An Australian woman's creepy, violent ex-boyfriend hacked her phone using stalkerware, then used that, along with her car's VIN number, to hack the remote control app for her car (possibly Landrover's Incontrol app), which allowed him to track her location, stop and start her car, and adjust the car's temperature. Read the rest
For years, I've followed Andy Greenberg's excellent reporting on "Sandworm," a set of infrastructure-targeted cyberattacks against Ukraine widely presumed to be of Russian origin, some of which escaped their targeted zone and damaged systems around the world. Read the rest
Nest is a home automation company that Google bought in 2014, turned into an independent unit of Alphabet, then re-merged with Google again in 2018 (demonstrating that the "whole independent companies under Alphabet" thing was just a flag of convenience for tax purposes); the company has always focused on "ease of use" over security and internecine warfare between different dukes and lords of Google meant that it was never properly integrated with Google's security team, which is why, over and over again, people who own Nest cameras discover strangers staring at them from their unblinking camera eyes, sometimes shouting obscenities. Read the rest
The Cyber Independent Testing Lab is a security measurement company founded by Mudge Zadko (previously), late of the Cult of the Dead Cow and l0pht Heavy Industries and the NSA's Tailored Access Operations Group; it has a unique method for assessing the security of devices derived from methods developed by Mudge at the NSA. Read the rest
You know what's great about putting wifi-enabled, Turing-complete computers into things like lightbulbs? Not. A. Single. Fucking. Thing. Read the rest
One of the most obvious facts I've learned in covering the unfolding scandal of the secret deals between Amazon's Ring surveillance doorbell group and hundreds of US police departments is that Amazon loooooves to play word-games. Read the rest
Last week at Defcon, a security researcher named Smea presented their findings on vulnerabilities in the Lovesense Hush, an internet-of-things buttplug that has already been shown to have critical privacy vulnerabilities. Read the rest
Dorothy is an (alleged) 15-year-old who has attained Twitter fame by hopping from device to device as her mother finds and confiscates her tools: first her phone, then her Nintendo, then her Wii U, and finally, her family smart fridge. Read the rest
Amazon is under fire over revelations that it did secret deals with local police departments to buzz-market its Internet of Things "Ring" brand surveillance doorbells, but Ring's shady history predates its acquisition by Amazon in 2017. Read the rest
Behold the AmazonBasics Alexa-Equipped Microwave, a $40 item whose low price is belied by the fact everything you say to it is held in contingent perpetuity in an Amazon datacenter. [via]
AmazonBasics Microwave simplifies cooking by letting you microwave using your voice and an Echo device. Just say, “Alexa, reheat one cup of coffee,” and Alexa will start reheating with the appropriate power and time settings. Quick-cook presets mean there’s no need to guess cook times or heat levels when you’re defrosting vegetables or microwaving a potato. Plus, Alexa is always getting smarter and adding new presets.
If you want a cheap 700w mini-microwave from Amazon, this retro Daewoo model is adorable. Read the rest
Every time I write about the unfolding scandal of Amazon's secret partnerships with hundreds of US police departments who get free merch and access to Ring surveillance doorbell footage in exchange for acting as a guerrilla marketing street-team for Ring, I get an affronted email from Amazon PR, implying that I got it all wrong, but unwilling to enter into detailed discussions of what's actually going on (the PR flacks also usually ask to be quoted officially but anonymously, something I never agree to). Read the rest
Mining the results of public records requests relating to Amazon's secret deals with local law enforcement to promote its Ring surveillance doorbells (more than 200 agencies!) continue to bear fruit. Read the rest
Last week, Motherboard broke a story revealing that Amazon had entered into secret agreements with local law enforcement agencies that had the cops pushing Ring surveillance doorbells to the people they were sworn to protect, in exchange for freebies and access to a system that let them request access to footage recorded by the Amazon's industry-leading internet-of-shit home surveillance tools. Read the rest
Last week, Motherboard reported on a public record request that revealed that Amazon had struck confidential deals with local police forces to get them to promote the company's Internet of Things "Ring" doorbells, and the accompanying "Neighbors" app that produces a kind of private surveillance mesh overlooking nearby public spaces -- under the terms of the deal, cops would be able to see a map noting locations of Ring surveillance cams and request footage from their owners. Read the rest
Amazon quietly struck deals with dozens of local law enforcement agencies across America that gave the police access to a distributed surveillance feed from its Ring "smart doorbell" products in exchange for the cops providing free advertising for the products without revealing their contractual requirement to do so. Read the rest
A hacker calling themself Light Leafon who claims to be a 14-year-old is responsible for a new IoT worm called Silex that targets any Unix-like system by attempting a login with default credentials; upon gaining access, the malware enumerates all mounted disks and writes to them from /dev/random until they are filled, then it deletes the devices' firewall rules and removes its network config and triggers a restart -- this effectively bricks the device, rendering it useless until someone performs the complex dance needed to download and reinstall the device's firmware. Read the rest
