Cloudflare presents a primer on "anti-patterns" that have transformed IoT devices into ghastly security nightmares.
This JSON request instructs the alarm clock on every “alarmSound” event to send a HTTP request to the coffee machine. Whilst this may seem a simple and effective way of implementing the Pub/Sub pattern in HTTP, this poses a significant security risk.
By not being able to validate if the receiver of the subscribed message wants the message or not, there is effectively a DDOS vulnerability. An attacker with the ability to set subscriptions on the alarm clock can effectively send HTTP messages to any device or internet property they want. If this is done across enough devices, a DDOS vulnerability is created.
Toast popping out of a toaster or a car driving across a road traffic sensor could be the trigger of a future large scale DDOS against a web property.
IoT Security Anti-Patterns
(via 4 Short Links)
Ship's captains and outside monitoring firms have reported waves of GPS jamming around Shanghai's ports, on a scale and of a severity never seen before: the jamming causes ships' locations to be incorrectly displayed and to jump around; the observations were confirmed via an anonymized (sic) data-set from a short-hire bike firm, whose bikes are […]
Wired security reporter Andy Greenberg's latest book is Sandworm (previously), a true-life technothriller that tells the stories of the cybersecurity experts who analyzed and attributed as series of ghastly cyberwar attacks that brought down parts of the Ukrainian power grid, and then escaped the attackers' control and spread all over the world.
Daniel Moghimi, Berk Sunar, Thomas Eisenbarth and Nadia Heninger have published TPM-FAIL: TPM meets Timing and Lattice Attacks, their Usenix security paper, which reveals a pair of timing attacks against trusted computing chips ("Trusted Computing Modules" or TPMs), the widely deployed cryptographic co-processors used for a variety of mission-critical secure computing tasks, from verifying software […]
Need a boost on that resume? Get a valuable tech education on your own time with these eBook bundles. They contain guides from Packt Publishing that cover everything from game development to machine learning. The Complete Mobile App Developer eBook Bundle It’s a veritable gold rush in the App Store these days. Get in on […]
Vinyl is officially back. People are hearing the proof behind the initial “retro” excitement: that records really do have a richer sound. And if you haven’t switched to old-school records for serious listening, it’s a new golden age. Why? Because quality turntables like the Altec Lansing ALT-500 are finally available to a market other than […]
Between all of our apps, streaming devices, Bluetooth speakers, and energy-sucking decorations, paying for utilities each month can be…brutal. In fact, the average household spends roughly $70 a month on the water bill alone. That number might not seem terribly significant, but when you add it up, that’s $840 a year — a pretty significant […]