Handy guide to the Olympic events

"Smart" Thermostats hacked

More news from the Internet of (Insecure) Things:

Last week, Andrew Tierney and Ken Munro from Pen Test Partners demoed their proof-of-concept ransomware for smart thermostats, which relies on users being tricked into downloading malware that then roots the device and locks the user out while displaying a demand for one bitcoin. 

The researchers have not released sourcecode or the name of the manufacturer. They say that they gained vital intelligence by examining the manufacturer's regulatory filings with the FCC, and that they could design an attack that turned heating or cooling to arbitrary setpoints, ran both at once, or rapidly power-cycled them, possibly causing damage.

This seems to be not just bad coding and a grotesque inattention to security, but architectural decisions that seem to guarantee failure:

* First, the device has no interlocks to prevent unsafe or unwise settings -- nothing to limit the heating or cooling, or simultaneous air-conditioner/furnace operation, or repeated high-speed power-cycling -- which means that software defects, as well as malicious software, can do significant damage that might be prevented with more thoughtful systems design 

* Second, the business-model for smart thermostats overwhelmingly assumes that users are hostile parties, and protects against them with DRM of some kind. Some thermostats are designed to be sold to power companies who'll subsidize their installation in customers' homes so that the power authority can tweak power consumption to reduce load at peak times -- these sales are much easier to make if the vendor can assure the power company that there are no apps that allow users to override these tweaks, and no apps that enable this will be approved for the device (and the device will not run unapproved apps).

Interestingly, the vendor is not named, so it's not possible for consumers to make informed decisions on what product not to purchase:

This matters because a device with DRM poses significant legal risks to security researchers. Anti-circumvention laws like the section 1201 of the DMCA and European laws implementing Article 6 of the EUCD have been invoked to make civil and criminal threats against security researchers, on the theory that information about defects in a device will assist people who want to bypass the DRM, which is banned under these laws.

Government is what we choose to do together.  Like forcing you to only have insecure products to purchase.  Behold your Philosopher Kings.

Free retro games!

The Internet Archive now has a long list of games developed for the Commodore Amiga available for free play.  All you need is a Browser to get access to King's Quest II, Hunt for Red October, Pac Man, Galaga, and other 1980s nostalgia.

Knock yourselves out.

Bluetooth door locks - insecure and staying that way

Ah, the "Internet Of Things" - ubiquitous insecurity.  Not just coming to your house, but coming to your front door:

Many Bluetooth Low Energy smart locks can be hacked and opened by unauthorized users, but their manufacturers seem to want to do nothing about it, a security researcher said yesterday (Aug. 6) at the DEF CON hacker conference here. 

Researcher Anthony Rose, an electrical engineer, said that of 16 Bluetooth smart locks he and fellow researcher Ben Ramsey had tested, 12 locks opened when wirelessly attacked. The locks — including models made by Quicklock, iBlulock, Plantraco, Ceomate, Elecycle, Vians, Okidokey and Mesh Motion — had security vulnerabilities that ranged from ridiculously easy to moderately difficult to exploit. 

"We figured we'd find vulnerabilities in Bluetooth Low Energy locks, then contact the vendors. It turned out that the vendors actually don't care," Rose said. "We contacted 12 vendors. Only one responded, and they said, 'We know it's a problem, but we're not gonna fix it.'"

None of these will ever come to my front door, and I recommend the same to you.

Security: not an afterthought - it wasn't thought of at all.

It looks like the Russians didn't hack the DNC

I've been skeptical, and posted this a little while back:

There are other plausible actors who would be more embarrassing to the Democrats.  It's not beyond belief that a [DNC] IT Administrator was a closet Bernie Bro who caught a whiff of what was going on, and leaked the emails to Wikileaks.

And look at this:

Julian Assange seems to suggests on Dutch television program Nieuwsuur that [DNC staffer] Seth Rich was the source for the Wikileaks-exposed DNC emails and was murdered. 

... 

From the video:

Julian Assange: Whistleblowers go to significant efforts to get us material and often very significant risks. As a 27 year-old, works for the DNC, was shot in the back, murdered just a few weeks ago for unknown reasons as he was walking down the street in Washington. 

Reporter: That was just a robbery, I believe. Wasn’t it? 

Julian Assange: No. There’s no finding. So… I’m suggesting that our sources take risks.

No doubt the crack investigators at the FBI will be on this in a jiffy.  And no doubt the ruling ultimately will be that no prosecutor would file charges ...

What they promise vs. what they deliver

This is God's own truth.

Why does "Green" power kill so many people?

The Department of Veteran's Affairs repeatedly delayed veteran's health care, killing many.  The reason, we are told, is because they didn't have a big enough budget.  So what did they have budget for?

The Department of Veterans Affairs has spent more than $408 million to install solar panels on its medical facilities in recent years, despite many of the projects experiencing significant delays and some of the systems not becoming operational at all.

Hundreds of millions of dollars flowing not to health care for veterans, but to Solyndra and other "Green" companies feeding at the public trough.

Does the VA even know what their mission is?  I mean, it's in their Agency's name and everything.

Hat tip: Rick via email.

Hack the Vote!

This is my surprised face:

“People weren’t thinking about voting system security or all the additional challenges that come with electronic voting systems,” says the Brennan Center’s Lawrence Norden. “Moving to electronic voting systems solved a lot of problems, but created a lot of new ones.”

The list of those problems is what you’d expect from any computer or, more specifically, any computer that’s a decade or older. Most of these machines are running Windows XP, for which Microsoft hasn’t released a security patch since April 2014. Though there’s no evidence of direct voting machine interference to date, researchers have demonstrated that many of them are susceptible to malware or, equally if not more alarming, a well-timed denial of service attack. 

“When people think that people think about doing something major to impact our election results at the voting machine, they think they’d try to switch results,” says Norden, referring to potential software tampering. “But you can do a lot less than that and do a lot of damage… If you have machines not working, or working slowly, that could create lots of problems too, preventing people from voting at all.”

The extent of vulnerability isn’t just hypothetical; late last summer, Virginia decertified thousands of insecure WinVote machines. As one security researcher described it, “anyone within a half mile could have modified every vote, undetected” without “any technical expertise.” The vendor had gone out of business years prior.

Stalin would have had them all shot.

(via)

Monday

OK, that would be a time I would take a self-driving car

Tesla drives man to hospital, saves his life:

A Missouri man says his Tesla helped saved his life by driving him to the hospital during a life-threatening emergency. 

Joshua Neally is a lawyer and Tesla owner from Springfield, Missouri, who often uses the semi-autonomous driving system called Autopilot on his Tesla Model X. 

The system has come under fire after it was involved in a fatal Florida crash in May, but Neally told online magazine Slate that Autopilot drove him 20 miles down a freeway to a hospital, while Neally suffered a potentially fatal blood vessel blockage in his lung, known as a pulmonary embolism. The hospital was right off the freeway exit, and Neally was able to steer the car the last few meters and check himself into the emergency room, the report said.

I don't like the lack of security in self-driving cars, but I like the idea of death even less.

An out of this world birthday

At the Air and Space Museum with #1 Son and #2 Son.



Haven't been here for ages and had forgotten just how spectacular it is.

Nerds of a feather flock together

This is a Royal Command blog post, with mint julips made by the Queen Of The World, from Castle Borepatch's Gentlemen's Smoking Room.



She says that she'll tell me when it is allowed to smoke ...

Tractor pull

Howard County Fair.

Busy now

#1 Son and #2 Son are visiting Castle Borepatch, so I'm pretty much away from the 'net.  It sure is nice to see them again.  And co-blogger ASM826 will visit later, so it's a very social weekend.

I hope your weekend is as nice as mine.

True that

The United States Department of Being Behind The Times

Shot:

NIST is no longer recommending two-factor authentication systems that use SMS, because of their many insecurities.

(this is where when you log in, the server sends a text to your phone with a one time number to enter as part of the login process)

Chaser:

The SSA said all new and existing ‘my Social Security’ account holders will need to provide a cell phone number. The agency said it will use the mobile numbers to send users an 8-digit code via text message that needs to be entered along with a username and password to log in to the site.

I'm a fan of using SMS text messages to add security to the login routine.  The risk that NIST is pointing out is that as more phones move to Voice Over IP (VoIP), it is getting easier to spoof the SIP number.  They are probably right that this is an emerging threat, but for now I still recommend doing it (and in fact I do it all the time).

Heh

Chris Lynch sees something funny.

So is the F-35 actually ready for combat?

The Air Force says yes.  The rest of the world takes a "wait and see" approach to this gold plated fiasco.

Well OK then

Would you use that ATM machine?

Sweet Jesus, Mary, and Joseph.

Protip to all readers: don't use an ATM that looks like this.