Insteon Vulnerability Exposed

[tmbrown97]

Hopefully this hasn't been posted already; this was pointed out by another member in the CT Chat room:
 
http://www.forbes.com/sites/kashmirhill/2013/07/26/smart-homes-hack/
 
Goes to show that you need to be diligent in securing your network and be very cautious about what you open up through your router.

 

[JonW]

Is it really hacking or even a vulnerability that someone can access these systems?  The fact that the docs say you should assign a username & password if you are putting it on the internet clearly indicate that it is the users responsibility to secure their system.  Sure, it would have been better to force the username/pw by default, but the real problem is non-tech users.

 

[wuench]

The fact that it is searchable via search engines, though, is a vendor issue.  All of these consumer type devices should include robots.txt files.

 

[apostolakisl]

Didn't even know that "HUB" existed.  ISY is a bit tougher to hack, though no system is unhackable.

 

[linuxha]

Didn't even know that "HUB" existed.  ISY is a bit tougher to hack, though no system is unhackable.

This isn't really about hacking Insteon as much as it is about accessing the application remotely (hardly hacking except when convenient for the law)

 

[tmbrown97]

Hack wasn't my word - you know how these articles go...  The point was there was an issue with some of this insteon hardware, and a lot of people come here to talk Insteon (and plenty who have limited networking knowledge), so it seemed worth mention to me.

 

[apostolakisl]

hack 1  (h

k)

v. hacked, hack·ing, hacks
v.tr.
1. To cut or chop with repeated and irregular blows: hacked down the saplings.
2. To break up the surface of (soil).
3.
a. Informal To alter (a computer program): hacked her text editor to read HTML.
b. To gain access to (a computer file or network) illegally or without authorization: hacked the firm's personnel database.

 
See definition 3b.  Hack is exactly the word you would want to use to describe the situation where an un-authorized party gained control of your Insteon network.  The fact that the security to prevent the un-authorized access is slim to none is irrelevant, it is still un-authorized.

 

[gatchel]

I think the point here is people get too "stupid" when it comes to cool novelties like controlling your hot tub and bragging to your friends about it....
 
If you don't take the time to learn about what you're installing and how to secure it then you deserve the extremely high electric bill, period!
 
I had on old tech school teacher thal told me one thing, learning costs you money, no matter what. You can pay someone to teach you or you can pay someone to do it for you and watch, or you can pay to do it right when you screw it up.
 
If you are trying to open up ports, etc and you havent read a networking for dummies book or at least spent some time educating yourself on how the IP world works then you are the only one to blame.

 

[gatchel]

The fact that it is searchable via search engines, though, is a vendor issue.  All of these consumer type devices should include robots.txt files.

 
 
This has always been an issue with web connected IP devices like IP cameras and such. All you have to do is look up how to do an "inurl:" search.
 
Its not a vendor issue IMHO. It's called securing your devices with a password other than the default.

 

[apostolakisl]

I think the point here is people get too "stupid" when it comes to cool novelties like controlling your hot tub and bragging to your friends about it....
 
If you don't take the time to learn about what you're installing and how to secure it then you deserve the extremely high electric bill, period!
 
I had on old tech school teacher thal told me one thing, learning costs you money, no matter what. You can pay someone to teach you or you can pay someone to do it for you and watch, or you can pay to do it right when you screw it up.
 
If you are trying to open up ports, etc and you havent read a networking for dummies book or at least spent some time educating yourself on how the IP world works then you are the only one to blame.

 
Yup.
 
Although your teacher didn't have cocoontech.  You can get lots of free "learnin" right here.  I guess time is money, so maybe it's not free.