> Light Commands is a vulnerability of MEMS microphones that allows attackers to remotely inject inaudible and invisible commands into voice assistants, such as Google assistant, Amazon Alexa, Facebook Portal, and Apple Siri using light.
> In our paper we demonstrate this effect, successfully using light to inject malicious commands into several voice controlled devices such as smart speakers, tablets, and phones across large distances and through glass windows.
I tried to adjust the time on my alarm clock. I failed.
> For some reason, my alarm clock requires that I install an app on my phone. And the app required me to create an account.
> I’m going to repeat that: In order to set my alarm clock, I had to create an account with the clock manufacturer.
Samsung TVs should be regularly virus-checked, the company says
> A how-to video on the Samsung Support USA Twitter account demonstrates the more than a dozen remote-control button presses required to access the sub-menu needed to activate the check. It suggested users should carry out the process “every few weeks” to “prevent malicious software attacks”.
eyeDisk. Hacking the unhackable. Again
> So, a lot of complex SCSI commands were used to understand the controller side of the device, but obtaining the password/iris can be achieved by simply sniffing the USB traffic to get the password/hash in clear text. The software collects the password first, then validates the user-entered password BEFORE sending the unlock password. This is a very poor approach given the unhackable claims and fundamentally undermines the security of the device.
The company behind the $16,000 AI-powered laundry-folding robot has filed for bankruptcy
> Backed by companies like Panasonic and Daiwa House, Laundroid had ambitious dreams to be the ultimate wardrobe organizer for the entire household. It had multiple cameras and robotic arms to scan a load of laundry, and used Wi-Fi to connect to a server that would analyze the clothing using AI to figure out the best way to fold it. A companion app was supposed to be able to track every piece of clothing that went through Laundroid, and categorize the clothes by household member. One load of laundry would take a couple hours to be folded, as each T-shirt took about five to ten minutes.
> That’s how it was supposed to work in theory, anyway — when I tested it out at CES 2018 with my own T-shirt, the machine ate it up and Laundroid engineers had to work for about 15 minutes to pry it out. The explanation was that its cameras couldn’t recognize my black shirt, only the brightly colored demo shirts they’d prepared on hand.
IoT Security Bills Use Federal Spending as Leverage
> The bill includes a number of separate provisions, but the one that stands to have the biggest potential effect on IoT security is the establishment of a set of standards for security in connected devices, standards that will be developed by the National Institute of Standards and Technology. The draft legislation doesn’t set out too many specifics for what those security standards would be, but dictates they will include four separate areas: secure development, identity management, patching, and configuration management. Under the language in the bill, vendors selling IoT devices to federal agencies will have to meet the NIST standards for those areas.
The Internet of Food
> You know something you can’t get through the internet’s wires, at least not on its own? Food. We’ve been working on it for years, but no, we’re not at the point where we can deliver nourishment directly via the series of tubes. But food has always been something of a means to an end—a way of driving the internet forward, making it something people would actually like to use.
Plus tons of links.
> We’ve performed the first announcement in this experiment yesterday,
and, despite the announcement being compliant with BGP standards, FRR
routers reset their sessions upon receiving it.
And then: https://mailman.nanog.org/pipermail/nanog/2019-January/099142.html
> We have canceled this experiment permanently.
Everybody can relax. The internet is safe now.
CES 2019: A Show Report
> On display this year was connectivity and integration for consumers based on about 10 years of incremental and sometimes hardly noticed baby steps. There are three big developments that are enabling the vast majority of scenarios on display at CES 2019:
> Any screen/speaker can play any streaming media.
> Any device can be turned on/off/controlled by voice.
> Any device can have a radio and connect to any other device with a radio.
Fun times ahead.
Lots of pictures.
The curious case of the Raspberry Pi in the network closet
> None of them knew anything about this so I asked my IT colleagues and they were as baffled as I was. I heard of people getting paid to put things like this in places they shouldn’t and for this reason I was very interested in finding out what it actually does.
The Internet of Unprofitable Things
> Uncle Andrew wants to tell you a festive story. The NTPmare shortly after Christmas.
A look at home routers, and a surprising bug in Linux/MIPS
> We reviewed 28 popular home routers for basic hardening features. None performed well. Oh, and we found a bug in the Linux/MIPS architecture.
California's bad IoT law
> It’s based on the misconception of adding security features. It’s like dieting, where people insist you should eat more kale, which does little to address the problem you are pigging out on potato chips. The key to dieting is not eating more but eating less. The same is true of cybersecurity, where the point is not to add “security features” but to remove “insecure features”. For IoT devices, that means removing listening ports and cross-site/injection issues in web management. Adding features is typical “magic pill” or “silver bullet” thinking that we spend much of our time in infosec fighting against.
can't turn on noise cancellation on my headphones on a plane
> because I have to agree to terms and conditions... that aren’t available offline
noticed a rogue AP on the network
> tracked it down to this water heater in a utility clpset
Q: Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible?
> A: Because Keynote Speakers Make Bad Life Decisions and Are Poor Role Models
> Some people enter the technology industry to build newer, more exciting kinds of technology as quickly as possible. My keynote will savage these people and will burn important professional bridges, likely forcing me to join a monastery or another penance-focused organization. In my keynote, I will explain why the proliferation of ubiquitous technology is good in the same sense that ubiquitous Venus weather would be good, i.e., not good at all.
your printer is part of a flaming botnet
All hail the hacker god.
WDMyCloud Multiple Vulnerabilities
> Several serious security issues were uncovered during my research. Vulnerabilities such as pre auth remote root code execution, as well as a hardcoded backdoor admin account which can NOT be changed. The backdoor also allows for pre auth remote root code execution on the affected device.
Your home was not so secure after all
> The thing is, a lot of time there is really no way for people to check whether a thing is really secure or not. And for HomeKit, it turned out not to be so secure after all. HomeKit didn’t check the sender of remote message before processing the request, which ended up allowing potentially anyone to remotely control HomeKit accessories in the home.
Additional TLS 1.3 results from Chrome
Your daily everything is terrible and will never be fixed email.
> the uptake of firmware for printers is typically poor.
> (Lastly, we note that in the paper “On the Practical Exploitability of Dual EC in TLS Implementations”, the authors remarked that they had no evidence that a version of BSAFE with extended_random support ever shipped. TLS 1.3 appears to have tripped over it.)