Hackers Make the First-Ever Ransomware for Smart Thermostats
motherboard.vice.com
motherboard.vice.com
...and it's simple to disconnect and reconnect yourself with 2 or 3 wires. In fact, I'd wager with a single wire and a little (and I do mean only a little) know how and a copy of the factory firmware you can recover it using the exact same process as you unbrick a router in just a few minutes.
Though, you should probably close the other holes in your network first. Chances are, if your thermostat has been hacked, they're in your network and it's only a matter of time before your computers suffer the same treatment.
Don't worry, this will be covered by some EULA, when connecting the device, where the owner is solely responsible for these things.
This "sort of" works for now, depending on where you live, what season, whether or not you keep junked tech, etc. But it strikes me, not only as dismissive and condescending, but also particularly short-sighted.
I can imagine, 20 or 30 years ago, someone saying something similar about a car: "a bug in your ECU is keeping your car from starting? That's your problem for having bought a car running off of a computer!" Fast-forward to today. It simply isn't possible to buy a car without an ECU.
The thing is, the changes that brought ECUs to cars are exactly the kinds of changes that are bringing computers into thermostats. In a surprisingly short amount of time, we're going to be living in a world where it simply isn't possible for most people to find a thermostat without a computer.
When people feel their agency and autonomy is being compromised with new technology, a common sentiment to echo in the tech world is "if you don't like it, don't use it". But the plain fact of the matter is that in many cases, IoT being an emergent but prototypical example, non-participation simply isn't an option.
So call it dismissive, call it what you want. I call it having a backup plan.
Also:
> I can imagine, 20 or 30 years ago, someone saying something similar about a car: "a bug in your ECU is keeping your car from starting? That's your problem for having bought a car running off of a computer!"
Forget 20-30 years ago, farmers are having this exact problem with John Deere right now, and they're concluding exactly this - it's their problem for having brought a tractor that relies on a computer, so they're buying up antique pre-ECU tractors so they're not beholden to these major corporations that "give them a license to use a tractor" for as long as the software works... and they have zero right to fix it if it breaks.
So next time you consider throwing out an old technology, just because there's something newer and better, perhaps consider putting it in a box for a time when it might be put to good use - a time such as this, and don't forget to put the installation instructions with it, because guaranteed you can never find them when you need them :P
It wasn't really meant to be a practical attack. It was largely because there has been speculation around this for the last few years, so we thought we'd actually do it.
It's largely to raise awareness that IoT security is poor and we don't have the control to do much about it.
It was runnign Tizen, which makes things a lot harder than Android.
We did get some minor vulns on the LG air conditioner.
edit: spelling
It's exactly this mentality that companies bank on to keep you replacing worthless crap with more worthless crap. Get an instruction manual and a screwdriver and become a bit more self sufficient. Your future self will thank you for it.
Not always. I helped debug some issues with our HVAC at our last office, and all of the thermostats were connected to the HVAC system via an ad-hoc wifi network. There was pin-based authentication, but it was easily googlable.
I can only see this kind of control becoming more common as HVAC manufacturers start looking at this as a way to impose DMCA restrictions over furnace installation, maintenance, and 3rd party controls. John Deere is paving the way here.
In particular, start ups trying to capitalized on IoT in niche products will need excess scrutiny in order to ensure they're not trying to run fly-by-night operations just to make a quick buck. Chinese IoT knock-offs will also need to be monitored carefully as well.
What's most frightening to me on something like this is even tech-savvy users are fairly screwed as your ability to interact with the device and try to remove or clear the ransomware manually will be restricted by the same methods meant to prevent you from tampering with the device in the first place. This likely can leave people without any recourse to ranson scenarios like the thermostat being hijacked, and the end-user will have no option except to remove the device.
Hopefully either a consumer or business alliance crops up with suggested practices for IoT devices, including remediation methods for these very scenarios. I think it's preposterous for companies to assume that their devices will never be compromised, and if they're going to lock down the devices, they need to provide a guaranteed way to reset the device; a bit of set up work certainly beats paying to make sure your fridge still works tomorrow. With IoT creeping out as the next "must include" feature for manufacturers, this sort of consumer protection is going to be essential.
I suppose I can see some potential future value to devices like thermostats, that directly control "large" resources like natural gas (by "large", I mean relative to what other resources a household consumes). Smarter controls at the household level could provide substantial energy savings in the aggregate.
However, the pessimist in me says "why does anyone really need appliances connected to the internet?". So you're trading off some potential future value to reduce overall energy use by better optimizing your own consumption in the present. You're also exposing yourself to faulty equipment that might also pose security risks. Do these thermostats have some sort of hardware kill switch that prevents software from doing clearly stupid things, like shutting off entirely or setting the heat to a maximum setting?
Finally, there was this gem in the article that I did not remember hearing about:
Munro, who last year found that a Samsung smart fridge leaked Gmail passwords
What exactly is the purpose of a "smart fridge", why does it need Gmail passwords, etc.
I think it's important to answer this without any of the qualifications you write after it. No one needs it. It's not even necessarily about how secure it is; if you're paying extra for these features you're just throwing your money away in the name of gadgetism.
You really don't need to fill in that they're unsafe or made with crap components. The truth is that no one would have a need of a perfectly made one.
But it sure as hell is nice to have all of those things.
I find it funny that in an article about how manufacturers are locking down their devices to only the features that the consumer needs (effectively having the manufacturer tell you what you need), you are going around telling others what they need.
None of these things are necessary, 99% of them aren't "need to haves", but they are "nice to haves".
I've gone down the "home automation" path, and i'm currently about $600 in and with that i've got most of the light switches in my house connected, as well as my thermostat and stuff like door locks and the garage door to the house. So keep in mind that I have a bias here.
Individually there is no one thing that is "worth it", but together it all adds up to a nicer life to me. Being able to turn all the lights out after i've gotten comfy in bed, being able to make sure the door is locked after i took in groceries, turning on the porch light for the delivery guy, or even checking to make sure the garage door wasn't opened when our car was broken into a few weeks ago.
Nobody wants a "Fridge that needs gmail passwords", but they want a fridge that can show your calendar. A fridge that can message you when you run out of something, a fridge that can show some photos from an album on your google account, or can send usage reports to your email on how much power it's using, or show you the weather or even the news. Now there are much better ways to implement all of that than just storing the gmail password and using it, but less technical people don't know that. Don't conflate the users' want of features with them wanting the security flaws as well.
Now I still don't think any refrigerators on the market have reached the point where it's worth the extra money for the "smart features" (at least as of a year ago when i was looking for a new fridge), but I feel it's close. After all, a refrigerator is a large appliance very in-view in the middle of your kitchen. People have put things on them for years with magnets and tape, it's a prime location for a touchscreen that can control not only the fridge, but can show and control other parts of your life/home. IMO it's a perfect location for something like a screen, and a pretty logical extension of what people have been using that space for already for years.
But to be honest I want other appliances to be "connected" first. Namely the dishwasher, and the clothes washer and dryer. Being able to schedule those, send alerts when they are done, to have the dishwasher determine if it's full enough to run now, or if it should wait, etc... Those are the things i'm looking for.
1) One big part of IoT is replacing capital goods with decades long depreciation with goods having months long depreciation. Yes your $20 Honeywell lasted three decades and a new one would last three more decades, but this $200 IoT thermostat simply won't be supported in a large number of months and the end users need an economic plan to replace it, say, annually, rather than a couple times per century. Which has interesting environmental/ecological concerns of its own. Your 1996 dumb thermostat works fine in 2016, but your 2016 IoT thermostat absolutely will not work with whatever passes for an iphone in 2036, or probably even 2026.
2) Demarcation points and interoperability and DRM need to be monitored. Oh so sorry your IoT thermostat got powned and tried to burn down your house, unfortunately instead of the standard current loop interface it uses a DRMed proprietary RS-485 based interface to talk to the DRMed furnace so rather than swapping in a new thermostat (which would just get powned in minutes anyway) you'll need a newer model thermostat and those only connect to new furnaces, so an IoT thermostat with a severe DRM infestation getting powned means a $5000 new HVAC system not just a new thermostat.
3) As more and more people recognize IoT as an anti-feature or unwanted at best, people are going to refuse to set it up, sorta like the millions of VCRs blinking 12:00 in the 80s/90s. My MiL has a long obsolete smart TV that's never been connected to the internet and is merely a dumb TV. Selected because she liked how the bezel matched her home decor. Likewise IoT devices are going to have to get used to the idea that very soon many/most users will never connect them to the internet, yet they still have to at least minimally operate.
When we bought a new TV, we picked the dumbest possible one, and did the bare minimum to make it work, skipping all the solicitations to hook it up to our wifi.
Does it matter? An unwanted feature is an unwanted feature. There's not much difference between buying a dumb tv and buying a smart tv and disabling the "smart" features.
For my MiL she wanted/needed a certain size and she really liked the bezel (and the stand, too) and that's how she selected her TV. It happened to be a smart TV but she was uninterested in that feature. She has no interest in wifi. At that time there was no choice or freedom in the market, its smart TV or no TV. Likewise 95% of the countries VCRs blinked 12:00 because the market at that time was fancy time shifting capable VCR or no VCR at all.
Part of the difficulty here is precisely that when it comes to IoT, there is no such thing as "expected security procedures", in no small part because established best practices on the internet often simply don't transfer well to a set of devices where a great many are expected to be acting as servers positioned behind very aggressive consumer firewalls. Even the "ideal case" applying the web security model to these kinds of devices leaves you with a very difficult NAT problem, and a very difficult authentication problem. You're left, more or less, with two mainstream approaches: either find a way to open up consumer firewalls (or bypass them entirely, for example by setting up your own dedicated access point for the device) and then issue the devices with its own TLS cert, OR use a centralized trusted-third-party auth model. Both, in addition to presenting enormous scaling problems, are shitty "solutions" when you're talking about devices with extremely high reliability requirements, like thermostats. If you have to connect to a TTP auth service for your heat to turn on, and your internet goes down, and it's winter in Canada...
So there are countless examples and anecdotes as to why it's not really as simple as establishing new best practices; entire new technologies may need to be established here. Now on the one hand, privacy and security are always secondary markets, so I don't think we'll see any direct calls for change through their advocates. On the other hand, these problems aren't just a matter of privacy and security: if you've ever tried to put together a consumer-grade solution for something like IoT, you know how hard it is -- largely as a result of the same technological shortfalls that are compromising security. As a business, anything that can save you development time/costs is going to be tremendously appreciated. So there's a nascent market gap for a technology that 1.) makes development companies happy by decreasing time/cost to market, and 2.) gives/forces security on them, in such a way that 1.) is inseparable from 2.). And that, I think, is really the way forward for privacy and security in IoT.
That's what I'm hoping, anyways, because I've sorta started a company trying to do that. The rest of this is basically a plug, so feel free to ignore it, but our product is called Hypergolix[1] and we're planning on releasing a very early preview alpha in the next few weeks. Our value prop for developers is that we're "Dropbox for Python objects, with an emphasis on IoT and privacy/security", and everything is enforced directly by cryptography. This also lets us do some really cool things like failover-to-LAN if your internet drops out, completely transparently to applications built on top of it.
I think the real home threat model is foothold: sitting quietly on your network and chipping away at the rest of your network, sipping from your fileserver, opening more ports on your router, etc.
With an IoT ransomware, vital appliances or controllers can be overtaken and potentially disrupt the victim's day to day activities. (Fridge is put into vacation mode if not paid in 24 hours, thermostat cranks the heat or AC until paid). These have very immediate and often costly real world consequences that cannot be mitigated short of removing the IoT device, and the immediacy can force a payment decision much faster than other ransomware.
I guess I don't see how you reason that it's less lucrative when the immediacy seems like it would prompt more payments.
In the case of a $2000 fridge, it's more persuasive. I might respond by revoking its network privs and paying for a service call to wipe and reset to factory. Again, I'm not going to trust the bad guy to get off my network.
In both cases, the bad guy has shown bad intent, means, and opportunity. I'm not trusting him after a payoff.
Basically while I agree with your assessment on how to respond I think the fact that ransomware is stilk so profitable means that you are the exception in this case. I posit that the same persons who reluctantly pay ransoms for their phones/tablets/desktops/laptops would be all the more quick to pay if not paying meant an additional heating or electric bill on top of it. I don't know if utilities would be sympathetic to victims but I am not confident they would be.
No, rationally there is no guarantee that payment unlocks the device or removes the attacker, but part of the attack is intending to induce an irrational state- it's likely why early ransomware pretended to be DMCA claims or FBI warnings.
(Please forgive spelling errors as I am on a tablet)
Try living in the north and having your heating fail in the middle of winter. $1000+ in emergency heating servicing is not all that uncommon.
Agreed. Its just cheaper to rip it off the wall and return it, or buy a new one. Its literally five wires and anyone who knows the basics of home repair can replace a thermostat.
I think the larger issue, at least to me, is that all these IoT devices are sensor devices. Does this thing ship with a SoC that also has a mic for voice commands? Or a wifi chip that can now start sniffing my data? Can someone now eavesdrop on you? This kind of thing can have serious repercussions for targeted individuals. Think blackmail, nation state snooping, corporate espionage, etc. If you can get root on an IoT device, you're definitely sniffing out data you shouldn't be.
Yes, the much bigger threat is taking control of these devices and using them as a pivot. We've done this for IP cameras, DVRs etc. It doesn't seem to engage the media or the public.
The ransomware has though.
Just like sex... if you don't absolutely know where something has come from or has been before, DON'T STICK IT INSIDE OF YOU (...without protection).
Consumers: If it's an sd card, a usb-stick/flash drive...whatever, don't put it inside of your hardware. Especially critical hardware such as a thermostat.
Hardware creators: Don't build slots, or at least exposed slots, for sd cards/usb drives, etc. on hardware such as thermostats, cameras, etc. I know the sales team told you the customer wants to put an image of their cat as the background of their thermostat, "it's the killer feature". Just say NO. There is absolutely no reason to do that using hardware. Build an online portal where users can upload images and then check them yourself before offering them as background choices.
Doesn't that just move the threat surface? Now instead of having to convince end users to put something on a USB stick, you have to try a password dump against your interface.
Although both ideas are nightmares for security.