Abusing the Internet of Things

was a nontechnical issue or a frequently asked question they could answer quickly. If not, the
agents could remotely log in to the LifeThings hub at the customer’s location to service the
request. To do this, they’d type the following command into their computer terminals (assum-
ing the customer’s email address is [email protected]):

$ create-secure-token [email protected]

Secure-token: a7144596f20fe4daf3a3c75f7011c4c5

The Secure-token value would then be used to access the customer’s hub. The service
agent would have to ssh into a server located at secure.lifethings.com using the Secure-
token as a password:

$ ssh -l [email protected] secure.lifethings.com

Password: a7144596f20fe4daf3a3c75f7011c4c5

The agent would then query the hub for attached devices using the hub command:

$ hub -l

1. [Thermostat] [Status: 69F]


2. [Lock: Main door] [Status: Locked]


3. [Lock: Garage door] [Status: Locked]


4. [Light switch: Living room lamp] [Status: Off]


5. [Baby monitor: Bedroom 2] [Status: Inactive]

Here is an example of how the temperature setting of the customer’s thermostat could be
changed:

$ hub "Thermostat" -s "80"

[Thermostat] [Status: 80F]

And here is how the customer’s main door could be unlocked:

$ hub "Lock: Main door" -s "Unlocked"

[Lock: Main door] [Status: Unlocked]

It was also possible to listen in on two minutes of the audio captured by a connected baby
monitor by accessing the audio1.mp3 file by running the following command:

$ hub "Baby monitor: Bedroom 2" -s "2m" -o audio1.mp3

[Baby monitor: Bedroom 2] [Status: Capturing audio to audio1.mp3 for 120s.

Press ^C to abort]

258 CHAPTER 9: TWO SCENARIOS—INTENTIONS AND OUTCOMES