1966: Smart Home Security - Revision history

SMGmsgsgd: /* Explanation */

2025-07-08T07:00:46Z

‎Explanation

76.212.74.243: /* Transcript */ grammar

2025-07-08T00:10:29Z

‎Transcript: grammar

207.237.220.21: /* Explanation */ Add note on planned obsolescence which botnet maintainers may be interested in preventing

2025-07-01T16:02:24Z

‎Explanation: Add note on planned obsolescence which botnet maintainers may be interested in preventing

2600:387:4:803:0:0:0:36: /* Explanation */ similar - voting machines, dehumidifier

2025-06-30T19:58:09Z

‎Explanation: similar - voting machines, dehumidifier

172.69.23.117: /* Explanation */

2024-01-09T05:39:33Z

‎Explanation

Theusaf: Reverted edits by Donald Trump (talk) to last revision by CRLF

2022-05-26T20:00:02Z

Reverted edits by Donald Trump (talk) to last revision by CRLF

Show changes

Donald Trump: Reverted edit by anti-crap user

2022-05-26T19:03:03Z

Reverted edit by anti-crap user

Show changes

CRLF: Reverted vandalism with User:CRLF/OneClickUndo.js

2022-05-26T18:02:38Z

Reverted vandalism with User:CRLF/OneClickUndo.js

Show changes

Donald Trump: Reverted edit by anti-crap user

2022-05-26T17:05:12Z

Reverted edit by anti-crap user

Show changes

Vandalbane: Reverted vandalism with User:CRLF/OneClickUndo.js

2022-05-23T18:37:39Z

Reverted vandalism with User:CRLF/OneClickUndo.js

Show changes

@@ Line 11: / Line 11: @@
 With the proliferation of smart appliances in recent years, there is a growing trend of hackers taking over smart "Internet of Things" devices and adding them to {{w|botnets}}. The hardware is then used for DDOS attacks, crypto mining etc. The "{{w|Mirai (malware)|Mirai}}" botnet, for example, made of over 500,000 compromised routers, refrigerators, TVs, DVRs, baby monitors, thermostats, and webcams, was used in October 2016 to take down DynDNS, one of the core infrastructure providers for the internet in North America.
-With the constant potential threat, security updates must be constantly published, and vulnerabilities must be found by the original developers and "{{w|White hat (computer security)|white hat}}" hackers (the faceless team of engineers [[Randall]] describes), before they are found and exploited by "{{w|black hat}}" hackers (not to be confused with [[Black Hat]]). At any time, these defenders could step down from their jobs, leaving devices defenseless.
+With the constant potential threat, security updates must be constantly published, and vulnerabilities must be found by the original developers and "{{w|White hat (computer security)|white hat}}" hackers (the faceless team of engineers [[Randall]] describes), before they are found and exploited by "{{w|black hat}}" hackers (not to be confused with [[Black Hat]], though he may be one of them). At any time, these defenders could step down from their jobs, leaving devices defenseless.
 The graph shows the various cases of how well things go on the y-axis, compared to how long it has been owned on the x-axis. The probability of compromise briefly dips (indicative of first rounds of security fix updates & the time window when you can easily exchange the product if you find out it's faulty) within the 1st year, then rises: the older a device/software is, the less likely it is to consistently receive security updates for protection, so they are more likely to be hacked, even in the best case. After 10 years, the device/software is most likely outdated and is not being used anymore. Companies then no longer find it profitable to continually update the product. Thus, they pull the support out, even if people are still using the device, leaving customers vulnerable. They may even add in advertisements, intentional slowdowns ({{w|planned obsolescence}}, e.g. Apple's "{{w|Batterygate}}" scandal), or outright disable or remove functionality to "encourage" the purchase of new devices.

@@ Line 20: / Line 20: @@
 ==Transcript==
-:[A graph is shown inside a frame. There is one dotted line going from the middle of the left edge, then dipping slightly before rising slowly at first, then more rapid and finally slowing its ascend down as it nears the top right corner.]
+:[A graph is shown inside a frame. There is one dotted line going from the middle of the left edge, then dipping slightly before rising slowly at first, then more rapid and finally slowing its ascent down as it nears the top right corner.]
 :[Above the frame is the title of the x-axis, and from each end of this text, there is a small line going out and then down, to indicate a time range, which is shown below with four times:]

@@ Line 13: / Line 13: @@
 With the constant potential threat, security updates must be constantly published, and vulnerabilities must be found by the original developers and "{{w|White hat (computer security)|white hat}}" hackers (the faceless team of engineers [[Randall]] describes), before they are found and exploited by "{{w|black hat}}" hackers (not to be confused with [[Black Hat]]). At any time, these defenders could step down from their jobs, leaving devices defenseless.
-The graph shows the various cases of how well things go on the y-axis, compared to how long it has been owned on the x-axis. The probability of compromise briefly dips (indicative of first rounds of security fix updates & the time window when you can easily exchange the product if you find out it's faulty) within the 1st year, then rises: the older a device/software is, the less likely it is to consistently receive security updates for protection, so they are more likely to be hacked, even in the best case. After 10 years, the device/software is most likely outdated and is not being used anymore. Companies then no longer find it profitable to continually update the product. Thus, they pull the support out, even if people are still using the device, leaving customers vulnerable.
+The graph shows the various cases of how well things go on the y-axis, compared to how long it has been owned on the x-axis. The probability of compromise briefly dips (indicative of first rounds of security fix updates & the time window when you can easily exchange the product if you find out it's faulty) within the 1st year, then rises: the older a device/software is, the less likely it is to consistently receive security updates for protection, so they are more likely to be hacked, even in the best case. After 10 years, the device/software is most likely outdated and is not being used anymore. Companies then no longer find it profitable to continually update the product. Thus, they pull the support out, even if people are still using the device, leaving customers vulnerable. They may even add in advertisements, intentional slowdowns ({{w|planned obsolescence}}, e.g. Apple's "{{w|Batterygate}}" scandal), or outright disable or remove functionality to "encourage" the purchase of new devices.
 The title text suggests that there may be some silver lining to having your device controlled by organized crime professionals: they have a vested interest in keeping your device working well enough that you keep it plugged in. So, the more organized, pragmatic attackers will actually secure it against competing attackers, especially those of a more prankster-like mindset, who would cause more noticeably malicious changes. Advanced malware in the wild does frequently block and evict competing malware, so Randall is probably right. Some IOT malware may thus provide "regular security update services" after the original manufacturers give up, some at a conceivably acceptable cost of a few cents' worth of electrical usage for a crypto-miner. However, it could very easily go horribly wrong, for instance if that miner is hiding by letting a refrigerator run 2°C higher than its outputs allege and using the energy difference to max out the processor on mining operations.

← Older revision		Revision as of 19:58, 30 June 2025
Line 16:		Line 16:

	The title text suggests that there may be some silver lining to having your device controlled by organized crime professionals: they have a vested interest in keeping your device working well enough that you keep it plugged in. So, the more organized, pragmatic attackers will actually secure it against competing attackers, especially those of a more prankster-like mindset, who would cause more noticeably malicious changes. Advanced malware in the wild does frequently block and evict competing malware, so Randall is probably right. Some IOT malware may thus provide "regular security update services" after the original manufacturers give up, some at a conceivably acceptable cost of a few cents' worth of electrical usage for a crypto-miner. However, it could very easily go horribly wrong, for instance if that miner is hiding by letting a refrigerator run 2°C higher than its outputs allege and using the energy difference to max out the processor on mining operations.		The title text suggests that there may be some silver lining to having your device controlled by organized crime professionals: they have a vested interest in keeping your device working well enough that you keep it plugged in. So, the more organized, pragmatic attackers will actually secure it against competing attackers, especially those of a more prankster-like mindset, who would cause more noticeably malicious changes. Advanced malware in the wild does frequently block and evict competing malware, so Randall is probably right. Some IOT malware may thus provide "regular security update services" after the original manufacturers give up, some at a conceivably acceptable cost of a few cents' worth of electrical usage for a crypto-miner. However, it could very easily go horribly wrong, for instance if that miner is hiding by letting a refrigerator run 2°C higher than its outputs allege and using the energy difference to max out the processor on mining operations.
		+
		+	Similar issues are mentioned in [[463: Voting Machines]], and [[3109: Dehumidifier]].

	==Transcript==		==Transcript==

@@ Line 11: / Line 11: @@
 With the proliferation of smart appliances in recent years, there is a growing trend of hackers taking over smart "Internet of Things" devices and adding them to {{w|botnets}}. The hardware is then used for DDOS attacks, crypto mining etc. The "{{w|Mirai (malware)|Mirai}}" botnet, for example, made of over 500,000 compromised routers, refrigerators, TVs, DVRs, baby monitors, thermostats, and webcams, was used in October 2016 to take down DynDNS, one of the core infrastructure providers for the internet in North America.
-With the constant potential threat, security updates must be constantly published, and vulnerabilities must be found by the original developers and "{{w|White hat (computer security)|white hat}}" hackers (the faceless team of engineers [[Randall]] describes), before they are found and exploited by "{{w|black hat}}" hackers. At any time, these defenders could step down from their jobs, leaving devices defenseless.
+With the constant potential threat, security updates must be constantly published, and vulnerabilities must be found by the original developers and "{{w|White hat (computer security)|white hat}}" hackers (the faceless team of engineers [[Randall]] describes), before they are found and exploited by "{{w|black hat}}" hackers (not to be confused with [[Black Hat]]). At any time, these defenders could step down from their jobs, leaving devices defenseless.
 The graph shows the various cases of how well things go on the y-axis, compared to how long it has been owned on the x-axis. The probability of compromise briefly dips (indicative of first rounds of security fix updates & the time window when you can easily exchange the product if you find out it's faulty) within the 1st year, then rises: the older a device/software is, the less likely it is to consistently receive security updates for protection, so they are more likely to be hacked, even in the best case. After 10 years, the device/software is most likely outdated and is not being used anymore. Companies then no longer find it profitable to continually update the product. Thus, they pull the support out, even if people are still using the device, leaving customers vulnerable.