Abusing the Internet of Things

(Rick Simeone) #1

  • Statistics collected from police department reports showed an unusually high number of
    burglaries in the high-rise condominiums powered by LifeThings.

  • Private audio recordings of high-profile political candidates discussing secret campaign
    details with their spouses at home had been leaked on the Internet. All four of the candi-
    dates targeted in the leak were known to live in houses served by LifeThings.


Stan Goodin’s article was picked up and syndicated by various media groups around the
world. Simin Powell issued this response on behalf of LifeThings:


The leadership at LifeThings take the privacy and security of our customers very seriously. The
recent article by Mr. Goodin is unfounded since it is based on unreliable statistics and hearsay.
Customers should contact LifeThings customer support directly to report any suspicious activity.

Yet again, the statement released by LifeThings didn’t address any efforts made by the
company to actually investigate the matter. By this time, there was still no advertised method
to contact LifeThings to report a security issue.
A few weeks after Goodin’s article appeared, the researchers who exposed the secure
token issue wrote a blog post stating that they had evidence to prove that the US and Chinese
governments had been logging into the secure.lifethings.com server. They stopped short of
providing any tangible evidence or any additional information about what exactly they had
found the two governments to be using the server for.
Two days later, a hacktivist group with the Twitter handle @against_world_gov tweeted:
“Don’t mess with us, LifeThings. We know you are working with the NSA to violate our peo-
ple’s privacy. This Denial of Service is on us.” Simultaneously, the hacktivist group launched a
denial of service attack on secure.lifethings.com, which prevented all LifeThings devices
from being controllable from the hubs. The same day, LifeThings issued the following
statement:


We are investigating an ongoing Denial of Service attack against our networks that has caused the
LifeThings hub to become unresponsive. We are committed to finding the perpetrators and return-
ing our service to normal.

However, no matter how hard LifeThings worked with its Internet service provider to cur-
tail the attack, the hacktivist group continued to use different armies of botnets to launch
attacks from various locations. Two days after the previous statement, LifeThings issued the
following notice:


LifeThings is committed to returning our services to normal. Customers have been emailed step by
step instructions on how to exchange their LifeThings hub with a new hub (LifeThings2) that is
not susceptible to the ongoing issues we are facing. We thank you for your patience.

A CASE OF ANGER, DENIAL, AND SELF-DESTRUCTION 261
Free download pdf