Mi Case Verde / Vera Hacked, who's next?

[Automate]

Xipiter has started a new series of articles on hacking embedded / IoT devices.  Their first article was just an introduction http://www.xipiter.com/musings/the-insecurity-of-things-part-one
 
The follow up articles will cover their victims:
 

• A "smart" smoke alarm
• A used ATM
• A  "standalone" webcam (A webcam not requiring a computer).
• A "smart home" hub
• Another "smart home" hub
• A "smart" thermostat
• Another "smart" thermostat
• A home router/access point
• A home Networked Area Storage (NAS)
• A "smart" networked wall outlet
• A "game console"
• A Point of Sales System
• and an Android tablet

 

 
Their first victim is the Mi Case Verde / Vera.  http://www.xipiter.com/musings/the-insecurity-of-things-part-two
 
Both articles published so are very well written.  I look forward to following the whole series as it is released.

 

[drvnbysound]

Any (read as ALL) internet facing devices are subject to be hacked in some way or another. The only thing that will completely remove the risk is to physically disconnect them.
 
Similarly, I see that a NAS is also listed above, which is not all that unlike "cloud" storage. Any data that you store in the "cloud" is also subject to be "hacked". If you don't want someone to have the information, don't store it where someone else can get it.

 

[Automate]

Any (read as ALL) internet facing devices are subject to be hacked in some way or another. The only thing that will completely remove the risk is to physically disconnect them.

 
True, but a complete air-gap separation of your home network/automation from the Internet severely limits its functionality.  I'm not willing to completely give up an internet connection since some of my automation algorithms are dependent upon it (example, the current weather forecast).  While nothing is 100% safe, it's all a matter of being aware and managing the security risk.
 
This Vera vulnerability certainly reminds us of the security issues with "cloud" services.  I would rather keep security under my own control with things like VPN but this is not an option for all users.

 

[video321]

I read the news release about Vera vulnerabilities a while ago. However, the first thing I did when I got the box years ago was to disable all communication to their servers. Further, I never store alarm codes on Vera or any app that accesses it.
 
It's hard to keep devices isolated, while still allowing necessary communication between them.
Still, I created an IoT VLAN to help out. The first device in it was my Ooma VoIP box which creates a tunnel to their servers - obviously this one can't be disabled

 

[pete_c]

Personally I am selfish and want to take but not give anything back.  Its just getting harder these days.  BUT it still can be done.

 

[drvnbysound]

True, but a complete air-gap separation of your home network/automation from the Internet severely limits its functionality.  I'm not willing to completely give up an internet connection since some of my automation algorithms are dependent upon it (example, the current weather forecast).  While nothing is 100% safe, it's all a matter of being aware and managing the security risk.
 
This Vera vulnerability certainly reminds us of the security issues with "cloud" services.  I would rather keep security under my own control with things like VPN but this is not an option for all users.

 
Absolutely. I'm not at all saying that I don't have internet facing devices - I do as well.

 

[ddennerline]

The vulnerabilities described in MiCasaVerde security research paper where quite basic. The HTTP_DotDot vulnerability could easily be found using one of many security scanners (i.e., Nessus).  The “interns” probably didn’t spend too much time finding the described vulnerabilities. Until network security is taken seriously, the manage your life from the “cloud” value proposition will be difficult to embrace.
 
VPN and privilege isolation (VLANs) are one way to minimize the fallout from IoT appliances’s insecurity. But because these services (Weather, Video, Energy Consuption, ...) all want to play together nicely without regard to boundaries, each device must at least have some level of “good enough” security embedded within.