Russia: Hidden chips 'launch spam attacks from irons' | Hacker News Reader

Russia: Hidden chips 'launch spam attacks from irons'

bbc.co.uk

230 pointsmikecane123 comments

This is pretty funny. I doubt its authenticity but confess that when I worked at Intel (a looooooooooong time ago) and Andy Grove suggested there would be an 8086 in every Toaster I thought he was nuts, because the minimum system was about 4 sq inches (I had one as a demo board Intel sold) and who would want a CPU in a toaster anyway? A timer and a heating element, how hard is that?

Flash forward to today when playing with an Electric Imp[1] and noting that you don't need 4 sq inches, you don't even need 1 sq inch and you can network the damn thing.

So it certainly becomes feasible to do this sort of thing but I'm unable to construct a non-targeted reason why it would be worthwhile to do it. Now if you said, "A shipment of toasters headed for the US Embassy" or something where there was some actionable intelligence to be gained by snooping the network, perhaps. but randomly? Not so much.

[1] http://electricimp.com

I know the net enabled toaster is a running joke, but I would kill for one. Typically toasters are cheaply made and give varying results.

I'd love to see a Nest-like toaster. I'd buy it in a second. Not sure if it needs net access, but it can certainly use intelligence. Might be nice for it to email me when its crumb tray gets full or download updates (toasting times for new items like gluten free bagels, etc).

Dear god no. I have a Nest thermostat and it drives me nuts with its inappropriate learning behaviour. I can just imagine the toaster learning, incorrectly, to what degree I wish my bread to be toasted and thus giving me levels of crispiness that I did not expect or want.

I really think there's a problem with over-engineered products these days. Not every appliance needs a motor or batteries, let alone a computer. I'm still very happy with my manual can-opener (the most reliable ones are the most basic, in my experience, like this one: http://meridianvale.files.wordpress.com/2013/05/can_opener.j...) and my analog meat thermometer.

Things aren't over-engineered, they're poorly engineered. It's supposed to be the art of taking away until nothing unnecessary left. The common practice is to replace things which are difficult to engineer or expensive to manufacture with electronics and _that_ is the failure.

The Nest isn't that kind of engineering. It took a programmable thermostat (already overkill for most people's use cases) and added even more automation on top.

Do you know how much money you can save with a programmable thermostat? We took a good 25% off our gas central-heating bill by having one fitted.

His point isn't that a programmable thermostat isn't worthwhile, but that most people don't want it even if they should. Moreover, the OP notes that the Nest is overkill as far as programmable thermostats go.

> It's supposed to be the art of taking away until nothing unnecessary left.

Except if I can't understand your use case, none of the complexity related to it is needed, so it's all excess and must be removed. After all, we have a Model T, so why do we need a Ford Focus? They both move you along under engine power.

In other words, a lot of engineers seem to have a Procrustean Bed and a deep need to cut problems down to size in the name of cutting solutions down to size.

http://en.wikipedia.org/wiki/Procrustes

You're taking it too literally. Since Model T, cars have improved tremendously. Efficiency, comfort, and safety are still getting better year after year. That is engineering with a goal, to make a better vehicle.

Things like hydraulic power steering is a good thing. It is there for a reason, and taking it away does not make better engineering. It is however being replaced with electronic power steering, for the exact engineering reasons. Before we could make reasonable good electronic power steering, there was nothing to take away from the hydraulic steering, but taking away the power steering itself, would be a step back.

Could you elaborate on the Nest? I was considering getting one.

Let me start with the positive: the Nest is beautifully designed and easy to install and in every respect appears to be a high quality product.

The negative, for me and my coworkers (the Nest is at my office - it was a gift from a client), is very simple: there are times when you find yourself asking the question, "Why the hell is the heat / air conditioning on right now?"

This never happens with a normal thermostat.

The basic issue, as far as I can tell, is that the Nest learns from people. This seems like a benefit but when you consider the way people behave doesn't work out that way in practice. People get hot because they just exercised; or they get cold because they got a chill waiting for the bus; or they are naturally warmer or colder than someone else; or they're coming down with something, etc.

They change the temperature of the office as a result. And maybe a bit later someone else changes it back, or changes it more, or whatever. So you end up with these weird patterns where the heat is at 19C usually, but for a two hour period in the morning it jumps to 22C, then goes back to 19C, then back to 20C for an hour in the afternoon, etc.

Our previous office thermostat, where you programmed a weekly schedule but could set it to a new temperature for three hours before it went back to its schedule, worked much better in practice.

These days I believe we have the Nest just set to keep things at a constant temperature all the time, which really defeats the purpose and is worse for resource usage than our old thermostat.

All of Nest's learning features can be individually enabled/disabled, at least. If you don't want the automatic scheduling, you can turn it off and set the schedule yourself.

You'll still benefit from the other things it does that other thermostats don't (learn when it's in direct sunlight to compensate, manage your humidity, learn how efficient your heat/air is so that it can reach scheduled temperatures at the scheduled time by turning on early, keep your office cooler with less a/c usage by running the fan a while even after the condenser shuts off).

In a home, being able to turn the temperature up or down a degree with your phone when you're on a different floor than the thermostat is nice.

Thanks for the tips, I'll dig into it a little more.

This appears to be one of those situations when you need either:

A) A dumb old-school programmable thermostat

B) A Star Trek computer for the house, that understands people.

So it's overlearning, and it's hard to improve on that with the deliberately limited inputs.

Incidentally, those aren't the most basic can openers; it's possible to make a can opener with no moving parts. Search for "swiss army knife can opener" to see some pictures.

Personally, I first learned to use the simpler design; when I saw the kind with the gears and handle, it seemed over-engineered to me. I find them equally easy to use, but I've seen the handles break on the more complicated kind (they were plastic, not metal) and I've also seen the gears go out of alignment. Yet the simpler design is rarely seen except in swiss army knives and military rations. This seems to support the idea that some added complexity can be worthwhile for most users as long as the product is otherwise well-designed and well-built.

> Not every appliance needs a motor or batteries, let alone a computer.

So true.

What's even worse is the half-baked stuff. There are, like, a dozen clocks embedded in various objects in my house. I've learned the whole list. How, you ask? I need to change them back or forward 1 hour twice a year.

The darned things are not DST-aware, to say nothing about the absence of any capability of syncing to NTP or GSM or GPS.

Amen. In the market for a new garbage disposal recently, I was looking at the top-of-the-line Insinkerator Evolution Excel model until I saw a note about the delay in power-up being due to "microprocessor initialization". Microprocessor in a garbage disposal?!?

Wow, those american-style can openers are the worst piece of engineering I have ever seen. The first time I saw one of those, it took me 15 minutes to figure out how it's operated, and I was baffled why there was a need to invent such a thing. Exemplary over-engineering.

This is a well-engineered can opener: http://www.fiskars.eu/Kitchen-Household/Products/Utensils/Ki...

A computerized Dualit [1] would be awesome especially if all it did was impersonate Talkie Toaster [2]

[1] http://www.dualit.com/products/classic-toasters [2] http://www.youtube.com/watch?v=LRq_SAuQDec

Not for me, thanks... The appeal of having a classic Dualit is that I can replace any of the three parts that might fail (elements, on/off switch, clockwork timer) in a couple of minutes with a screwdriver. Everything is serviceable and fixable, and it isn't really that hard to learn how to make toast manually...

Would a Raspberry Pi-powered microwave[1] suffice?

[1] http://madebynathan.com/2013/07/10/raspberry-pi-powered-micr...

controlled, not powered.

His usage of "powered" is a very common english colloquialism. For example the phrase “powered by wordpress” doesn’t indicate that someone is obtaining energy from the wordpress software product.

Some more examples: https://www.google.com/search?q=%22powered+by%22

You might like this video [1]. I used to scoff at the idea of 'tweeting toasters' etc but watching this gave me a different perspective on why things like this are going to be big.

[1] http://vimeo.com/61862454

I will keep my old Toastmaster 1B14. Fully automatic, drop toast in, it goes down, toast is done it comes up automatically. Haven't changed the setting in years.

A Nest Toaster? So three hundred dollars to make toast, I wonder if it would chat with you like the one from Red Dwarf?

Some items don't need new incarnations, there are many old appliances you can buy on auction sites that will cost you about the same as new ones and provide you years and years of great use. Best yet, most are super easy to fix, if they do break.

Given that God is infinite, and that the universe is also infinite... would you like a toasted teacake?

Computer scientists and toasters. This one is old but it's still good:

http://philip.greenspun.com/humor/eecs-difference-explained

Spoken like someone who hasn't learned the lessons of Talkie Toaster from Red Dwarf :)

( http://m.youtube.com/watch?v=LRq_SAuQDec&desktop_uri=%2Fwatc... )

So you want a "smart toaster"? Funny you should mention that.... check this guy out. http://www.amazon.com/KitchenAid-Pro-Line-Toaster-4-slice/dp...

It won't email you anything, but:

* it will wait for you to insert two slices, then gently lower the toast on its own (or you can press the toast button)

* when the toast is done, it will gently be lifted (instead of popping up, which is a little more violent and probably wears out the toaster a bit if you think about it)

* If you leave the popped-up toast alone for half a minute, the toaster will lower it down again to do a 'keep warm' function

* it's got the "a little longer" button that actually works, instead of just a thermostat which you need to guesstimate turning up

so now I just wish I had an amazon referral account to make a quick buck here :P

NetBSD really does run on anything!

http://www.embeddedarm.com/software/arm-netbsd-toaster.php

Somewhere along the way, a cpu became the cheapest way to build the timer.

If I had to build a reliable variable timer these days, I'd choose a PIC and a few lines of code instead of a 555 and fiddling with resistor and capacitor values.

If you read the original, there are several strong bullshit indicators.

The 200 meter range is one.

Second, they quote some guy who's a director of a consumer electronics importer. He says that the reason they found these "spy chips" is because the shipment of consumer electronics was over declared customs weight. So they started looking and found chips, meaning that the keyword you are looking here for is "customs", not "Chinese spam chips" :)

[0] http://www.rosbalt.ru/piter/2013/10/22/1190990.html

The story was discussed on Russian forums and people found even more blatant BS there -- "wi-fi module" was in fact just a speaker used to indicate horizontal position of the iron, spying module in the demonstrated Chinese phone were just capacitors.

"by connecting to any computer within a 200m (656ft) radius which were using unprotected Wi-Fi networks."

wow it's better than any wifi router I've ever owned! Time to buy an iron.

Makes sense. People who use irons are the real global power brokers in every modern society. The laundry room is the ultimate prize. Even though it may cost $50 to manufacture an iron that has 200M WiFi range and sophisticated viral payloads, and sure irons are unplugged most of the time, and OK, you'd have to sell the irons at a steep loss, but still you will have amassed a network of thousands of irons spanning the globe, listening, waiting, and ironing.

"This is a Seldon crisis we're facing, Sutt, and Seldon crises are not solved by individuals but by historic forces. Hari Seldon, when he planned our course of future history, did not count on brilliant heroics but on the broad sweeps of economics and sociology. So the solutions to the various crises must be achieved by the forces that become available to us at the time.

"In this case, -trade!"

Sutt raised his eyebrows skeptically and took advantage of the pause, "I hope I am not of subnormal intelligence, but the fact is that your vague lecture isn't very illuminating."

"It will become so," said Mallow. "Consider that until now the power of trade has been underestimated. It has been thought that it took a priesthood under our control to make it a powerful weapon. That is not so, and this is my contribution to the Galactic situation. Trade without priests! Trade alone! It is strong enough. Let us become very simple and specific. Korell is now at war with us. Consequently our trade with her has stopped. But, -notice that I am making this as simple as a problem in addition, -in the past three years she has based her economy more and more upon the nuclear techniques which we have introduced and which only we can continue to supply. Now what do you suppose will happen once the tiny nuclear generators begin failing, and one gadget after another goes out of commission?

"The small household appliances go first. After a half a year of this stalemate that you abhor, a woman's nuclear knife won't work any more. Her stove begins failing. Her washer doesn't do a good job. The temperature-humidity control in her house dies on a hot summer day. What happens?"

He paused for an answer, and Sutt said calmly, "Nothing. People endure a good deal in war."

"Very true. They do. They'll send their sons out in unlimited numbers to die horribly on broken spaceships. They'll bear up under enemy bombardment, if it means they have to live on stale bread and foul water in caves half a mile deep. But it's very hard to bear up under little things when the patriotic uplift of imminent danger is not present. It's going to, be a stalemate. There will be no casualties, no bombardments, no battles.

"There will just be a knife that won't cut, and a stove that won't cook, and a house that freezes in the winter. It will be annoying, and people will grumble."

Sutt said slowly, wonderingly, "Is that what you're setting your hopes on, man? What do you expect? A housewives' rebellion? A Jacquerie? A sudden uprising of butchers and grocers with their cleavers and bread-knives shouting 'Give us back our Automatic Super-Kleeno Nuclear Washing Machines.'"

The source for this is Russia state owned media. I imagine this is a Ukrainian chocolate situation. When Russia gets pissed at someone they attack a trade relationship that hurts that country. Suddenly, Ukrainian chocolate is unsafe. Suddenly, American adoptive parents are unsafe and morally dubious for Russia adoptions.

I wonder who makes these irons and if this is the beginning of a larger smear operation.

I've not heard about the Ukrainian chocolate war before (have now googled and read about it, oddly enough in Russia Today), but I've read about and seen the Georgian and Moldovan wine ban in action. Pretty brutal for such small countries to be honest. Luckily the best Georgian + Moldovan wine will get exported to the EU anyway, but for your average winery times must get tough.

I'm not so sure EU wants to import wine anyway. They have their own of the best quality in any quantities

The EU imports massive amounts of wine from all over, so yes, Russia might just turn out to hurt their own interests with that ban, as it's quite possible Georgia and Moldova will simply find other markets and get less dependent on Russian trade.

The horrifying part of this behaviour of using conspiracy theories and blaming external enemies, is that it is so like the world's worst dicatorships, in e.g. the Middle East. Where will this end? :-(

Granted, the source is not known for reliability, but than everyone laughed their asses of when discussing fake stone used by British in Moscow spy scandal. Until British admitted something like 5 years later ( http://www.theguardian.com/world/2012/jan/19/fake-rock-spy-r... ).

So I'll file it under "curious, possible, but so far dubious".

Exactly. Few weeks ago Russia has banned all milk products from Lithuania. Official reason was low quality, but that's simply funny as the same products are exported to EU countries, that generally have higher quality standards. More likely was unofficial reason: revenge for problems caused to Gazprom. So yes, it is a common practice for Russia to imply import bans as a political reasoning.

The milk thing has another possible/likely reason: Lithuania holds the EU presidency at the moment, and will host a summit that amongst others will involve free trade agreements with Ukraine, as well as initiate talks with Moldova and Georgia about further cooperation. Russia has made it very clear they take a dim view of more ex-Soviet states coming under EU influence, in part because they want their own customs union and closer integration with these countries.

During my short time in Russia, the "unprotected wifi network" did not appear to exist. Wherever I went, they seemed pretty paranoid (probably justifiably) about keeping wifi locked down.

Hotels went so far as to give you a custom per-device one-day-only password.

gorky park was one of the few 'open wifi' hotspot I found this year (April). I'm sure there are others, and I didn't venture outside of downtown moscow, but I didn't notice open wifi (found a couple, really poor speed). I had a mifi hotspot with me which kept me connected around town.

Starbucks and mcdonalds has open wifi, Aa lot of cafes and food courts in malls. Private access points are usually WPA/WPA2

noticed in mcd, but only went in twice. My wifi thing popped up asking if I wanted to join (IIRC), and did in gorky park, but rarely ever did anywhere else - travelled a lot of small backroads and streets in moscow, so maybe I didn't hit too many freebies.

They do this in parts of Europe, but I think this is more due to laws that make the hotspot operator liable for user conduct.

> a custom per-device one-day-only password

Pretty common in Europe.

There are European (EU?) laws that do this too, and I'm assuming Russia ones. Essentially, they want the identity of every user on wifi. Sucks for the casual traveler.

YMMV, depending on country... and how much the hotel cares about Wifi access.

Italy has strong controls related to terrorism, IIRC. The which has meant the last few times I stayed in hotels there you had to hand over your passport for photocopying to be issued Wifi passwords.

France & Germany have been a mixed bag – smaller hotels handed out per-device, per-use passes but a few nicer / chain hotels I stayed at have the standard "Open hotspot, enter your room # and name to bill to room" setup as I'd find here in the States. The UK For the most part has been fairly normalised ala US Style for me.

On the other hand, there are apparently controls over mobile internet access in France, including a (? 48 hour ?) delay in activating prepaid Data, and IIRC your passport also gets entered in the DB. Generally, I'm a prepaid-data-in-country type traveller (I have a bag of about 25 sims from various countries)... France has been a no go for that.

I remember having a little fun in Florence with guessing passwords. Think I got on a restaurant or hotel wifi near a tourist spot using "12345678"

If they can't stop me, they ain't stopping dedicated terrorists.

I suspect (this is entirely speculation) based on conversations with Hoteliers in Italy before that they find it an onerous, silly requirement.

They simply have to show that anyone they authorized to access their network was logged.

Following the letter of the law, not the spirit, as it were.

Actually, I'd say free wifi is at least as common in cafes and restaurants in Moscow as it is in big cities in US/Canada, if not more.

I spent more time in other parts of the country, but the ones I came across were free but not "unprotected". Meaning you needed at least a password from the waitress or written on the wall, etc.

This is good enough to protect against the "wifi spam bot hidden inside of a household iron" attack.

The appliance could just try every SSID it sees as the password. Won't take long before someone looking at the sign enters the password in the SSID field of their client.

I've been ironing my tinfoil hat and all along I was just perpetuating the problem. Doh!

True or not, it's an interesting attack vector. Makes me wonder (again, assuming this is real) if it was designed that way or perhaps the manufacturer was compromised/firmware modified (although why would an iron need firmware?). I imagine we'll probably see more attacks using unconventional attack vectors in the future; the Chinese hackers using a thermostat to maintain persistence in the US Chamber of Commerce springs to mind [1]. Something that you bring in and connect willingly to your network would be devastating. Can you imagine buying a new TV, toy for your kids or some other high-tech wifi-enabled device and later discovering that it would periodically arp-poison your laptop?

[1] (see section titled "Lying in wait", about halfway down the article) http://www.nytimes.com/2013/01/31/technology/chinese-hackers...

Sounds interesting - it must be very cost effective to do this, so I'm wondering what chipsets are used in these products? Would this make for a very low cost Internet of Things? I've always wanted to have a mini-router embedded in a light bulb. It wouldn't need power and should have decent range.

You can use one of the WiFi SD cards for something like this. They're completely hackable, and run busybox linux.

This is an early article, an other people have gone so far as to add displays and other devices to them.

http://haxit.blogspot.com.au/2013/08/hacking-transcend-wifi-...

Thank you for amazing me.

Do you have one in mind? An Eye-Fi perhaps?

They all seem to be built on the same foundations, though the Transcend ones look to be the most popular. I've one sitting around but I haven't had a chance to do much with it except for confirming that the vulnerabilities exist.

Are SoC's getting so cheap that this kind of scatter shot approach is cost effective ?

In all honesty I believe this is a fabricated story. Mainly 1) its not cheap 2) Irons are hot and can have water in them for steam. Not ideal for electronics 3) Irons aren't in use all day. Hardly a great attack vector, a mobile phone charger would be much better

Yeah, I'm not really buying this either, Russian state media isn't exactly the high-water mark of journalism. The idea is entertaining though.

There is a possibility that this is an attempt to build up a media cover and public support for rolling out some sort of state sponsored "security" system for Russian citizens akin to the Great Firewall of China.

And it's need a power convector. Yes, it's fake. Russia trying to find a reason to block goods from China.

About #2: Irons already have electronics in them, typically a microcontroller + sensor + LED(s) + input buttons + of course the heating element.

Now I feel old; last time i looked inside an iron all I found was a thermocouple, a cheap bulb and the heating element;)

I am sorry, but this is just cool (if in fact, the reporting is accurate).

This is why using Chinese chips in American military equipment is a bad idea, aside from the fact that ghost runs of popular chips can result in fake, non-working chips.

Why did they choose the irons? Usually irons are not plugged-in more than couple of hours in a week.

First thing that comes to mind is that no one would suspect an iron. People are gonna beat their heads over these intermittent spam issues for quite a while before any correlation pops up. Second, if you add a battery to the chipset, then you can charge while the person's ironing and out spam throughout the week. Irons are pretty high power devices, so no one's really going to notice an extra watt or so.

Wouldn't an SOC + battery in an iron be fairly prone to overheating issues?

It could just charge while the iron is on, and do everything else while the iron is off. As to being affected by heat, there are parts of the iron that can't be hot (i.e. the handle), so you can move the install away from the hot parts.

> First thing that comes to mind is that no one would suspect an iron. ...

That's very Monty Python.

That may be part of the reason. Common household item with somewhat unpredictable usage sounds like a good way to mask the activity.

Yup, all you need is a brief window to dump the malware on another box. Finding a malicious device is much harder if it's intermittent.

Heavy? A lot of room in the handle? Nope... I'm stumped too, because I can't imagine there would already be a transformer in there for easy 5 - 12v power.

If you won't be physically interfacing to the outside, you can get 5-12V power very easily with some incredibly simple components. Your circuit just might be at 100+V with respect to ground, so it needs to be completely isolated.

See http://ww1.microchip.com/downloads/en/appnotes/00954a.pdf

Speculation:

1. Heavy, relative weight difference is negligible. 2. Has power 3. Easy to open up and work with 4. Plenty of extra space inside 5. Travels into a diverse selection of households 6. (most important) the person has a day job in an iron factory.

I also like the theory this is just a PR stunt for someone like a local iron retailer, or it was a local mod done to the irons after they arrived in Russia.

I'm thinking hotel rooms could be a target. Irons that are used frequently and in close proximity to people connected to (or sharing) wireless connections.

There is no way that this attack method is profitable if the attacker is fronting the cost of manufacturing. This leads me to believe that this article is incorrect or fabricated, or that this is a seriously interesting attack on a iron manufacturer.

Scary foresight of things to come with the internet of things.

I'm more afraid of computerized toilets, to be honest.

"We tried to port-scan the rogue device, but it flushed the evidence."

I'll just show muself out...

Might be a better experience than once the local script kids find your bidet. ;)

There are lots of attempts at humor in the comments. So far, the BBC reporting just says, "State-owned channel Rossiya 24" reported something, without any BBC reporter claiming to have independently verified the reports from Russia. Maybe this isn't a true fact about the world. It might be Russian official media paranoia, or some kind of hoax, or some kind of misunderstanding of a legitimate product feature. Until this story is better verified, I will go right on ironing my clothes. Are there specific brand names or lot numbers of the products available to reporters in other places who could verify (or disconfirm) this story?

The original Russian report is typically fractured by Google Translate: http://translate.google.com/translate?sl=ru&tl=en&js=n&prev=...

I think this is something where shipments specifically headed to Russia were targeted. But that's not to say it can't pop up elsewhere. [typo edit]

I'm having a hard time believing that they detected some of the microchips by comparing the listed shipment weights with the actual shipment weights.

Let us imagine a hypothetical scenario. Two identical shipments are weighted at the same scale during customs. One of them is consistently 0.05% heavier than expected. Then you notice same pattern with a few more shipments. An inquiring mind might wanna open a few boxes and see what is up. *Typoed

Weight is likely taken very seriously by any Customs department due to drug smuggling. And these days, much more malevolent items.

Another good reason for irons, they are a bit heftier than a lot of other small goods, giving less variance from the weight of a small chip.

Why irons though?

i remember a classic demo at one conference where they used a PSU. It had some advantages: 99% certain it will be used near a computer. USB and Ethernet ports for "power surge protection" that can add attack vectors.

the only reason i can think of for irons is either lack of other opportunities, or trying to be as inconspicuous as possible (tech savy people are more prone to opening a PSU than an iron)

>* remember a classic demo at one conference where they used a PSU.* //

Wifi from inside a grounded PSU casing inside a (possibly metal) PC casing doesn't sound like something that's going to work very well?

all UPSs i had were plastic cases.

ah, sorry... i wrote PSU... my bad. not a PSU, but one of those UPS, or no-break. more specifically the APC ones that are cheap and have USB data port and Ethernet/modem filtering.

Well, who wound think that the iron are sending spam?

Don't trust anything Russian state-owned media says. It went completely crazy in last 2 years. I recently watched a "Documentary" on this main "news" channel Rossiya 24, which speculated that the outbreak of Swine influenza in Asia was an ethnicity-targeted bio-weapon attack, carried out by the US. And other similarly insane things like "Bill Gates tries to make everybody infertile in Africa, with his anti-malaria vaccine." Overall mood that this 'program' tried to convey is "be afraid, be very afraid of foreigners and foreign states. They are out to get you."

Sounds like pretty much any media in any state, USA included... Replace the names of the countries and you will get your regular CNN.

"И — боже вас сохрани — не читайте до обеда советских газет..."

There's really no way for us to know that CPU manufacturers haven't embedded a backdoor that transmits - on some unknown frequency, or maybe technology - the contents of CPU registers and cache lines directly to some NSA satellite somewhere. We just don't have the ability to audit the powers that create these machines; and this sort of highlights a massive disparity between classes - the technocratic class, and the consumer class.

TOR EXIT NODES. In a single swoop, the internet just got a whole lot messier to police ;)

I've been thinking about ideas like this for years, but it never occurred to me that you could just hit the supply chain at the source, rather than covertly fit the devices once kit had been installed.

Scary to think that my coffee pot is connected to your coffee pot by a piece of metal.

Scarier still, they might not need the metal. It might just go invisibly through the air.

I wonder if they spend their time exchanging pictures of cats too?

Nope, toaster pictures

That's like porn to irons? :D

Except that it isn't.

Yes, there will be a transformer on a pole (or in a box) outside your house somewhere, which means your coffee put is only inductively coupled to my coffee pot, unless you happen to be my neighbor.

In other news the NSA has possible backdoors in real computer devices.

My new company will provide Faraday caging of homes and residential buildings... Seems like with the new Intel chips with built in wifi that were rumored it will become popular service

Would it help in this case? Sure, you'd prevent signals from leaving the house, but the signals in this case are all internal to the house, so the wifi would still work internally. All you'd prevent are outside services from pinging in and vice-versa, not much help for internal devices connected through broadband internet wired or fiber.

There won't be much unsecured stuff to connect to on the inside.

Are botnets getting expensive or do they suck to send spam nowadays?

Without more evidence, I'm pretty skeptical of this particular claim.

Nevertheless, thousands of heating elements under your control in enemy territory would make a pretty evil cyberweapon.

I wonder if finding this is the result of post-NSA paranoia.

This makes me miss Burn Notice. Thats the kind of stuff Michael Westen would be doing in pretty much every episode.

See what happens when you take down the iron curtain???

Give us time, and we'll make bears with WiFi bots!

Finally, the Internet of Things is becoming a reality

hacking at its best. and a whole new meaning to internet of things.

Reply on news.ycombinator.com