cybergibbons

The problem is, people are using solely what3words for location. Every single call recording to emergency services doesn't use any other information.

The odds are around 1 in 24 that you hit one of these squares in London.

Yeah, that's not true.

https://cybergibbons.com/security-2/why-what3words-is-not-su...

Yes, that's pretty much the definition of incorrect.

Old skool! Those were the days :)

A design requirement of the app is it works offline.

Your surface area is totally incorrect.

Only with a ridiculously long word list containing plurals and words people can't spell.

Yeah, multiple MRT members have contacted me to say this is a real struggle. If someone is on the move, it's virtually impossible to work out what direction they are going.

It's promoted for use in search and rescue, so other bands are in use.

Why 3 words? Why not 4?

You would still get high densities of cells which share two words being present close together, leading to any issue with the third word causing a confusing location.

No, I went from the patent and using the API instead:

https://twitter.com/cybergibbons/status/1386344576856825858

https://twitter.com/cybergibbons/status/1386393951276609539

https://twitter.com/cybergibbons/status/1386867562554793984

https://twitter.com/cybergibbons/status/1387164507705860097

The word list already is 40k long. That's beyond most people's vocab and includes really awkward to spell words.

IMO, if the solution is to use words, then What4Words would have had a word list of less than 3000, resulting in a word list with less confusable words and more accessible to children and people who struggle to read or write.

Two reasons: 1. It needs to be reversible so you can go from words to lat/lon. 2. They wanted to use shorter words in cities, so the distribution of low n didn't want to cover the full range of m. (this could probably be solved by some sort of banding though).

Yes, sorry, added that bit on my phone when out and about and made a mistake. Corrected.

RTCs are actually quite rare, especially in a lot of the lower power RF SoCs.

Drift would also be an issue - most move at least 10 minutes a year. That's with good temperatures, not being left in a hot car or at body temp.

If you could solve the drift issue then it would be pretty good I think, it's an interesting idea.

Is CTR more common?

I've added a section on padding oracle attacks towards the bottom.

I don't think there's a significant different in ease of understanding between most of the modes. I used CBC as it's one of the most common and familiar modes, and because it's where I have seen this issue many times. I don't see CTR used in the wild very often.

I also tend to use CBC for other demos as well, so it makes things consistent.

I considered using a padding oracle attack in the post, but it's aimed at a very basic level of understanding. I find padding oracles are much harder to describe to newcomers.

Also, the XOR malleability issue is present in lots of block modes of operation.

Why do you need to spend money to use HTTPS with IoT?

Less well tested than OpenSSL, but historically has been relatively secure.

Specifically, in the case of the firmware running on the Trådfri gateway, it already supports TLS.

No, unfortunately not. We had to do it all black box as it was on sale or return, so couldn't inspect the firmware to find vulns.

It was runnign Tizen, which makes things a lot harder than Android.

We did get some minor vulns on the LG air conditioner.

I did the work on this.

Yes, the much bigger threat is taking control of these devices and using them as a pivot. We've done this for IP cameras, DVRs etc. It doesn't seem to engage the media or the public.

The ransomware has though.

I did the work on this.

It wasn't really meant to be a practical attack. It was largely because there has been speculation around this for the last few years, so we thought we'd actually do it.

It's largely to raise awareness that IoT security is poor and we don't have the control to do much about it.

Yes - his GitHub actually had the repo for this in the past.

Someone reported the issue on there before I found it.

Yes, the device has reference to Esee and IIRC it sends XML data to their server.

I didn't look into that as the other stuff meant it was game over.

Thanks, updated the post.

Possibly.

Part of the problem though is that there is not a full toolchain. You could replace the DVR app, but the OS is still going to be crap.

I had a very quick go at updating the firmware with Juantech and it failed. There is some check in place to prevent this.

Yeah, I tried juantech. Not the password, unfortunately.

openssl passwd -salt a0 juantech a0hDjN2cjQ1hI

I've bruteforced all alphanumeric for the descrypt hash, and not found anything. Trying the whole space now, but it will be weeks.

I think mine was regularly rebooting, but I've put it away so need to check.