I assune the attacker doesn't own that EC2 instance. If they did, the bandwidth costs would be prohibitive (there is no economic reason to pay XX cents per GB to send data to a tiny remote CPU for processing)
Why connect random ownable devices to your network, especially for the low low benefit of <checks notes> ... knowing when the clothes' drier is done ?!?
Connected firmware updatable white goods allow appliance manufacturers to do even less QA because they can always fix it later, which wasn't possible before. If you're the paranoid who won't connect random crap to the net, this is bad news, as you'll get lower quality appliances.
I wouldn't be surprised if we get internet-only appliances soon, which charge customers on a pay-per-use basis. Considering the low margins on the average whitegoods, it could be an attractive business model to bundle the consumables with the hardware as part of a subscription/PAYG model.
Or you could lockdown certain modes and temperatures behind a paywall. Similar how the car industry is already doing it.
Wow. And those features don't work without WiFi. Why the heck would it need an internet connection and a subscription to fry something? It already costs $1,500! You'd think maybe it would be using AI to figure out how to best fry the food or something like that, but the article also says the frying function didn't work very well...
The smart models have recipe step-by-step. The recipes can send commands to the Thermomix rather than manually setting the dials and timers. There's also a baby companion Thermomix Friend that can receive commands from the main unit to cook dishes separately e.g. a sauce.
Non-geek friends are always shocked that I do not typically want additional new tech-stuff in my life unless the payoff is very high.
Novel and interesting are not sufficient on their own.
I am immersed in layers of technology (and poorly-thought-out Authentication schemes) everyday for 10-12 hours and it presents a noticeable amount of frustration.
I rarely am looking for more of it. I am pretty sure I don't want my dryer on my network.
I've run into the same reactions from friends and colleagues. They're surprised that someone with a career in IT and tech doesn't want smart speakers or home assistants or any kind of IoT.
In their perception, I should be all over every new little gadget and interconnected doodad, but those sorts of devices just drive me up the wall. There is always some annoying issue or limitation, a lot of them don't even perform their primary function adequately, and if something goes wrong, you have no logging or diagnostics possibilities, short of maybe cracking open the case and looking for a JTAG connector or something.
It drives me crazy when I can't just look at a log file or at least get a descriptive error message, it's always just "oops, something broke, sorry about that teehee". Then you power cycle the device and hope that works, if not then you try a factory reset. If that doesn't work, what do you do? Everything is so integrated today that old-school fault finding on a PCB won't yield anything of value. I hate it.
I do have some smart/IoT/modern gadget tech devices. The thermostats on our radiators are intelligent. By this I mean they have a programmed daily schedule, to lower temps at night. They also sense open windows from the temperature drop and shut the heat off and then on again when we close the windows. The only connectivity on them is Bluetooth, which has to be turned on by a button press on the individual thermostat, every time you want to connect to it. That is the sort of connectivity I will accept from "smart" devices.
The other is a Chromecast, which is reluctantly tolerated because it's the lowest-friction way to have a collaborative queue of videos to watch, when you're in couch potato mode. But if anything goes wrong, you have to break out the garlic and black candles and hope you can perform the proper incantation to make it happy again. If I could get similar functionality on the HTPC in a web browser tuned to https://youtube.com, that little puck-like bastard would be forever banned from the premises.
If I want more home automation, I will program it myself using a Pi or Arduino or ESP32 or something, combined with commodity electronics and sensors. So far, the need has not presented itself.
One short story in Cory Doctorow's "Radicalized" is exactly about that. In the story, immigrants living in social housing supplied with "smart" appliances are only allowed pre-approved detergent, among other things.
Can recommend the other stories from the book as well. The one about the doomsday fetishists is something I think about every once in a while, especially now during the pandemic.
Even worse, let's apply the non network neutrality argument: the washer won't work without certain "licensed" detergents sold as for the safety of the washer (some claim about harm of the device from the wrong detergent).
Consumers need to outright reject these attempts by manufacturers. Is there risk that some appliances already put some sort of timer chip and stop working after some time? Kind of the HP inkjet business model?
We need some open source washer companies, I would pay a premium for an open source washing machine.
Already happened with home exercise bikes. A decade ago no one would have fathomed that millions would be buying home gym equipment with subscription models.
I tend to agree that subscription models will evolve into many more devices.
Home automation seems to mainly achieve "low low benefits". Like turning on a light from your phone instead of using a light switch. These things make some minor conveniences possible, but don't come close to being essential. It doesn't seem worth it for the privacy, security, management overhead, cost, etc.
When done well it provides more than just toggling a switch on your phone. Examples are timers for lights to say turn on outdoor lights at dusk. Turning on thr garage light when the garage door opens. Double tapping the switch by thr front door to turn off all lights in your home.
I'd like to think that shunning home automation isn't the answer, rather demanding open protocols and no internet connection required, such as with ZWave and more so Zigbee.
I'm no expert but these appliances don't seem to be very programmable. For example, can I set the living room bulbs to be white in the day, gradually turn yellower throughout the evening and red at night?
To me it just seems like going from a dimmer switch on the wall to an app on a phone is being heralded as a revolution, when it isn't.
It sounds like you haven’t used any automation systems. You can do exactly that (and more) with the most popular smart light - Philips Hue. Other brands can as well.
Some of these things can be achieved with lower-tech sensors.
Outdoor lights with light or motion sensors are common.
Garage lights typically turn on automatically when the garage door opens. If you mean the human-sized door to the garage, light bulbs with built-in motion sensors are available; I have used those in entryways and in closets. I don't have a garage, but if I did it would be nice to be able to close it remotely if I forgot to.
I have also installed timer switches to make sure things like vent fans for the shower do not stay on longer than necessary.
Switching all lights at once is nifty if you live in a large home. I have a small home, so it's quite trivial to turn off all of the lights.
For myself, I just don't think it's worth it to setup more sophisticated automation at this time. For one, I rent. Second, of all of the inconveniences in my life, these are at the bottom of the list.
One of the best minor conveniences I addressed recently was getting a larger-volume soap dispenser so that I have to refill it less often.
Yep, if you rent it doesn't make as much sense. All I was pointing out is that automation is way more than just being able to flip your light on using your phone. I have ZWave switches in my home and I don't use my phone to flip any switches. For me, I like being able to program the house and customize it in any way.
A motion sensor hard wired vs one that goes back to a Zigbee/Zwave hub running OpenHab are not too different. One is some added complexity for added flexibility.
Oh, I am a big advocate of open protocols so you can host the hub locally rather than it connecting back to some AWS server. Hence the ZWave and Zigbee reference.
I was able to add dimming capability to the lights in my rented apartment where it wasn't available before using smart lights. That was a pretty big benefit to me.
This doesn't require a network connection, just a dimmer switch. Note that these generally won't work with smart lights, so you need a dimmer switch and dumb bulbs.
Unless you're saying because it is rented, the landlord won't allow you to install your own switches, though I'm not sure why they'd care as long as you restore it before moving out. I own rental properties and would definitely allow tenants to do that. Hell, I'd even do it for them if they asked.
I have installed my own switches in rentals. For example, I installed a timer switch for a vent fan in my last apartment. Very easy to undo when it comes time to move, if necessary.
There are some valid use cases though.
For example loading a washing machine in the morning, then starting it a hour before I plan to drive home. This one can be a real quality of life changer.
Nothing is really essential in our life. Do you really need washing machine? You can do laundry by hand. It saves time and more convenient to use a machine. The problem with a lot of automation schemes is that it takes more time and less convenient because of poor design.
Surely you can just set the timer most washing machines to start it a few hours after you leave? Personally though having washing machines running in an empty house makes me nervous.
What worries me is that soon we won't be able to monitor this anymore because these devices won't be dependent on a customer-supplied internet connection anymore. Instead, they'll all have cellular connectivity and we'll have no idea what is being sent, to whom and why.
And I fear that there will be no device manufacturers in the same price range left that don't include this feature. Similar to how Smart TV's are cheaper than dumb displays of identical specs.
Then you'll get local shops that sell the machines painted in 2-3 layers of faraday paint (or apply some sort of cage, or solder out the antenna, etc). Or perhaps just like in the old console hardmod days everyone will know someone that can "mod" your dryer so it stops being dumb and just dries your clothes.
FYI, RF paints are poor signal attenuators, even when applied in multiple coats. There’s no RF paint product that can stop commercial cell communication across usable spectrum.
In the future SIMs are probably going to be some kind of signed data blob instead of a physical card. But I guess breaking off antennas will always be a thing if you have the skill set to identify it.
Luckily we only need one person with the right skill set to identify the antenna or other offending component to be removed and document it online, with pictures and instructions :-)
Sounds extremely boutique. There would almost certainly be a cat and mouse game where licensed retailers refuse to sell to these local shops, which would drive prices through the roof
There is very little going on in any appliance that couldn't be run by a mechanical timer of yore. If there's ever a popular movement to remove the surveillance antifeatures from modern appliances (and I sure hope there will be!), it'll be as simple as popping in a different control board.
BTW does anybody know of any pointers to community projects that are making hardware for this type of thing? I've got it on my long term todo list to create a replacement board for a washer with a "bad control board", but wouldn't want to waste the effort if there are already projects doing this.
A generic washer control board sounds like something there would be a market for today.
I could imagine a little microcontroller and say 10 relays that can control the pump, motor, valves, etc. Then you sell it together with instructions which specify how to program in which output does which function.
You could sell it to people who want to "IoT" their machines for cheap, to people who have a dead control board, and people who want to customize their appliances (eg. I need a custom wash cycle for washing extra dirty clothes).
Yeah, exactly. It's so apparent to me that I figure something like this has to exist, if I dug into it.
I don't know if you'd even 10 relays. Most appliances have been cost-reduced into like two motors, a heater, and one or two actuators. Perhaps newer models with steam cleaning etc have reversed that trend.
Control side, I'm thinking of an AVR + ESP32. The AVR for reliably controlling the motors with the sensors, eg if the water is full, turn the water off. True safety stuff like overheat switches obviously stays inline though.
One of the more complex details is newer appliances have moved to brushless motors for efficiency. A three phase motor driver is straightforward, but figuring out what design parameters will be reasonably generic to serve the most appliances is some research.
The least generic parts seem to be fitting in with the existing user-input buttons, and managing the complexity of programming many different models for non-engineer users. The kind of people that are comfortable taking apart appliances generally have less patience for programming computers.
Yeah that's what I was thinking (although with hard buttons, and touch on the display only for flexibility). Still kind of hacky though. Like on a dishwasher, it would just stick vertically to the front? Shrug.
Of course if any specific model became popular enough someone could fab a dedicated control board that fit in the right spot, or at least had matching aesthetics.
CFAA requires you to interfere with someone else's computer. Presumably, the computer in the washing machine you bought is yours, so the manufacturer would (should..) have no standing.
Presumably... but companies have been pushing the limits on what you can consider "yours" for a few decades now. Sure, you bought the hardware... but they might think they "own" the cellular chip because they pay for the bandwidth or something.
I think in California it's CCPA that not only protects personal data, but also against the non-consented collection of data by devices owned by the person or in the person's own home.
Telecom providers will probably provide a service for companies like LG to lock down the connection in such a way it can only access their services. Kind of like they already provide MPLS and such.
Cellular providers aren't giving LG a cellular modem for free, esp. 1Gbyte/day. Unless there is going to be something that causes cellular providers to give away data, it's going to be a significant cost.
The only sustainable ways for this to work is:
A) for the data for LG to collect to be worth what it has to pay to the providers. Aside from hopefully unlikely things like LG collecting audio and visual from hidden devices on the appliance, What the hell could anyone collect from a dryer that makes it worth it to pay for a cellular connection to your dryer? Is when and how much I use a dryer worth $30/month on a 2 year contract, for example?
B) for LG to charge you a subscription to use your dryer. People won't do this dumb shit for a dryer unless the dryer is not sold to them, but rented for like $30/month--with free installation. Even then, if the monthly cost is over a certain threshold over me going down to the laundromat and putting quarters in machines there, people won't do it--last time I did laundry at laundromat recently it was $4.25 to wash and effectively $5 to fully dry and that doesn't include soap and dryer sheets.
Now if you throw in a bundled detergent and fabric softener and dryer sheet subscription on top of it, and a free service if anything goes wrong ... it might work. And then ... maybe it is worth it?
$55/mo for a free dryer and all-you-can-eat soap, softener, and sheets--brand of your choice. Like commercial copiers/toner--well, imagine if it was "pay per load".
I mean we're probably going down the road of--in a few years or a deacde--manufacturers being so cheap and the middle-class-eviscerated consumers being so disempowered and poor that it ends up being you have to replace the dryer every 2 years anyway.
Low-usage data-only cellular service, obtained in bulk, is becoming very cheap. I have one device in my home now that use cellular service paid by the manufacturer to report back telemetry. It could have easily been WiFi, but they seem to have found the somewhat higher cost of cellular is worth it to avoid the setup complexity.
Suddenly homebrew Stingray cell tower devices seem reasonable, with only enough power to force IoT devices to sink their connections with them into a blackhole instead of your closest tower.
There's always things like Amazon Sidewalk that give IoT the "best" of both worlds. Pervasive connectivity where you don't have to pay for the bandwidth yours.
You want to leave wet clothes in the dryer for several hours before turning the dryer on? That doesn't make any sense. Why not just turn the dryer on when you go out.
I actually use these though. It's a boon for someone with ADHD for a dryer that has adaptive drying (the drying time varies based on moisture content, so the estimate isn't perfect). I'll be plugging away at my computer and my phone tells me "hey it's time to take them out". It's even more valuable when you have a washer with alerts, since you can know exactly when to do the next load.
Some people have night rates for electricity so you could set your dryer to start at 3am and save yourself money.
You could get an estimated time for when the clothes are going to be dried. Often I have to switch on the dryer a second time as the clothes aren’t completely dry.
If the water collection tank is full in my dryer it essentially stops drying the clothes so if I could get an alert that the tank was full I could empty it or maybe alert someone in the house that it needs to be emptied.
Often if I’m washing clothes at night I don’t turn on the drier as some people have gone to bed, I normally leave the clothes in the drier. So if I could get an alert based on the weather the next morning if it makes sense to hang out the clothes before I go to work or is it going to rain and the drier will switch it on and be finished before I come home from work.
88 comments
[ 4.2 ms ] story [ 132 ms ] threadAh, wait, I just realized it can’t be if there is no any traffic other than AWS.
Why connect random ownable devices to your network, especially for the low low benefit of <checks notes> ... knowing when the clothes' drier is done ?!?
Connected firmware updatable white goods allow appliance manufacturers to do even less QA because they can always fix it later, which wasn't possible before. If you're the paranoid who won't connect random crap to the net, this is bad news, as you'll get lower quality appliances.
Or you could lockdown certain modes and temperatures behind a paywall. Similar how the car industry is already doing it.
"Subscription-only features include caramelization, slow cooking, and frying."
https://www.thespruceeats.com/thermomix-tm6-review-4693221
https://www.vorwerk.co.uk/thermomix/thermomix-friend/
I have the dumb TM31.
Non-geek friends are always shocked that I do not typically want additional new tech-stuff in my life unless the payoff is very high.
Novel and interesting are not sufficient on their own.
I am immersed in layers of technology (and poorly-thought-out Authentication schemes) everyday for 10-12 hours and it presents a noticeable amount of frustration.
I rarely am looking for more of it. I am pretty sure I don't want my dryer on my network.
A couple of weeks ago I had to spend an afternoon in Wireshark to make some "smart" lightbulbs work with the corporate WiFi.
One of the owners wanted to add iPhone controlled mood lighting to the office.
In their perception, I should be all over every new little gadget and interconnected doodad, but those sorts of devices just drive me up the wall. There is always some annoying issue or limitation, a lot of them don't even perform their primary function adequately, and if something goes wrong, you have no logging or diagnostics possibilities, short of maybe cracking open the case and looking for a JTAG connector or something.
It drives me crazy when I can't just look at a log file or at least get a descriptive error message, it's always just "oops, something broke, sorry about that teehee". Then you power cycle the device and hope that works, if not then you try a factory reset. If that doesn't work, what do you do? Everything is so integrated today that old-school fault finding on a PCB won't yield anything of value. I hate it.
I do have some smart/IoT/modern gadget tech devices. The thermostats on our radiators are intelligent. By this I mean they have a programmed daily schedule, to lower temps at night. They also sense open windows from the temperature drop and shut the heat off and then on again when we close the windows. The only connectivity on them is Bluetooth, which has to be turned on by a button press on the individual thermostat, every time you want to connect to it. That is the sort of connectivity I will accept from "smart" devices.
The other is a Chromecast, which is reluctantly tolerated because it's the lowest-friction way to have a collaborative queue of videos to watch, when you're in couch potato mode. But if anything goes wrong, you have to break out the garlic and black candles and hope you can perform the proper incantation to make it happy again. If I could get similar functionality on the HTPC in a web browser tuned to https://youtube.com, that little puck-like bastard would be forever banned from the premises.
If I want more home automation, I will program it myself using a Pi or Arduino or ESP32 or something, combined with commodity electronics and sensors. So far, the need has not presented itself.
You have articulated the situation really really well. Thank you for that.
https://arstechnica.com/gaming/2020/01/unauthorized-bread-a-...
Well, that's an everyday sales lead for us these days. The devious "Product as a Service" is by far the most demanded feature.
Consumers need to outright reject these attempts by manufacturers. Is there risk that some appliances already put some sort of timer chip and stop working after some time? Kind of the HP inkjet business model?
We need some open source washer companies, I would pay a premium for an open source washing machine.
Voters need to ban these attempts. Limiting our power to that of mere consumers is what has allowed things to get this bad in the first place.
https://www.npr.org/2021/02/17/968704526/why-printers-are-th...
I tend to agree that subscription models will evolve into many more devices.
I'd like to think that shunning home automation isn't the answer, rather demanding open protocols and no internet connection required, such as with ZWave and more so Zigbee.
To me it just seems like going from a dimmer switch on the wall to an app on a phone is being heralded as a revolution, when it isn't.
Outdoor lights with light or motion sensors are common.
Garage lights typically turn on automatically when the garage door opens. If you mean the human-sized door to the garage, light bulbs with built-in motion sensors are available; I have used those in entryways and in closets. I don't have a garage, but if I did it would be nice to be able to close it remotely if I forgot to.
I have also installed timer switches to make sure things like vent fans for the shower do not stay on longer than necessary.
Switching all lights at once is nifty if you live in a large home. I have a small home, so it's quite trivial to turn off all of the lights.
For myself, I just don't think it's worth it to setup more sophisticated automation at this time. For one, I rent. Second, of all of the inconveniences in my life, these are at the bottom of the list.
One of the best minor conveniences I addressed recently was getting a larger-volume soap dispenser so that I have to refill it less often.
A motion sensor hard wired vs one that goes back to a Zigbee/Zwave hub running OpenHab are not too different. One is some added complexity for added flexibility.
Its time for an open source washer!
Unless you're saying because it is rented, the landlord won't allow you to install your own switches, though I'm not sure why they'd care as long as you restore it before moving out. I own rental properties and would definitely allow tenants to do that. Hell, I'd even do it for them if they asked.
Nothing is really essential in our life. Do you really need washing machine? You can do laundry by hand. It saves time and more convenient to use a machine. The problem with a lot of automation schemes is that it takes more time and less convenient because of poor design.
And I fear that there will be no device manufacturers in the same price range left that don't include this feature. Similar to how Smart TV's are cheaper than dumb displays of identical specs.
Then you'll get local shops that sell the machines painted in 2-3 layers of faraday paint (or apply some sort of cage, or solder out the antenna, etc). Or perhaps just like in the old console hardmod days everyone will know someone that can "mod" your dryer so it stops being dumb and just dries your clothes.
I would just snip off the antenna or remove the SIM, but if I can think of that, so can the manufacturers.
My sim "card" today is just an email already.
BTW does anybody know of any pointers to community projects that are making hardware for this type of thing? I've got it on my long term todo list to create a replacement board for a washer with a "bad control board", but wouldn't want to waste the effort if there are already projects doing this.
I could imagine a little microcontroller and say 10 relays that can control the pump, motor, valves, etc. Then you sell it together with instructions which specify how to program in which output does which function.
You could sell it to people who want to "IoT" their machines for cheap, to people who have a dead control board, and people who want to customize their appliances (eg. I need a custom wash cycle for washing extra dirty clothes).
I don't know if you'd even 10 relays. Most appliances have been cost-reduced into like two motors, a heater, and one or two actuators. Perhaps newer models with steam cleaning etc have reversed that trend.
Control side, I'm thinking of an AVR + ESP32. The AVR for reliably controlling the motors with the sensors, eg if the water is full, turn the water off. True safety stuff like overheat switches obviously stays inline though.
One of the more complex details is newer appliances have moved to brushless motors for efficiency. A three phase motor driver is straightforward, but figuring out what design parameters will be reasonably generic to serve the most appliances is some research.
The least generic parts seem to be fitting in with the existing user-input buttons, and managing the complexity of programming many different models for non-engineer users. The kind of people that are comfortable taking apart appliances generally have less patience for programming computers.
Of course if any specific model became popular enough someone could fab a dedicated control board that fit in the right spot, or at least had matching aesthetics.
https://www.bbc.com/news/blogs-news-from-elsewhere-44645217
The only sustainable ways for this to work is:
A) for the data for LG to collect to be worth what it has to pay to the providers. Aside from hopefully unlikely things like LG collecting audio and visual from hidden devices on the appliance, What the hell could anyone collect from a dryer that makes it worth it to pay for a cellular connection to your dryer? Is when and how much I use a dryer worth $30/month on a 2 year contract, for example?
B) for LG to charge you a subscription to use your dryer. People won't do this dumb shit for a dryer unless the dryer is not sold to them, but rented for like $30/month--with free installation. Even then, if the monthly cost is over a certain threshold over me going down to the laundromat and putting quarters in machines there, people won't do it--last time I did laundry at laundromat recently it was $4.25 to wash and effectively $5 to fully dry and that doesn't include soap and dryer sheets.
Now if you throw in a bundled detergent and fabric softener and dryer sheet subscription on top of it, and a free service if anything goes wrong ... it might work. And then ... maybe it is worth it?
$55/mo for a free dryer and all-you-can-eat soap, softener, and sheets--brand of your choice. Like commercial copiers/toner--well, imagine if it was "pay per load".
I mean we're probably going down the road of--in a few years or a deacde--manufacturers being so cheap and the middle-class-eviscerated consumers being so disempowered and poor that it ends up being you have to replace the dryer every 2 years anyway.
This is far more difficult to achieve than you might think, and incredibly illegal.
The contract they negociate with the carrier will probably be closer to $3/drier/year.
Don't worry, the rich will still be able to build faraday cage homes...
Maybe LG needs the audio to sell to advertising. They would have data not collected in the entertainment room.
https://www.ibtimes.com/homehack-attack-vulnerability-lg-app...
So I can get a notification when the dryer is finished.
So I could be alerted if some goes wrong with the dryer or if it needs a service.
The ones mentioned, we could already read in the company's marketing material...
You could get an estimated time for when the clothes are going to be dried. Often I have to switch on the dryer a second time as the clothes aren’t completely dry.
If the water collection tank is full in my dryer it essentially stops drying the clothes so if I could get an alert that the tank was full I could empty it or maybe alert someone in the house that it needs to be emptied.
Often if I’m washing clothes at night I don’t turn on the drier as some people have gone to bed, I normally leave the clothes in the drier. So if I could get an alert based on the weather the next morning if it makes sense to hang out the clothes before I go to work or is it going to rain and the drier will switch it on and be finished before I come home from work.
I found out that it was constantly pinging a Chinese site/portal don’t remember the name. It’s not one of the known famous ones.
I had to disconnect it from Internet..