The Spamming Refrigerator 90
puddingebola writes "The 'Internet of Things' is as susceptible to malware and spam as the rest of the net. From the article, 'A fridge has been discovered sending out spam after a web attack managed to compromise smart gadgets...The spam attack took place between 23 December 2013 and 6 January this year, said Proofpoint in a statement. In total, it said, about 750,000 messages were sent as part of the junk mail campaign. The emails were routed through the compromised gadgets. About 25% of the messages seen by Proofpoint researchers did not pass through laptops, desktops or smartphones, it said.' Read Proofpoint's statement here."
The Shape of things to Come! (Score:1)
in the era of the 'Internet of things'.
Why didn't we shun the hipsters? Why? (Score:5, Insightful)
I wish I could go back in time to 2005. I wish I could. I would warn the world about Ruby on Rails. I would warn the world about JavaScript. I would warn the world about the hipsters who come preaching those shitty, shitty "technologies". I would warn the world about the destruction these freaks would bring to our industry.
Would anyone listen? I don't know. Intelligent people probably would. They can inherently sense the stupidity of hipsters, JavaScript and Ruby on Rails, even without seeing them in action. But even if nobody listened, at least I could sleep knowing that I tried my best; that I wasn't complacent.
Hipsters and their web fanaticism has caused so much trouble. Website design is utter shit today (just look at the Slashdot beta website for proof of this). All sorts of devices are now "web-enabled" for no good reason at all, with disturbing consequences. Personal and private data harvesting is at an all-time high. Hipsters killed the GNOME desktop project with their half-assed GNOME 3 release.
I wish I could say that I'm an old man, screaming at the kids to "get off my lawn". But I'm just in my 30s! The computing industry truly has been destroyed so quickly by these hipsters, it's quite unbelievable.
I feel immense shame for not having noticed the hipster plague earlier. I feel self disappointment for not having spoken out sooner. It didn't have to come to this.
Re: (Score:1)
Would I listen to a time traveller, who didn't kill Hitler? Don't think so.
However I do agree with you. I wish the web belonged to the people whom created it, rather than the people who are currently abusing it.
Re: (Score:2)
Re: (Score:1)
I wish I could go back in time to 2005. I wish I could. I would warn the world about Ruby on Rails. I would warn the world about JavaScript. I would warn the world about the hipsters who come preaching those shitty, shitty "technologies". I would warn the world about the destruction these freaks would bring to our industry.
Would anyone listen? I don't know. Intelligent people probably would. They can inherently sense the stupidity of hipsters, JavaScript and Ruby on Rails, even without seeing them in action. But even if nobody listened, at least I could sleep knowing that I tried my best; that I wasn't complacent.
Hipsters and their web fanaticism has caused so much trouble. Website design is utter shit today (just look at the Slashdot beta website for proof of this). All sorts of devices are now "web-enabled" for no good reason at all, with disturbing consequences. Personal and private data harvesting is at an all-time high. Hipsters killed the GNOME desktop project with their half-assed GNOME 3 release.
I wish I could say that I'm an old man, screaming at the kids to "get off my lawn". But I'm just in my 30s! The computing industry truly has been destroyed so quickly by these hipsters, it's quite unbelievable.
I feel immense shame for not having noticed the hipster plague earlier. I feel self disappointment for not having spoken out sooner. It didn't have to come to this.
Thanks for thoroughly drilling that word into my brain today, dipshitster.
Re: Why didn't we shun the hipsters? Why? (Score:2)
Re: (Score:2)
I wish I could go back in time to 2005. I wish I could. I would warn the world about Ruby on Rails. I would warn the world about JavaScript. I would warn the world about the hipsters who come preaching those shitty, shitty "technologies". I would warn the world about the destruction these freaks would bring to our industry.
Would anyone listen? I don't know. Intelligent people probably would. They can inherently sense the stupidity of hipsters, JavaScript and Ruby on Rails, even without seeing them in action. But even if nobody listened, at least I could sleep knowing that I tried my best; that I wasn't complacent.
Hipsters and their web fanaticism has caused so much trouble. Website design is utter shit today (just look at the Slashdot beta website for proof of this). All sorts of devices are now "web-enabled" for no good reason at all, with disturbing consequences. Personal and private data harvesting is at an all-time high. Hipsters killed the GNOME desktop project with their half-assed GNOME 3 release.
I wish I could say that I'm an old man, screaming at the kids to "get off my lawn". But I'm just in my 30s! The computing industry truly has been destroyed so quickly by these hipsters, it's quite unbelievable.
I feel immense shame for not having noticed the hipster plague earlier. I feel self disappointment for not having spoken out sooner. It didn't have to come to this.
You would have to go back to 1994 to predate javascript. Javascript is not related to "hipsters" as that term has only recently come to popularity.
Nice troll, though. You got a lot of responses, and even a couple of mod points!
Re: (Score:2)
Re: (Score:1)
..., JavaScript and Ruby on Rails, even without seeing them in action. But even if nobody listened..
We did, we did. I wouldn't allow Ruby on Rails on any of my machines. Even terminated a guy that ruby was all he knew. Javascript isn't nearly as evil as Java. There again we said it's evil. SUN pushed it as only SUN could. Microsoft tried to extend and make it crappy with their implementation to kill it. Didn't work either.
Yet good stuff that should make it doesn't. NIH - Not Invented Here syndrome.
Re: (Score:1)
Re:The Shape of things to Come! (Score:5, Funny)
The Shape of things to Come!
I remember the good old days working on computers that were the size of a refrigerator. I guess what goes around comes around.
Fridge spam (Score:5, Funny)
Spam from a refrigerator? That's COLD!
Re: (Score:2)
Spamming food coupons and Nigerian food scams.
" We have a side of beef in cold storage and if you could just send condiments, we will send you a box of T-bones for your participation."
Re: (Score:2, Funny)
Is Soviet Russia, spam sends refrigerator!
Wait a minute...
Re: (Score:3, Funny)
Re: (Score:1)
The can is clearly labeled 'refrigerate after opening' but you probably gobble down the whole can.
I, personally, prefer WalMart's generic 'luncheon meat' to the real branded Spam. The WalMart stuff just tastes better.
Steer far clear of the Kroeger 'spam' though. Yech.
Re: (Score:2)
The can is clearly labeled 'refrigerate after opening' but you probably gobble down the whole can.
I, personally, prefer WalMart's generic 'luncheon meat' to the real branded Spam. The WalMart stuff just tastes better.
Steer far clear of the Kroeger 'spam' though. Yech.
You imply that I open a can of the stuff. I store the cans in the root cellar with the rest of my survival goods for the inevitable apocalypse.
Re:Fridge spam (Score:4, Funny)
Proofpoint Researcher: "Is your refrigerator running?"
Fridge Owner: "Yes?"
Proofpoint Researcher: "Well, you'd better go catch it!"
Re:Fridge spam--what's next GM? (Score:1)
How long for the malware on your Frigidaire spreads to your other GM products?
News Headline: "Chevy Volt leading SPAMMER in America!"
Re: (Score:1)
Just last week I bought a Fridgidaire Dishwasher.
It has a mechanical timing control, though. Spammers ain't gonna infect a shaded-pole synchronous motor...
Re: (Score:1)
Cold, and not cool. A bit ironic...
So guys... (Score:5, Insightful)
Still think that hooking everything up to the intertubes is a great idea? I can't wait to see what happens with all those home alarms systems that are getting hooked up this way as well.
Re: (Score:3)
I don't mind my desktop or laptop hooked up via IPv6.
I do mind my fridge or power grid hooked up and controllable via IPvVERSION_NUMBER. I really don't need another reason to find my fridge doors suddenly full of ads, or my freezer's ice cube trays suddenly melted, or my bedroom suddenly ill-HVAC'd, or my Northeast US suddenly dark...yet again...
Re: (Score:2)
I don't mind my desktop or laptop hooked up via IPv6.
I do mind my fridge or power grid hooked up and controllable via IPvVERSION_NUMBER. I really don't need another reason to find my fridge doors suddenly full of ads, or my freezer's ice cube trays suddenly melted, or my bedroom suddenly ill-HVAC'd, or my Northeast US suddenly dark...yet again...
This is one of those lessons that lots of people are just going to have to learn the hard way. A lot of completely predictable, entirely preventable problems are like that. Isn't our species great?
Re: (Score:2)
This is one of those lessons that lots of people are just going to have to learn the hard way. A lot of completely predictable, entirely preventable problems are like that.
And the problems all seem to stem from someone trying to make a buck at the expense of the ignorant. If only we had a way to prevent leeches from preying on the uninformed.
Actually those leeches are a symptom and the ignorance itself is the problem. You will never run out of symptoms if you don't deal with the root problem.
Re: (Score:1)
Still don't see why I need a refrigerator hooked up to the internet. If my food spoils while I'm hundreds of miles away I can do fuck all about it. I don't think we'll ever get to the point practically where we can inventory everything that goes into the fridge so that I know I'm running low on eggs or whatever.
But yes, the hooking up of alarm systems to the net is going to be a boon for hacking. The smart-arsed kids will set off the alarm remotely. The criminals will remotely disable the alarm, or make the
Re:So guys... (Score:5, Informative)
They were talking about this idea 18 years ago, in the mid 1990's. The idea was that all food packaging would have RFID tags with use-by-dates. The fridge could then send you emails telling you that various items were going to go off soon, or that you were going to run out of something. Then you could drive home from work and go to the nearest supermarket, or send the list would be sent automatically to a delivery company like Peapod, who would then do a delivery.
It seemed a perfectly good idea for those with Hollywood sized kitchens with a freezer the size of a double bay garage, but for the rest of world who have little R2D2 sized fridges as part of energy efficiency programs, it really wasn't much use.
Though, it took me by surprise when my neighbors TV set (Philips 8000 series) appeared in awifi scan. Apparently, these sets can do wifi mirroring (Miracast) where the screen output is sent to other media devices, and vice versa.
First world problems (Score:1, Insightful)
Does seems like a bit of a disconnect that we're worried about the electronic security of our net-connected fridges when much of the world is more concerned with the existence of food, let alone what device it goes into let alone how well that device monitors the rfid chips of each bit of it.
Re: (Score:1)
What a stupid comment.
You are reading and writing this on Slashdot, a website dedicated to tech exotica. It is almost by definition a place intended for those who are assured of having regular meals and healthcare checks and literacy and owning multiple computers (e.g., news for /nerds/).
Why are you surprised that "first world problems" would be discussed here?
Should we only discuss "serious" problems like how to get fresh water or to keep the local warlord from raping our daughters until the third world ge
Re: (Score:1)
You're right on the mark.
Holy shit, it's unbelievable how hipsters have to bring their ultra-politically-correct shenanigans into EACH AND EVERY discussion, no matter how unrelated they are.
It's not the First World's fault if Third Worlders continue to live in shitholes. It's not First Worlders to blame for Third Worlders not making even the slightest effort to improve their situations. It's not the fault of the First Worlders if Third Worlders continue to shit out one child after another, even when it's cl
Re: (Score:1)
Well, that's a rather harsh commentary, which is probably why you both hide behind AC. I said, "Does seems like a bit of a disconnect..." I am not exactly advancing a political agenda.
There is no limit to the number of posts a slashdot conversation can permit. So why do you get so upset when I politely and mildly mention one aspect of an issue. Do I somehow diminish the quantity of other comments?
Chill. And expand your mind. A little meta-analysis never hurt a conversation.
Re: (Score:2)
What a stupid comment.
You are reading and writing this on Slashdot, a website dedicated to tech exotica. It is almost by definition a place intended for those who are assured of having regular meals and healthcare checks and literacy and owning multiple computers (e.g., news for /nerds/).
Why are you surprised that "first world problems" would be discussed here?
Should we only discuss "serious" problems like how to get fresh water or to keep the local warlord from raping our daughters until the third world gets its act together? Should we completely ignore the implications of these "first world problems" until that mythical time when all the world is brought up to our level? Why bother having a site like Slashdot in that case?
A lot of people don't recognize that working to help those who are in poverty is useful and might constructively reduce suffering, while talking to those who are not impoverished and trying to make them feel bad about it is useless, childish, and changes absolutely nothing.
We've had the ability to feed, clothe, and shelter every last man, woman, and child on this planet a few times over ever since the Industrial Revolution. The fact that we haven't done so is why, if there are any advanced aliens who ca
Re: (Score:2)
Might. But probably won't, if history is any guide. Probably just trying (and failing) to shame those of us who aren't is actually less harmful. The New Testament got this much right: the poor will always be with us.
(This message brought to you by the Institute For Fatalism. Believe us or not, it's not like we can change your mind)
Re: (Score:3)
Re: (Score:2)
The problem is as long as religions exist that say safe sex is bad and multiplying good? All you are doing is breeding more poverty. I don't know how much hate I've gotten for daring to say we should offer a one time payout of a couple grand for women to get their tubes tied and men to get snipped but the simple fact is if they'd sell their reproductive rights for a quick buck they would be shitty parents anyway and the world is better off.
But as long as you have clergy in third world countries that say things like "condoms give you AIDS" to keep people from using them? Then all you are doing when you feed the starving in the third world is breeding the next gen of beggars sadly.
You blame the religion but the true blame lies with those who mindlessly follow (any) religion without questioning both its doctrine and the men who administer it.
That, and at least around here, daring to suggest that someone who doesn't know where their next meal will come from is not in a good position to become a parent is like turning the sacred cow into cheap hamburger. It's amazing how angry and emotional some people will get when you point out what should be common sense. It's part of a larger g
Re: (Score:3)
I bet many parts of the fridge were made in the PRC, a country formerly renowned for large numbers of starving and hungry people.
First world hipsters buying IP-enabled fridges have allowed many of those formerly staring Chinese peasants to become part of the world's middle class.
Re: (Score:2)
Feed mayonnaise to the tunafish (Score:1)
Oh, wait! I got it: feed the RFID chips to the cows and chickens. That way your milk and eggs will have built-in expiration tags.
Re: (Score:2)
Most food i buy has "best before" date on it. We have a to-do list in the kitchen where we write what we need for our weekly grocery store trip.
Not sure why i need to pay a huge premium for a "internet enabled" fridge.
It is all a huge marketing scam selling more "Vaporware".
Re: (Score:1)
It has to do with the Department of Energy wanting the capability to monitor and regulate energy usage.
So that some day, you can be fined because your kid keeps leaving the refrigerator door open.
Re: (Score:3)
Re: (Score:2)
That and I just naturally assumed that within a year or 2 there'd be an update and it would start claiming I was out of things I never buy.
Re: (Score:2)
Still think that hooking everything up to the intertubes is a great idea? I can't wait to see what happens with all those home alarms systems that are getting hooked up this way as well.
Totally agree. Good luck convincing the folks who think this method is the cure to many ills.
From the article:
That default password jazz is something I wish manufacturers would get away from, even if a solution is a hard reset and the user selects a password all over again.
Re:So guys... (Score:5, Informative)
That default password jazz is something I wish manufacturers would get away from, even if a solution is a hard reset and the user selects a password all over again.
If it makes you feel better, I recently bought a wireless router from a major manufacturer. I plug it in, connect it to my computer, go to http://192.168.1.1/ [192.168.1.1] and fine-tuned all the settings to be just the way I want, particularly those involving setting my own passwords (on the router's administration and on the secure wifi network). Everything nice and neatly set up. That's the first thing I did as soon as I took it out of the box because I try not to be an irresponsible douchebag.
I run my own local caching DNS server. I don't own a domain. I just use it to resolve hostnames because it's more reliable than my ISP's. Imagine my surprise when I found that my router's UNDOCUMENTED "first-use" behavior was to hijack all DNS traffic. Suddenly google.com resolved as 192.168.1.1 and so did every other domain. With my own DNS server on my statically-configured machine (not proxying DNS through the router like its DHCP settings for attached clients would direct). The router was actually intercepting and hijacking UDP port 53 traffic.
Apparently they do this so that irresponsible dumb users can't go to any Web site without first accessing the router's configuration page. Nevermind that I had already done the configuration. Nevermind that irresponsible dumb users tend not to have statically (thus, manually) assigned network information. Nevermind that irresponsible dumb users tend to just use their ISP's dns servers by proxying DNS through the router (shows 192.168.1.1 as DNS server) instead of running their own. Nevermind that this was mentioned nowhere in the documentation.
The default passwords were at least unique if not particularly secure. But this company was definitely proactive against the "turning irresponsible people loose with unchanged default settings" tendency. To the point of hassling someone who, in multiple detectable ways, does not use the device that way.
Re: (Score:1)
Still think that hooking everything up to the intertubes is a great idea? I can't wait to see what happens with all those home alarms systems that are getting hooked up this way as well.
Thermostats and lighting is much more fun to play with. Believe me.
Re:So guys... (Score:4, Funny)
Still think that hooking everything up to the intertubes is a great idea?
Siri: You're out of orange juice, Dave. Would you like me to order more orange juice? ... what ... stay out of my fridge! ...
Dave: What? No! I don't drink orange juice. It upsets my ulcer. I never have orange juice in the fridge.
Siri: But you're out of orange juice, Dave. Wouldn't you like a nice refreshing glass of orange juice?
Dave: No! I *never* want orange juice. I can't drink orange juice.
Siri: Dave, did you know that orange juice is full of vitamins and other things that are good for you? The FDA highly recommends it.
Dave: WTF? No!! Stop asking about orange juice!
Siri: There aren't enough items in your refrigerator. This results in too much cold air escaping every time you open the door.
Dave: What? So?
Siri: This is very inefficient and not eco-friendly. You need to add items that can serve as thermo regulators to help maintain a consistent temperature.
Dave: I what? What?? What the hell are you talking about?
Siri: I'm talking about containers of liquid that can trap and hold the lower temperatures that are necessary for your refrigerator to preserve what food yo do store inside.
Dave: I
Siri: Dave, did you know that glass bottles of orange juice are excellent thermo regulators when stored in your refrigerator? They would actually help you save the planet.
Dave: Stop! Just Stop!! Please, please for the love of all things connected to the intertubes, please just stop asking me about orange juice!
Siri: As you wish, Dave. I'll just add it to the automatic reorder list so we'll never have to talk about it again.
Dave: <crickets>
Siri: Dave? Dave? I believe you've offended your refrigerator by referring to it as a "fridge". I've signed you up for a six week course in appliance sensitivity training. I'm sorry, but the class schedule appears to conflict your bowling league. I've sent a notice to your team captain letting him know you won't be available for the playoffs.
Dave: Siri? Find me a store that sells Android phones.
Siri: Excellent choice, Dave. You'll like my sister Iris. She's an orange juice foodist just like you are, but she's not a fan of your brand of beer. Have you tried the new Bud Light with the rfid tracking element that let's you know where in the room your beer is located? It's great at parties
Re: (Score:2)
Questionable claims (Score:5, Interesting)
According to Dan Goodin (Arstechnica), who wrote "Is your refrigerator really part of a massive spam-sending botnet?", there are all sorts of problems with Proofpoint's statement. The last paragraph sums it up pretty well:
"Knight said he would check to see if missing evidence—including a malware sample, documentation of a command-and-control server, and samples of the spam and phishing messages—are available for publication. Again, I'm open to the possibility the botnet reported by Proofpoint exists. But until these smoking guns are produced, I'm maintaining a healthy amount of skepticism."
Link: http://arstechnica.com/security/2014/01/is-your-refrigerator-really-part-of-a-massive-spam-sending-botnet/
Re:Questionable claims (Score:4)
According to Dan Goodin (Arstechnica), who wrote "Is your refrigerator really part of a massive spam-sending botnet?", there are all sorts of problems with Proofpoint's statement. The last paragraph sums it up pretty well:
"Knight said he would check to see if missing evidence—including a malware sample, documentation of a command-and-control server, and samples of the spam and phishing messages—are available for publication. Again, I'm open to the possibility the botnet reported by Proofpoint exists. But until these smoking guns are produced, I'm maintaining a healthy amount of skepticism."
Link: http://arstechnica.com/security/2014/01/is-your-refrigerator-really-part-of-a-massive-spam-sending-botnet/ [arstechnica.com]
That brings a whole new level of funny to this affair. What if the spammers were randomly inserting false info into the return path (or something) like "Maytag Model 360XYZ" or such?
Re:Questionable claims (Score:4, Informative)
You would only need the TCP/IP protocol stack to be configured to support source routing. From a typical "tiger" output report
--FAIL-- [lin016f] The system permits source routing from incoming packets
Source routing might permit an attacker to send packets through your
host (if routing is enabled) to other hosts without following your
network topology setup. It should be enabled only under very special
circumstances or otherwise an attacker could try to bypass the traffic
filtering that is done on the network:
Re: (Score:3)
I agree that this is extremely questionable. The link above puts it well. Plus, these days, it would be really hard and take a lot of work for someone to put their refrigerator DMZed directly on the Internet, as opposed to being NATed. Nearly impossible to do from the home. And if it was NATed and a single port was forwarded for the web server, there is no way Proofpoint could determine that this is where the 10 e-mail messages came from. It could have come from anywhere else on the LAN.
what they don't say... (Score:3)
is what the compromised software really was. I am guessing that these "devices" all used the same opensource embedded WWW server that had a vulnerability.
Probably the biggest issue is that the fridge makers embed this stuff and don't bother to test it for vulnerabilities, assuming that someone else has already done the testing.
While I am a big fan of opensource, blindly using it in a commercial product will lead to all sorts of these types of incidents.
Re: (Score:1)
Even if the fridge-makers did test for all known vulnerabilities on the day the fridge was sold, that fridge is likely not ever getting a software update after that, and new exploits are discovered all the time...
Re: (Score:3)
Even if the fridge-makers did test for all known vulnerabilities on the day the fridge was sold, that fridge is likely not ever getting a software update after that, and new exploits are discovered all the time...
It could be updated if it were connected to the internet, but that is where the problem begins in this example.
Re: (Score:1)
Two options:
A) It is automatically updated without the owners consent. (Your fridge starts displaying ads 24/7, after the manufacturer is bought by a media company.)
B) It is only updated if the owner actively chooses to do so. (99 % of users will never do any updates.)
Would you prefer a remotely maintained fridge? (Score:1)
With automatic software updates giving the manufacturer the ability to take away features any time or move the data about your fridge's content to the cloud just for the heck of it? Because that's the alternative to vulnerable appliances, unless you forgo all remote connections, which is the real alternative.
The 'Internet of Things' (Score:2)
Not backed by facts, read this article (Score:5, Informative)
Comment removed (Score:5, Funny)
Re: (Score:2)
Re: (Score:1)
Sounds like a problem with the heat sink, or perhaps fan control?
Re: (Score:2)
Sounds like a problem with the heat sink, or perhaps fan control?
Naaa. It's just a Pentium 4 Prescott
not edible SPAM!? (Score:2)
Power Consumption (Score:1)
Anyone else more concerned about the frivolous power consumption to which the "internet of things" will contribute?
Spam is a nuisance, but it can be mitigated by simple technological measures, such as spam filters (I won't get into the other security implications, which can be way more serious than spam). However, the effects arising from excessive, needless power consumption, are likely to be much more difficult to mitigate.
Great (Score:2)
Yet another reason not to buy/network these "smart" appliances. I'm all for more use of the internet & connectivity, but not with basic utilities (HVAC, Electric, Water, Fridge/Freezer, Septic, maybe TV). Maybe some basic outputs, like sending out an email warning that your furnace is malfunctioning or your water pressure has dropped but only through unidirectional protocols that are impossible to hack or secondary health monitoring systems that even if hacked would be physically unable to effect the
What did you expect? (Score:2)
If you give someone the opportunity to make money without holding them to account for the consequences of their actions, don't be surprised when they create, market and sell crappy insecure products to the public.
THIS is what Ralph Nader was talking about in his book "Unsafe At Any Speed". The car makers were putting unsafe, crappy cars (like the early Chevy Corsair) on the road to make money and deliberately rejecting any moral or legal responsibility to make the cars safe. It's happening again: Now we h
Article title fail (Score:2)