3

I recently purchased a fairly sleek LED lamp. Like most new-fangled furnishings it comes with a pile of unnecessary features including bluetooth, wifi, and a mobile app.

Hence my new-found paranoia. I hate connected devices, but I've long taken comfort in that I never connect these devices to the internet.

This morning though, I had a thought: can't these devices all talk to each other anyway?

For example, I live in an apartment complex. My lamp could in theory talk to my neighbors lamp, and now my lamp has an exit.

This has also made me really paranoid about my knock-off Raspberry Pi that I use as an OpenWRT.

How do I know with certainty what hardware is on these devices?

I get this sneaking feeling all these IoT devices and microcomputers are a modern trojan horse.

4 Answers 4

4

This morning though, I had a thought: can't these devices all talk to each other anyway?

For example, I live in an apartment complex. My lamp could in theory talk to my neighbors lamp, and now my lamp has an exit.

In theory they could sit there computing Pi to a trillion decimal places, but they probably won't.

To communicate with each other locally over WiFi, they would both have to be connected to the same access point (or two access points on the same LAN). Alternatively, one could set up an SSID and the other could connect to it - a possible scenario, but improbable. They could communicate over the internet using the manufacturer's service, but there's no reason for them to do that for arbitrary unrelated devices owned by different people who don't know each other.

To communicate with each other over Bluetooth they would need to pair with each other. Again this is exceedingly unlikely.

How do I know with certainty what hardware is on these devices?

Take them apart and look. The hardware is not really that important though - it's the firmware on top that implements the behaviour.

I get this sneaking feeling all these IoT devices and microcomputers are a modern trojan horse.

This feeling is entirely unfounded. If you reverse engineer any cheap IoT device you'll almost certainly find that it was put together with the bare minimum level of engineering effort by someone who had neither the time nor pay package to enact world domination on behalf of their employer.

2
  • Point taken—but would you really trust a router from a foreign manufacturer--particularly from an adversarial country?
    – fny
    Commented Oct 12, 2022 at 6:47
  • That's just xenophobia.
    – Polynomial
    Commented Oct 13, 2022 at 12:22
1

I get this sneaking feeling all these IoT devices and microcomputers are a modern trojan horse.

Maybe not directly from the manufacturer but they probably can be made into that through an update.

The only thing preventing your lamp or RPi router to talk to a neighbours device in a meaningful way is encryption and the software running on those devices. Data is constantly being send from all your (wireless) devices dozens of meters or more in every direction just by design. Just like your neighbours devices are sending data to you.

In order to know what hardware these devices use you need to take them apart or look for some tear down online. They often use RISC or ARM processors with either onboard or additional flash on SPI for firmware. New "features" are just an update away.

While Polynomial is right, that no factory is going to bug you or the majority of users on purpose, you could argue that they do not care about security either and that the telemetry which these devices emit could also be called reconnaissance.

1

Hence my new-found paranoia. I hate connected devices, but I've long taken comfort in that I never connect these devices to the internet.

This morning though, I had a thought: can't these devices all talk to each other anyway?

For example, I live in an apartment complex. My lamp could in theory talk to my neighbors lamp, and now my lamp has an exit.

Totally could. I've been on projects where a client asked us to route traffic from any device, no matter the customer. In their defense, they had the best of intentions ("what if the internet went down?"). This is less likely over wifi/bluetooth and more likely with custom radio stuff.

But Apple Airtags are BT based and will reportedly route their traffic via any Apple phone available. So, within a company/family of products, there can be room for neighbor routing. I'm not sure I've seen reports of cross-company neighbor routing.

How do I know with certainty what hardware is on these devices?

It's less the hardware and more the software that you're concerned about. Where possible, stick to products which contain vetted open source software. OpenWRT is an acceptable example of this. With as many line of code that exist in these projects, no one can say they are free from backdoors/nefarious behaviors, but it's less likely than closed source projects.

0

A lot of embedded devices have known to have Bluetooth stack vulnerabilities, for example BlueBorne ( https://en.wikipedia.org/wiki/BlueBorne_(security_vulnerability) ). So your neighbor indeed is capable of taking over your lamp, if it is vulnerable, and going lateral, by getting credentials to your WiFi network.

But this requires some level of sophistication from threat actor and radio proximity to your LED lamp, so the risk is not high.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .