This is not what you expect.
Matthew Garrett:
I’m in London for Kubecon right now, and the hotel I’m staying at has decided that light switches are unfashionable and replaced them with a series of Android tablets.
One was embedded in the wall, but the two next to the bed had convenient looking ethernet cables plugged into the wall. So.
I managed to borrow a couple of USB ethernet adapters, set up a transparent bridge (brctl addbr br0; brctl addif br0 enp0s20f0u1; brctl addif br0 enp0s20f0u2; ifconfig br0 up) and then stuck my laptop between the tablet and the wall. tcpdump -i br0 showed traffic, and wireshark revealed that it was Modbus over TCP. Modbus is a pretty trivial protocol, and notably has no authentication whatsoever. tcpdump showed that traffic was being sent to 172.16.207.14, and pymodbus let me start controlling my lights, turning the TV on and off and even making my curtains open and close. What fun!
And then I noticed something. My room number is 714. The IP address I was communicating with was 172.16.207.14. They wouldn’t, would they?
I mean yes obviously they would.
Internet of Things. What could go wrong?
Internet of Things. Making the FBI happy with minimum effort.
The problem there?
Not “Android lightswitches”.
Not “the Internet of Things”.
But “Modbus … has no authentication whatsoever” [and is also evidently not being used in an SSL wrapper].
(Remember, people have been doing wireless IoT home automation for ages … but those use modern protocols that are AES encrypted and have authentication.)
Considering that Marriott just got whacked with a $28 million judgement for a perv looking in through a peephole, any American hotel chain that implements a system this bad is just waiting to make a bunch of lawyers rich!
Actually, the problem here is whomever spec-ed out the system, or more fundamentally the people who approved the proposal.
Remarkable.
<
blockquote …………………………………………………………………………………………………>”my .friend’s mate Is getting 98$. HOURLY. on the internet.”….
<
blockquote>two days ago new Mc.Laren. F1 bought after earning 18,512$,,,this was my previous month’s paycheck ,and-a little over, 17k$ Last month .,3-5 h/r of work a days ..with extra open doors & weekly. paychecks.. it’s realy the easiest work I have ever Do.. I Joined This 7 months ago and now making over 87$, p/h.Learn. More right Hereo!510➤➤➤➤➤ http://GlobalSuperEmploymentVacanciesReportsJobs/GetPaid/98$hourly…. .❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:❖:❦:::::o!510……..,…
The people who approved these probably are just suits with no tech knowledge beyond knowing how to tweet.