Today in "Internet of Things as Applied Demonology" news:

"I stayed in a hotel with Android lightswitches and it was just as bad as you'd imagine"

The hotel I'm staying at has decided that light switches are unfashionable and replaced them with a series of Android tablets. One was embedded in the wall, but the two next to the bed had convenient looking ethernet cables plugged into the wall. So. [...]

And then I noticed something. My room number is 714. The IP address I was communicating with was They wouldn't, would they?

I mean yes obviously they would.

It's not as bad as it could be - the only traffic I could see was from the 207 subnet, so it seems like there's a separate segment per floor. But I could query other rooms on my floor to figure out whether the lights were on or not, which strongly implies that I could control them as well. [...] Hotels are happily deploying systems with no meaningful security, and the outcome of sending a constant stream of "Set room lights to full" and "Open curtain" commands at 3AM seems fairly predictable.

Previously, previously, previously, previously, previously.

Tags: , , , ,

  • Previously