Hacker News Reader

Comment by blacksmith_tb | Hacker News Reader

I am not sure I follow - is the implication that some "creepy" person I met at a bar/cafe/etc. who knows only my first name will somehow exploit $RANDOM_IOT_DEVICE in my home? Even if you allow that they might be able to ID me accurately (say with a phone camera), they'd need to find my IP (which changes regularly, DHCP from my ISP), get through the firewall, and compromise the device. That isn't impossible, but it would make a better subplot for Mr. Robot than something I should spend time worrying about. It seems much more likely IoT devices will be exploited by scripts, running over ranges of IPs, and their "creepy" owners will be thousands of miles away from my home.

View on HN

Do you have anything in your home that you might wish to keep private? Any texts with loved ones? How about any intimate moments, whispered nothings that you would prefer not be recorded?

Oh, you say you have nothing to hide.

Do you have a bank account? An investment portfolio? College funds for your kids?

A skilled attacker can make all of that vanish.

Without many people noticing, the IoT has slowly invaded the average American home. Almost every TV is a Smart TV, internet gateways are smarter, Alexa, Siri, Cortana, light bulbs, door locks, refrigerators, thermostats...

With a little effort, an average pen tester could own your system, publish your secrets, steal your life savings, record you with your wife, and brick your iPhone, TV, and furnace just for good measure.

It's time to take IoT security seriously.

*It actually was on Mr. Robot. There was a subplot wherein Darlene compromises an E-Corp exec's smart home, causes the appliances and security system to malfunction to drive away the occupant, and then uses the place as a hideout.

Even if you literally have nothing valuable to hide, consider that a hacked device on your network could be used for malicious things like DDOS, hosting illegal content, proxies for other attacks, etc etc.

More importantly, consider how much more empowered malicious state-backed entities become. At the moment we can only be surveilled (which is plenty terrifying). What happens when we can be physically influened remotely at scale

> It seems much more likely IoT devices will be exploited by scripts, running over ranges of IPs, and their "creepy" owners will be thousands of miles away from my home.

It seems much more likely that it's not an either/or proposition.

Does it seem that unreasonable that someone can go from name to email to spearfishing attempts to ip to firewall exploit to home security camera/refrigerator/every out-of-date piece-of-garbage IoThing in your house if they're specifically trying to get you? That was pretty much each of the 100 stories behind the Fappening. You think a rival startup wouldn't go through the effort, or a creepy neighbor? Isn't that the entire concept behing RATting (minus the easy way in provided by the IoT)?

You think it won't be turned into a 1-click app with notifications after each stage is passed?

No, the implication is that your abusive partner, or perhaps a stalker, might turn your IoT devices against you & use them to watch you in your own home.

It’s easy for people to be completely oblivious to this reality if they have never experienced it themselves or had someone they knew be on the receiving end of this kind of behaviour. It really is not that uncommon.

If your threat model includes an abusive partner, then it has to include physical and authorised access, device replacement, device replacement with completely different hardware... basically, this is woefully insufficient.

>they'd need to find my IP (which changes regularly, DHCP from my ISP)

You might be surprised at how long you can have the same IP. It can easily go for a year with some ISPs.

Besides, you just have to hack only a single device to keep logging your current IP address.

I think the general concern is both that the IoT devices provide incredibly poor security combined with the general availability of personal information getting tied across the IoT infrastructure. Federated Facebook/G+ logins for IoT devices are just around the corner, if they're not already here, and more and more IoT devices show up on Shodan every day.

I will concur the article is a bit of IoT fear mongering combine with general paranoia over the current state of web services, but it's not really like this is much of a stretch for the near future.

The author is alluding to taking a person home after a bar.

Reply on news.ycombinator.com