Internet Of Not-So-Smart Things: Samsung's Latest Smart Fridge Can Expose Your Gmail Password

from the I'll-take-my-devices-stupid,-thanks dept

The sometimes blisteringly-inane hype surrounding the “Internet of Things” appears to be on a collision course with the sophomoric security standards being employed in the field. As we’ve seen time and time again, companies were so bedazzled by the idea of connecting everything and anything to the Internet (your hat! your pants! your toilet!) they left device and network security as an afterthought — if they could be bothered to think about it at all. The result has been smart TVs that share your personal conversations, vehicles that can easily be used to kill you, and a home full of devices leaking your daily habits.

The latest example comes again via Samsung, whose “smart” refrigerators aren’t so smart. While Samsung’s shiny new refrigerators connect to the Internet, can display your Google Calendar and implement SSL, hackers during a challenge at the recent DEFCON found the refrigerators fail to validate those SSL certificates. That opens the door to all kinds of man-in-the-middle attacks, potentially allowing your neighbor to steal your Gmail login information while sitting on his couch next door:

“The internet-connected fridge is designed to display Gmail Calendar information on its display,” explained Ken Munro, a security researcher at Pen Test Partners. “It appears to work the same way that any device running a Gmail calendar does. A logged-in user/owner of the calendar makes updates and those changes are then seen on any device that a user can view the calendar on.”

“While SSL is in place, the fridge fails to validate the certificate. Hence, hackers who manage to access the network that the fridge is on (perhaps through a de-authentication and fake Wi-Fi access point attack) can Man-In-The-Middle the fridge calendar client and steal Google login credentials from their neighbours, for example.”

On the plus side, this vulnerability was found after Samsung invited hackers to try and find vulnerabilities in the system, showing some proactive thinking. On the flip side, this is the same company whose “smart” TVs were found to be happily sending living room conversation snippets unencrypted over the Internet — so it’s not always clear Samsung listens to feedback, or how many bugs and vulnerabilities go unnoticed. Regardless, the researchers’ blog post has a little more detail, noting they may have also found some vulnerabilities in the app’s encrypted communication stream with the refrigerator.

These endless IOT security issues may have the opposite effect of that intended: actively marketing the need for many devices to be dumber. And those dumb devices are getting harder to find. Many of the latest and greatest 4K television sets, for example, simply can’t be purchased without intelligent internals that integrate functionality the user may not want. So while Wired magazine’s endless 1990’s obsession with intelligent refrigerators may have finally come to fruition, they may be unwitting pitchmen for how sometimes it’s better for things to simply remain utterly analog — and beautifully, simply stupid.

Filed Under: , , , ,
Companies: samsung

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Internet Of Not-So-Smart Things: Samsung's Latest Smart Fridge Can Expose Your Gmail Password”

Subscribe: RSS Leave a comment
43 Comments
scotts13 (profile) says:

Remember the Jeep Cherokee security hack?

I work for a Chrysler dealer. Yesterday, we had training session on the Uconnect internet-enabled electronics systems in our cars. We were told “People don’t buy cars these days. They buy car radios; the rest of the car is just to carry the radio around.” Know what wasn’t mentioned? Security – at all.

Groaker (profile) says:

Re: Remember the Jeep Cherokee security hack?

The ability to hack (don’t know if it was done in the wild) cars is not new. It goes back at least a decade, since the “fly by wire” brake, accelerator and other controls started to be connected by radio signals instead of wires.

When I asked the salesman about it, he seemed genuinely surprised and unbelieving. Given that I was able to read him well enough to beat his price into the dirt, I believe he was telling the truth about not knowing about it.

Anonymous Coward says:

Re: Re: Remember the Jeep Cherokee security hack?

…do people even use car radios anymore?…

If it’s got an mp3 input jack: YES.

If it’s got a CD player: YES.

If it’s got a satellite radio input and subscription: YES.

If it’s got bluetooth capability to port your smartphone to: YES.

If it’s strictly an AM/FM radio: NO.

tqk (profile) says:

Re: Re: Re: Remember the Jeep Cherokee security hack?

…do people even use car radios anymore?

If it’s strictly an AM/FM radio: NO.

Ah. I see the problem. Back in ancient times, autos came with car radios. Now, we have “onboard media entertainment interface systems” (ordinarily called a “stereo”) which can also be used as replacement for those old style car radios.

I was beginning to wonder why I was seeing so many lovingly restored classic cars on the roads these days, far more than I used to see.

Groaker (profile) says:

Re: Re: Re:2 Re:

You can believe that, but having had a muiltidisciplinary career, half of which was in various levels of IT, I will paraphrase a wise man: the only safe computer has had its CPU, memory and storage removed and destroyed, is buried in 50 ft of concrete, is surrounded by a moat filled with hungry sharks, and the moat is in turn surrounded by armed guards who are watched 24/7 on CATV from a hidden bunker. And even then I am not certain the computer is safe.

There is only the probability of safety, never an assurance. To suggest only one hole that can not be cured by a firewall — your router may have suffered the same fate as Ciscos.

Groaker (profile) says:

Re: Re: Re:3 Re:

Depends on whether the rogue is an equal opportunity invader, or wants something from you specifically.

Before the Sony rootkit scandal, how many security minded individuals would have hesitated to put an audio CD into their computer’s CD player? That insertion didn’t have to go through a network firewall, but rather was walked right around it.

Klaus says:

It's a problem

There’ll come a day when all home appliances come equiped with discrete pan/zoom cameras, microphones, GPS, cellular chips to contact their HQ, and internal always-on UPS for the above circuitry.

I’m going to go find a nice log cabin to live in.
http://www.dailymail.co.uk/news/article-3209634/Bethany-Butze-leaves-Harvard-live-near-Manitoulin-Island-Canada.html

Violynne (profile) says:

“You’re gaining a little weight there, kid. You should work on that.”
“How do you know what I weight?”

“Because I can see you, silly. Look at you. Pudgy and filled with nothing but junk food.”
“It’s amazing you found the time to take your eyes of Candy Crush.”

“Will you two shut the hell up already! Trying to watch ‘Lord of the Rings’ here.”

*sigh*

Sometimes, coming home isn’t fun. In the olden days, it was listening to kids fighting. Now, it’s my goddamn appliances giving me hell.

I’m starting to understand the rants of old people now.

Oblate (profile) says:

Re: Re:

(Violynne): “Will you two shut the hell up already! Trying to watch ‘Lord of the Rings’ here.”

(Toaster): “Says the Lord of the Onion Rings…”

In a few years we’ll be hearing about Smart Scales and Smart Cars communicating, and then the car refuses to drive to fast food. Or maybe there will be a car hack that will make the car complain when overweight people get in (“Ouch!”), make grunting noises when going uphill, and ask “Ummm, we going to the gym?” at least once a day.

Fun times ahead…

TDR says:

Talkie Toaster?

So if things keep going the way they are, we could soon see a real-life Talkie Toaster?

“Howdy doodly-doo! Anybody want any toast?”

“No toast.”

“You sure you don’t want any toast?”

“I don’t want any toast. No one around here wants any toast. Not tow, not ever. No toast!”

“How about muffins?”

“No muffins! We don’t like muffins ’round here. No muffins, baguettes, bagels, or tea cakes! No hot cross buns and definitely no smeggin’ flapjacks!”

“Ah, so you’re a waffle man!”

If so, we may be looking at some cases of first-degree toastercide in the near future.

Rekrul says:

Security always comes last, usually after they’ve created some gaping security hole by adding a feature that was never needed in the first place, all in the name of convenience.

Anyone remember Outlook Express’s preview pane that would happily open any attachment it found in a message? Or the auto-run system that would automatically execute whatever instructions it found on removable media?

GEMont (profile) says:

Is it stupid to buy smart?

Smart Appliances.

Hmmmmmm….

Smart also sorta means intelligent….

What is it that the NSA calls all that stuff they gather into haystacks for analysis in order to get the drop on whoever they deem to be the bad-guys of the week…..?

Oh yeah. Intel, or more properly, Intelligence.

Don’t suppose there’s any connection…..

Smart TV = Intelligence Gathering TV

No way they’d be that deviously obvious, right….

tqk (profile) says:

Re: Is it stupid to buy smart?

Smart TV = Intelligence Gathering TV

Just like the NSA’s hasystack, it’s wrong to call this “Intelligence Gathering.” It’s “Data Gathering.” It’s not intelligence until someone sifts the data for the intelligence contained within.

It’s really annoying to me this’s still misunderstood.

GEMont (profile) says:

Re: Re: Is it stupid to buy smart?

Methinks ye may be laboring under the misconception that the CIAF BIN SADOJ “holds the data in digital storage and only analyzes it when certain criteria are present and only examines the metadata surrounding the captured data and eliminates any identifying information and content immediately on all US citizen data captures…

They, um…. lied about all that.

Of course they did. Its what they do best.

They have an unlimited budget provided by the millions of tax payers in five countries. Like an iceberg, 99% of their operation is completely clandestine and completely unknown to the public and most officials.

The daily capture is analysed by a massive tax-payer purchased array of military super-computers as it comes in, for sorting into the various areas of “action-ability”.

Everything that gets a rating higher than zero is re-examined by a bigger computer array and then recycled through the system and anything rated over 5 gets sorted by importance and then is examined by people, within minutes to hours of the data arrival.

This is an ongoing process, which is for the most part jobbed out to hundreds of civilian companies in foreign countries, like India, which were created specifically for this purpose by 5-I. Different companies deal with different data input types – telephone, email, television, cell phone, snail mail, wireless, and soon refrigerator, toaster and Barbie Doll data….

Everything gets stored on a variety of formats and is re-examined by mega-computer arrays daily to compare it to other recent and old similar data and it is all then re-evaluated according to its association with other data and then goes through the daily standard procedure for data of that classification level again. Three shifts a day, 7 days a week and its all paid for by the tax payers of the 5-I nations.

At the end of each day, the gathered Intelligence is sent up the ladder for executive analysis and re-examination on home based super-computers.

How do I know this?

Because given the funds, that’s how I’d do it. ๐Ÿ™‚

It’s really annoying to me this’s still misunderstood.

Its not misunderstood.

Its misinformation.

GEMont (profile) says:

Re: Re: Re: Is it stupid to buy smart?

What people fail to realize, is that the Home Surveillance Program is the primary program, and all of the peripheral PR programs such as the TSA and the Border Watch and all the other Terrorist and Drug catching programs are pure hollywool.

The only Drug Program that is real is the one that eliminates/disrupts distribution channels of any competitor drug merchants such as non-dues-paying cartels in un-invaded countries, like China.

All the rest are merely associated member reminders – pay the vigorish or suffer the consequences of a military assault on one or more of your production facilities.

The Border watchers have already been shown to be little more than a free wage operation for friends and family members of politicians, using computers so old they can’t even play decent games.

The one and true fascist program is the one that steals personal data from every computer in America, for the purposes of blackmail/extortion of civilians and businesses, theft of ideas and innovations, prevention of competition and general profiteering by the billionaires in power and behind the scenes.

Their equipment is probably 20 years ahead of anything commercially available, and their bases are unknown to all but a handful of people in high places who work entirely behind the scenes and have a zero public profile as far as press and Who Is Who sources are concerned. Many are not even American. Many are Royalty.

Try an experiment.

Consider momentarily that you are a generally unknown private billionaire asshole with access to absolutely unlimited funds provided by the taxes of five nations and a global drug/prostitution/gambling and entertainment empire, and your goal is to completely subvert the laws of every nation on earth so that you and your billionaire friends around the world can better control the world economy like a giant business – Earth Inc..

How would you go about it?

If you’re a little short on starting ideas, just look around you at the recent exposures of the CIAF BIN SADOJ operations, as well as those of the Snoop and Scoop agencies of the other four 5-I nations. ๐Ÿ™‚

Keep in mind that the general public has been trained to disregard the words of anyone who has not proven themselves reliable and smart by becoming wealthy first, so you have no fear of anyone in the non-rich general public causing you any grief that cannot be resolved as easily as one discards a used coffee cup, through the use of blackmail, character assassination and/or falsified evidence of a crime, leading to incarceration or death of any such nuisance, and that, the only people you actually fear are your fellow billionaires.

—-

Add Your Comment

Your email address will not be published.

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop ยป

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...
Loading...