909
Man Alarmed to Discover His Smart Vacuum Was Broadcasting a Secret Map of His House (futurism.com)
submitted 10 months ago by to c/technology@lemmy.world
188 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] -3 points 10 months ago (1 child)

yes and no.. i agree with the sentiment, but with root you can extract wifi credentials and various other secrets… you shouldn’t be able to get these things even when you have physical access to the device… the root access itself isn’t the problem

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 10 months ago* (1 child)

    If I broke into your home, why TF would I carefully take apart your robot vacuum in order to copy your wifi credentials‽

    Also, WTF other "secrets" are you storing on your robot vacuum‽

    This is not a realistic attack scenario.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 10 months ago (1 child)

    you’re on programming.dev so i assume you know that secrets is a generic term to cover things like your cloud account login (whatever form that may take - a password, token, api key, etc) for the robot vacuum service and you’re being intentionally obtuse

    it’s a realistic attack scenario for some people - think celebrities etc, who might be being targeted… if someone knows what type of vacuum you have, it’s not “carefully take apart” - it’d take 30s, and then you have local network access which is an escalation that can lead to significantly more surveillance like security cameras, and devices with unsecured local access

    just because it doesn’t apply to you doesn’t mean it doesn’t apply to anyone… unsecured or default password root access, even with physical access, is considered a security issue

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 10 months ago* (1 child)

    Listen, if someone gets physical access to a device in your home that's connected to your wifi all bets are off. Having a password to gain access via adb is irrelevant. The attack scenario you describe is absurd: If someone's in a celebrity's home they're not going to go after the robot vacuum when the thermostat, tablets, computers, TV, router, access point, etc are right there.

    If they're physically in the home, they've already been compromised. The fact that the owner of a device can open it up and gain root is irrelevant.

    Furthermore, since they have root they can add a password themselves! Something they can't do with a lot of other things in their home that they supposedly "own" but don't have that power (but I'm 100% certain have vulnerabilities).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 10 months ago (1 child)

    they're not going to go after the robot vacuum when the thermostat, tablets, computers, TV, router, access point, etc are right there.

    … and all of those things should be equally protected

    they’re going to go for the easiest thing to extract information or escalate

    since they have root they can add a password themselves!

    the most absurd thing is assuming that an end-user is going do add a root password to a serial interface

    i’m not saying end users shouldn’t be able to gain root somehow, simply that it shouldn’t be wide open by default… there should be some process, perhaps involving a unique password per device

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 10 months ago (1 child)

    Having a unique password per device is best practices. IoT vendors should be doing that regardless of whether or not they're giving the end user root.

    There's supposed to be a regulation demanding an IoT "nutrition label" that has that very thing in its list of items. I wonder what happened to that?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 10 months ago

    Having a unique password per device is best practices.

    yup that’s all i’m getting at… this vacuum has unprotected access to ADB, which another user likened to root access, and i just think that in circumstances that are root-like, even physical access shouldn’t grant unprotected root

  • permalink
  • fedilink
  • source
  • parent