Hacker News Reader

Comment by cek | Hacker News Reader

Seems like it would be easy to use these tools to brick all these cameras/dvrs, saving everyone (but their owners) a lot of headache.

View on HN

This is obviously horribly illegal and unethical, but it does sort of appeal to that same small part of my brain that longs for things like violent proletariat revolution. Imagine if some greyhat security outfit intentionally bricked tens of thousands of these devices. Buyers would be pissed, go to the manufacturer for recompense, possibly to the level of bankruptcy, and there would finally be some incentive for taking IoT security seriously.

I'm not saying someone should do it... but I'm not saying someone shouldn't do it.

Which brings the question:

Are the manufacturers stupid enough to put the items on the internet AND embed a self-destruct command...

I don't think there is a self-destruct command ever from what I've heard. There are plenty of chips with undefined behavior that can be exploited to essentially act as a self-destruct. Failing that I assume there are ways to kill it by overrunning the device's normal mechanisms.

These attacks are showing that's it's trivial to achieve remote-code-execution on many of these devices. So in a way, yes, they do have self-destruct built in.

Simple connect to one, and then overwrite the boot partition. Or rm -rf /. Or even just use the firewall to block all inbound and outbound connections (an IP camera isn't very useful if you can't view the feed).

The scarier thought to me is that this many cameras installed in houses, businesses, bedrooms, etc. are being commandeered. That's a huge problem for privacy, let alone being used as botnets on the side.

You are correct. I know there are sites out there that even aggregate camera feeds, although the more ethical ones remove any feeds where there may be privacy concerns.

Frankly, I would NEVER install such a device in my house. The engineering on many is (almost?) criminally flawed.

Could it be deemed an act of self defense if done in the middle of such an attack? We have all these laws where we are allowed (in the US) to shoot somebody and kill them if they invade our home or business. If I am a business owner, why could I not then "kill" the device that is attacking me? Is it any different than killing an attacking dog that belongs to someone else? Interesting thought experiment in the very least...

This is something that has occurred to me too. It would also -hopefully- result in large, class action lawsuits against the manufacturers for producing products so insecure that they got mass bricked.

I would be all for such... preventative action... if it wouldn't also hurt the consumers. Unfortunately it is the end users that would lose.

Reply on news.ycombinator.com