alt Hacker NewsI keep reading about how IoT / wearables / smart home devices are routinely both vulnerable and exploited, if not even come with malware preinstalled, so I was curious to finally go through a primary source like this.
After skimming through the attacks performed in this research, and checking every mention of the word "internet", all I got was a section with a hypothetical scenario where the watch has a publicly reachable IPv4 address. Suffice to say, that is really quite unlikely, certainly in my experience at least.
It did also talk about bundled malware, so I guess that's bad enough, but is all IoT research like this? Always sounded to me like you kinda need to already have a foot in the door for these, and this paper didn't dispel that notion for me at all.
Replies
"You're safe as long as every device on the network you're on is safe" isn't safe.
In theory I should be able to take a modern browser/device over a completely compromised router and either be safe, or have my device tell me "holy shit, something is wrong".
The days of local trust should be long gone by now.
> a hypothetical scenario where the watch has a publicly reachable IPv4 address
Or one of your other IoT / smart home devices / malware on your PC is doing local network reconnaissance? Connecting this device to a public wifi? Or just a bad neighbour who hijacks your SSID? This smells of "I'm secure because I'm behind a NAT" which conveniently ignores the couple dozen other paths an adversary could take.
The source site/paper won't load for me at this time, but if the device has a cellular modem in it for network connectivity, it will 100% be assigned an IPv4 address from the carrier. Unless this device is using an APN at the carrier level, or is using a SIM provider that provides some additional security.
> the watch has a publicly reachable IPv4 address
Attacker reachable, presumably? Like from a hacked cable modem or wifi router?
> Suffice to say, that is really quite unlikely, certainly in my experience at least.
Why is that? Are the cellular carriers blocking access?
Many of the great hacks have involved breaking through 2 layers of supposed security. You break into the 3D printer, which lets you send packets on the local network. Then you use that to break into the exercise bike, which has a camera because it's based on a generic tablet.
Either vendor might see the flaw as low-severity. So what if someone can send packets? So what if someone already on the local network can hack the camera? But combine them and you're pwned.