Oh snap, old phones and new IoT devices just sprung another leak

Subject: General Tech | March 15, 2016 - 01:11 PM |
Tagged: snapdragon, qualcomm, security, iot

TrendMicro discovered vulnerabilities in the Qualcomm Snapdragon 800 series, including the 800, 805 and 810 on devices running a 3.10-version kernel.  They have privately discussed the issue with Google who have since pushed out updates to resolve these issues on their phones, preventing attackers from gaining root access with a specially crafted app.  Unfortunately that is the tip of the iceberg as according to Qualcomm more than a billion devices use Snapdragon processors or modems, many of them IoT devices which have not had this update.  With the already fragmented market getting worse as everyone and their dog are now creating IoT devices the chances are very good that your toaster, fridge and other random internet connected devices are vulnerable and will remain so. 

You should think twice when considering the balance of convenience and security when you are purchasing internet connected household appliances and other IoT devices.  You can see what Slashdot readers think about this here if you so desire.

sd_processor_03.png

"Security experts at Trend Micro have discovered a vulnerability in Qualcomm Snapdragon-produced SoC devices. In fact, it is the same vulnerability that cropped up earlier in the month, affecting Nexus 5, Nexus 6, Nexus 6P and Samsung Galaxy Edge Android handsets. This in itself is concerning as these are devices that are no longer in line for security updates, but more concerning is the fact that the same chips are used in IoT devices."

Here is some more Tech News from around the web:

Tech Talk

Source: Slashdot

If you have a Trane thermostat you should update the firmware immediately

Subject: General Tech | February 9, 2016 - 01:30 PM |
Tagged: trane, iot, security

It is not a good sign when a security team refers to your smart thermostat as "a little malware store", especially when the flaws have been known for some time.  Indeed the original issue of hardcoded SSH passwords has been known since 2014 and the update took a year to be created.  Unfortunately most owners of a Trane Thermostat will not have upgraded their firmware, even if they knew about the update as it is not something which was installed remotely.  Instead you need to download the new firmware onto an SD card and manually install it on the thermostat.  Last month another update was released to address a remote code execution vulnerability in the ComfortLink II, which was not generally known until The Register posted about it today.  If you are using this device you should get an SD card handy and download the firmware.

1401223883460.png

"In April 2015, one year after the first alert, Trane fixed the hardcoded password issue with a new release of the ComfortLink's firmware. Cisco then tipped off US CERT about the remaining issues. Trane eventually addressed the flaws in its code in January 2016, but didn't tell its customers that new firmware is available."

Here is some more Tech News from around the web:

Tech Talk

Source: The Register

Ever been so sick of a song you considered veering off the road to make it stop?

Subject: General Tech | January 27, 2016 - 01:24 PM |
Tagged: Usenix Enigma, security, iot

The good news is that this particular bug has been addressed but it does not make the vulnerability any less terrifying.  A mere 18 seconds of playtime on a compromised audio CD in your car is enough to insert the attack code and gain complete control over your cars computer controlled systems.  This particular vulnerability was discovered in 2010, long before the more recent vulnerabilities you would have seen all over various media.  You could shut off the engines, forcibly unlock the doors, interfere with steering and many other functions that could well cause serious damage at highway speeds or in other scenarios. 

When placing the blame, The Inquirer makes sure to point out that you should not look to the car companies as it is the software providers who are the source of the problem.  Thanks to various corporate policies no car company has access to all of the source code running in their products so a security audit will not help.  Even better is the inclusion of a government-mandated OBD-II port which allows complete control over your cars system; which you should not touch as simply plugging into it would be a crime in the USA.  There is some good news, this vulnerability resulted in Fiat Chrysler recalling 1.4 million cars at a cost of about a quarter of a billion dollars ... an expensive mistake that may convince them to change their software implementation processes.

enigma_logo_700x253.png

"The modern car's operating system is such a mess that researchers were once able to get complete control of a vehicle by playing a song laced with malicious code. Malware encoded in the track was executed after the file was loaded from a CD and processed by a buggy parser."

Here is some more Tech News from around the web:

Tech Talk

 

Source: The Register

Make yourself a WiFi camera remote

Subject: General Tech | January 25, 2016 - 12:40 PM |
Tagged: wifi, camera, DIY, iot

Hack a Day has posted a perfect example of how inexpensive and easy it is to build yourself useful things instead of shopping for expensive electronics.  If you have looked at the prices of cameras or adapters which allow you to wirelessly take a picture you have probably been disappointed, but you don't have to stay that way.  Instead, take an existing manual remote trigger, add in a WiFi enabled SoC module like the ESP8266 suggested in the video, download and compile the code and the next thing you know you will have a camera with wireless focus and shutter trigger.  Not too shabby for a ~$5 investment.

index.jpg

"It’s just ridiculous how cheap and easy it is to do some things today that were both costly and difficult just two or three years ago. Case in point: Hackaday.io user [gamaral] built a WiFi remote control for his Canon E3 camera out of just three parts"

Here is some more Tech News from around the web:

Tech Talk

 

Source: Hack a Day

It's fixed now but for a while there your Ring let people into more than just the door

Subject: General Tech | January 13, 2016 - 12:27 PM |
Tagged: ring, iot, security, gainspan

The Ring WiFi enabled video doorbell, with optional smartlock compatibility to let visitors in remotely, would also share your WiFi password to anyone who knew how to ask.  Just use a Torx screwdriver to pop the doorbell off, press the setup button on the back and connect to the Ring and you can get the networks SSID and PSK in plain text.  Thankfully Ring has pushed out an update to resolve this issue but it is a perfect demonstration of the abysmal security on IoT devices and the lack of any thought about security implications by users or makers of these new devices.  The Register also mentions the Fitbit Aria bathroom scale as being vulnerable in the exact same way as it also uses Gainspan wireless, though at least the scale is inside your house, not accessible to anyone wandering by.

ring.jpg

"Security researchers have discovered a glaring security hole that exposes the home network password of users of a Wi-Fi-enabled video doorbell. The issue – now resolved – underlines how default configurations of IoT components can introduce easy to exploit security holes."

Here is some more Tech News from around the web:

Tech Talk

Source: The Register

Shame about the name but power over WiFi would be nice

Subject: General Tech | November 27, 2015 - 01:54 PM |
Tagged: poWiFi, wireless power, iot

It is going to take some work as it is not currently that impressive but the experiment at Cornell University shows that power over WiFi is not impossible.  The experiment was not all that impressive, they charged a Jawbone headset @ 2.3mA and after 2.5 hours which they managed to charge the battery to 41% over a distance of 5-7cm.  Those results are poor compared to Qi and other wireless charging solutions on the market but are promising.  The power is transmitted by a wireless router that can also send and receive data so for wireless cameras and other low powered devices which transmit data this could be quite useful.  You can read the research paper by following the links from Hack a Day.

feature_crop_proto_dongles.png

"There have been a few reports of power over WiFi (PoWiFi) on the intertubes lately. If this is a real thing it’s definitely going to blow all of the IoT fanboys skirts up (sorry to the rest of you *buzzword* fanboys, the IoT kids flash-mobbed the scene and they mean business)."

Here is some more Tech News from around the web:

Tech Talk

Source: Hack a Day

The Internet of Things loves to share

Subject: General Tech | November 26, 2015 - 12:22 PM |
Tagged: idiots, iot, security

You would think people would be be taken aback if someone suggested saving money by using the same key on every new house built in a neighbourhood, if so you don't work for companies developing hardware for the Internet of Things.  In a recent survey of  4,000 embedded devices from 70 hardware makers, Sec Consult found that many had the same hardwired SSH login keys and server-side SSL certificates.  The numbers they provided The Register were a total 580 private keys were found distributed over all the analyzed devices, of which at least 230 are in already in use on the internet.  To be fair this is not uncommon in consumer level firmware as companies do not even bother to check over the source code let alone change the security keys held within but it is a huge security risk.  For a glimpse at how bad some of these supposedly secure certs and keys are read on at The Register.

sec-consult-79037376.jpg

"Lazy makers of home routers and the Internet of Things are reusing the same small set of hardcoded security keys, leaving them open to hijacking en masse, researchers have warned."

Here is some more Tech News from around the web:

Tech Talk

Source: The Register

Windows 10 IoT Core Starter Pack for the Pi 2 Released

Subject: General Tech, Mobile | October 5, 2015 - 08:01 AM |
Tagged: windows 10, microsoft, iot

Microsoft has released the Windows 10 IoT Core for the Raspberry Pi 2. It retails for 75$ without the Raspberry Pi 2 Model B, or $115$ with it. Apart from the optional Pi, it is basically a pack of electronic components and an SD card that's pre-loaded with Windows 10 IoT. It is available at the Adafruit store, although both packs are currently out of stock... because of course they are.

microsoft-2015-raspbi-win10-iot-pack.jpg

Beyond jumper wires, a case, breadboards, resistors, LEDs, switches, and sensors, the pack also comes with a WiFi module. Interestingly, Adafruit claims that this will be the only WiFi adapter for the Raspberry Pi 2 that's supported by Windows 10 IoT. This is weird, of course, because Windows is kind-of the go-to when it comes to driver support. It makes me wonder whether Microsoft changed anything under the hood that affects hardware compatibility and, if it did, whether Windows 10 IoT loses its major advantage over Linux and other OSes in this form factor.

The kit is currently sold up, but retails for $75, or $115 with a Raspberry Pi 2 Model B.

Source: Microsoft

Windows 10 for everything arrives

Subject: General Tech | August 11, 2015 - 12:52 PM |
Tagged: windows 10, iot, raspberry pi 2

The slimmed down version of Windows 10 for devices such as the Raspberry Pi 2 has arrived and it is royalty free for makers, available right here.  The Register describes some problems with the current version, mostly incompatibility with certain peripherals but also include occasional video crashes or networking issues.  Seeing as how this particular incarnation of the OS is designed for creative minds tinkering on custom hardware the issues are not unexpected nor should you consider it proof the OS is not usable if you plan on tinkering with it.  You will need a full PC for development with Windows 10 and Visual Studio 2015 to start using the slimmed down Windows 10, nothing new but certainly worth noting.  Check out more on the Universal Windows Platform and Windows 10 for the IoT at The Register.

RPi2_0.png

"Microsoft has shipped the public release of Windows 10 IoT Core, the pared-down version of Windows 10 for embedded devices, including the Intel MinnowBoard Max and the Raspberry Pi 2."

Here is some more Tech News from around the web:

Tech Talk

Source: The Register

Still not worried about security on the Internet of Things?

Subject: General Tech | August 4, 2015 - 01:13 PM |
Tagged: security, scary, iot

Likely you caught at least one news story on the remotely disabled Jeep recently, with the attackers able to control system ranging from annoying to life threatening.  If that didn't rustle your jimmies, how about a drug infusion system used in hospitals which can be remotely controlled?  It is not just that the pump can be used to cut off or overdose a patient on drugs, it is the abysmal security that was put onto the pump. Both telnet and FTP ports were left wide open, two very popular and effective routes into systems you shouldn't necessarily be in and port 8443 which the system uses shipped with a generic password which, like SOHO routers everywhere, was never changed after the pump was installed.  Overall an inexcusable affront to those who think about security and a terrifying glimpse into the utter incompetence of providers of devices which were never network connected until recently.  You can read more about the Hospira horror story at The Register.

Hospira-Inc-medical-drug-infusion-pumps.jpg

"The US Food and Drug Administration has told healthcare providers to stop using older drug infusion pumps made by medical technology outfit Hospira – because they can be easily hacked over a network."

Here is some more Tech News from around the web:

Tech Talk

Source: The Register