Your 'Smart' Thermostat Is Now Vulnerable To Ransomware

from the the-Jetsons-this-ain't dept

We've noted time and time again how the much ballyhooed "internet of things" is a privacy and security dumpster fire, and the check is about to come due. Countless companies and "IoT" evangelists jumped head first into the profit party, few bothering to cast even a worried look over at the reality that basic security and privacy standards hadn't come along for the ride. The result has been an endless parade of not-so-smart devices and appliances that are busy either leaking your personal details or potentially putting your life at risk.

Of course, the Internet of Things hype machine began with smart thermostats and the sexy, Apple-esque advertising of Nest. The fun and games didn't last however, especially after several botched firmware updates resulted in people being unable to heat or cool their homes (relatively essential for a thermostat).Not quite the future that was advertised. And things are about to get notably more interesting with the news that hackers have figured out a way to load smart thermostats with ransomware. Security researchers Andrew Tierney and Ken Munro demonstrated their thermostat ransomware proof-of-concept at the hacking conference Def Con on Saturday, using the opportunity to highlight how many of these devices aren't transparent and fail utterly at giving users any real control of what's happening on their home network:

"We don’t have any control over our devices, and don’t really know what they’re doing and how they’re doing it,” Tierney told Motherboard. “And if they start doing something you don’t understand, you don’t really have a way of dealing with it."

And again, as we've seen with everything from smart refrigerators to Wi-Fi embedded tea kettles, companies get so excited about the IoT marketing and revenue possibilities, they fail to embed even basic security in supposedly intelligent devices:

"The thermostat in question has a large LCD display, runs the operating system Linux, and has an SD card that allows users to load custom settings or wallpapers. The researchers found that the thermostat didn’t really check what kind of files it was running and executing. In theory, this would allow a malicious hacker to hide malware into an application or what looks like a picture and trick users to transfer it on the thermostat, making it run automatically."

So yeah, imagine waking up one morning to this:Yes, this is just one thermostat and a proof-of-concept, but worries about the IoT industry's total failure to include security on "smart" devices should not be confused with scaremongering or hyperbole. As Bruce Schneier recently warned, the IoT explosion has resulted in the introduction of thousands of new attack vectors in homes, businesses and vehicles across the country, with vendors and Luddite consumers often ill-prepared to quickly update these products when vulnerabilities are exposed. If smart technology doesn't get smarter soon, the future of smart technology...is going to be dumb technology.

Filed Under: iot, ransomware, security, smart thermostat, thermostat

Nest May Be The First Major Casualty Of Hollow 'Internet Of Things' Hype

from the hero-to-zero dept

When the Nest smart thermostat was launched back in 2011, you may recall that it was met with an absolute torrent of gushing media adoration, most of it heralding the real arrival of the smart home. That was in part thanks to the fact the company was founded by Tony Fadell and Matt Rogers, both ex-Apple engineers with some expertise in getting the media to fawn robotically over shiny kit. But a parade of high-profile PR failures have plagued the effort since, including several instances where botched firmware updates briefly bricked the device, leaving even the media's resident internet of things evangelists annoyed.

Under the hood it has become increasingly clear that the company was plagued by what some cooperating companies recently proclaimed was an overall "culture of arrogance", manifested in a reputation for blaming Nest's own problems on partner companies. And being acquired by Alphabet (Google) didn't seem to help matters. Despite expanding the company's employee count from 280 to 1200 and being provided a "virtually unlimited" budget, the same press that built Nest into an internet of things god based on a single pretty thermostat design has suddenly and comically realized that Nest hasn't actually done or produced much of anything:

"In return for all this investment, Nest delivered very little. The Nest Learning Thermostat and Nest Protect smoke detector both existed before the Google acquisition, and both received minor upgrades under Google's (and later Alphabet's) wing. A year after buying Dropcam, Nest released the Nest Cam, which was basically a rebranded Dropcam. Two-and-a-half years under Google/Alphabet, a quadrupling of the employee headcount, and half-a-billion dollars in acquisitions yielded minor yearly updates and a rebranded device. That's all."

There's also the recent kerfuffle involving Nest acquiring smart home hub manufacturer Revolv in 2014, then effectively bricking a $300 device as of last month (again, without really providing anything to replace it with). Over the last year Nest also started leaking many top employees and there was a notably ugly and public feud with Dropcam co-founder and departing Nest employee Greg Duffy, who blamed Nest's dysfunction on Fadell's "tyrant bureaucrat" management style.

Now after six years leading Nest's frontal assault to nowhere, co-founder Tony Fadell announced last Friday in a blog post that he will be stepping down as CEO. The departing executive tries valiantly to claim it was just time to "leave the nest" (ba dum bum):

"Today though, my news is bittersweet: I have decided that the time is right to “leave the Nest.” While there is never a perfect time to transition, we’ve grown Nest to much more than a thermostat company. We’ve created a hardware + software + services ecosystem, which is still in the early growth stage and will continue to evolve to move further into the mainstream over the coming years.

Alphabet CEO Larry Page meanwhile issued a rosy statement of his own about this firing dressed up as a not firing:

"Under Tony’s leadership, Nest has catapulted the connected home into the mainstream, secured leadership positions for each of its products, and grown its revenue in excess of 50% year over year since they began shipping products. He’s a true visionary, and I look forward to continuing to work with him in his new role as advisor to Alphabet. I’m delighted that Marwan will be the new Nest CEO and am confident in his ability to deepen Nest’s partnerships, expand within enterprise channels, and bring Nest products to even more homes."

And while that's sweet and all, Fadell reportedly held an all hands Google meeting back in April after which he was pretty furiously mocked by Google employees, many of which wanted (and presumably still want) Fadell fired and Nest sold off. Google/Alphabet, meanwhile, appears to have gone full speed ahead on a variety of smart home projects that have nothing to do with Nest, including the company's Asus and TP-Link OnHub routers (which have baked in IOT functionality not fully enabled yet), and the more recently unveiled Google Home (Google's version of Amazon Echo).

Nest can certainly still turn things around whether it's sold or remains at Alphabet, and it should soon be clear just how big of a role Fadell's management style played in the company's gear grinding. But the media's manufacture and subsequent demolition of Nest is also part of a broader cautionary tale about the tech media's boundless adoration of style over substance (or, security, as "smart" tea kettles, refrigerators, TVs, and vehicles keep illustrating) when it comes to the internet of shiny things.

Filed Under: hype, internet of things, smart things, thermostat, tony fadell
Companies: alphabet, dropcam, google, nest