Hacker News Reader

Comment by segmondy | Hacker News Reader

For once, I really hope the US govt would do something about these sort of devices. I bought a digital picture frame from amazon. It's listed as having an SD card. When I tried to set it up. It wanted me to install an android app, and that was the only way to save pictures to the SD card. To connect the device to Wifi, then use my phone to send picture to the device. So nothing only would I have an unknown device in my network, collecting and reporting who knows what, it would be on my cell phone as well. I returned it. Imagine if there was 100k or 500k of these trojan horse devices in the US. It's truly scary what it means for US's national security.

View on HN

Nothing to imagine, I am certain that there are 100s of thousands of such devices, and even if their design intent is not malicious they are typically security nightmares.

Its very odd you are being downvoted. You're not incorrect.

It doesn't matter if the intent doesn't seem malicious. And if they had nothing to hide, why weren't they upfront about the data collection? Remember when we thought having all those Facebook "Like" buttons on every website was harmless until we learned the level of which everybody was being tracked without consent?

This is China's typical playbook. Purposely collect data in seemingly harmless ways, or intentionally leave wide open security flaws that they can exploit in the future. And when they get caught it's an "oops sorry, we'll fix it right away".

The worst part is that there is no consequence for this behavior. Google, the EU, and/or FTC should be lodging fines.

> It's truly scary what it means for US's national security.

“national security” is the magic phrase to get the US government to do anything

> Imagine if there was 100k or 500k of these trojan horse devices in the US. It's truly scary what it means for US's national security.

Imagine saying this with a straight face as an American.

I don't think it matters at all for US national security. It would be hard to imagine that the NSA doesn't listen to all inbound and outbound traffic in the US already and other nations don't do the same. Nationally sensitive information isn't going to be presented anywhere near these devices, thats still a "come to the office" industry unless you somehow have the clout to get a scif installed in your basement.

The metadata around peoples behaviors could be a very valuable source of operational intelligence when targeted at specific people.

For example: Imagine if you could track the security teams availability and behavioral patterns. You could infer when the business has been hacked or there is going to be a release they have been hacked, you could trade off this information for profit.

It would take some serious hollywood plot logic to come up with some actual business decision even if you had all of this information in front of you. Are you going short based on what time the security team is clocking into work or something? They could get hacked but you might have no idea when that will finally affect the stock price if at all. You'd be way better off just bribing someone from that company to tell you whatever, than to come up with some sort of model that actually indicates something reliable based on this metadata.

> You'd be way better off just bribing someone from that company to tell you whatever, than to come up with some sort of model that actually indicates something reliable based on this metadata.

You'd be better off hacking the company yourself if you wanted effectiveness.

Let me give you a lower stakes example, I can figure out when you're at work to know when to rob your place via when you post on instagram. Lower stakes but same theory.

That seems a lot less reliable and far more risky than just casing a house and seeing when the cars leave, since people often post on instagram after the fact. That's the thing with a lot of these digital "what if" scenarios. The confidence you have in your model is lower compared to old fashioned techniques that work well enough for far cheaper.

I agree, we can debate the "this is easier scenarios all day long". One has a cheaper but perhaps less reliable indicator.

Here is an example of an IOT owned by a security team being abused ( https://practical-tech.com/2023/06/13/how-an-amazon-fire-kid... ), Admittedly the attack vector is a little different but its not insane to think about the IOT software being abused.

Reply on news.ycombinator.com