cloud" is just a fancy way of saying "someone else's hard drive."

If it's truly important or worth keeping private, don't store it on anyone else's hard drive.

 

[RicInOR]

Security flaws in popular GPS system allow hackers to remotely track and turn off the engine of at least 1 million vehicles around the world, report says (More)

"...including companies with fleets of vehicles, law enforcement agencies, militaries and national governments. BitSight said in its report that it also found the GPS trackers used by Fortune 50 companies "

MiCODUS GPS

"The most severe flaw is a hardcoded password that can be used to gain complete control of any GPS tracker, access to vehicles' real-time location and past routes, and remotely cut off fuel to vehicles. Because the password is embedded directly into the code of the Android app, anyone can dig around the code and find it. "

"The research also found that the GPS tracker comes with a default password of "123456," allowing anyone access to GPS trackers that have not changed their device's password. BitSight found 95% of a sample of 1,000 devices it tested were accessible with an unchanged default password, likely because device owners aren't prompted to change the device's password on setup. "




In case you were wondering, many school districts have trackers in their busses. Parents can use this to see when to bring the little ones out to the stop.