IoT goes nuclear: creating a ZigBee chain reaction | Hacker News Reader

IoT goes nuclear: creating a ZigBee chain reaction

blog.acolyer.org

41 pointskushti19 comments

The paper was heavily discussed here 7 months ago:

https://news.ycombinator.com/item?id=12893793 (309, 98 comments)

People don't bother to update even their home router's firmware. IoT ecosystem will be one of the biggest holes in cyber security and a heaven for black-hat hackers.

Economically vendors have little to no incentive to fix this mess either, so it will haunt us for some time to come. Introducing a slew of devices that all need security updates into each household that falls for them doesn't seem all that clever.

A light bulb that can change its brightness and colour shouldn't be smart; it should be dumb as a brick and expose only those parameters that can sensibly and safely be set by a user — kind of like a normal light bulb does.

"IoT ecosystem will be one of the biggest holes in cyber security and a heaven for black-hat hackers."

I think you meant "is" here.

Haha, I was in dilemma. But since most people are not aware of it, I chose the future tense. But you are right, it is already.

1. shit brick easily.

2. vendors mix feature changes/removals and security updates.

3, better the devil you know...

So I was reading the headline a little more literal and got cold shivers from imagining that IoT crap spreading to actual nuclear plants.

Still scary as hell.

Don't google IIoT.

Putting Touchlink in Zigbee was big mistake imo...

It helps(a bit) with user friendliness but throws AES security of Zigbee out the window...

I hope IKEA removes Touchlink in future: https://www1.cs.fau.de/content/zigbee-security-research Specially since IKEA uses power on-off pattern to reset bulbs https://www.youtube.com/watch?v=mJm9YpPrGzk

tl;dr: OTA firmware update was hacked.

"Correlation Power Analysis (CPA) attack against the CCM encryption mode used to encrypt and verify firmware updates"

Fascinating work. Working direct .PDF: https://pdfs.semanticscholar.org/b457/e4b95a70f8d1726ba70885...

Sounds like we already living in some cyberpunk dystopia. Except for people who don't buy "smart devices" of course.

It's getting harder every day not-to-buy "smart devices"... Try buying plain TV (without YouTube and Internet), try buying non-smart phone...

> Try buying plain TV (without YouTube and Internet)

If you leave the smart-TV without a network connection it'll be mostly like a plain TV.

> try buying non-smart phone

There are some feature phone Nokia models available, I use one such.

The thing I miss the most about having a smartphone is GPS and a map app. For everything else except mobile internet, which I can do without, that a smartphone would give me I have an iPod touch.

Not sure if it still works, but i swear my old SE featurephone had maps fetched straight from Google.

"Try buying plain TV (without YouTube and Internet), try buying non-smart phone..."

Disable data connection for both and you have "dumb" counterparts. Of course, you still pay for unnecessary features, but it's the price to pay if you value your privacy.

If only it were that simple.

Unless you've physically removed or disconnected the wireless interface, there's still a chance that a firmware vulnerability could lead to your TV being hacked via a remote and/or side-channel attack similar to what was demonstrated in the article.

Buying non-smart phones is very easy. Plain TVs are also readily available.

does anyone know a good Zigbee-capable smoke/co alarm listener that can be hooked up to send alert emails without relying on third-party servers? i was looking at openHAB and their Zigbee support is meh it seems :(

I should order some simple MOSFATS and other basic components in large numbers, get a mobile booth - an large sign reading:

Doest thy hardware has't the beshrew? Software demonic exoc'rzisms and beshrew removal! The doct'r is in.

Reply on news.ycombinator.com