We need to talk about criminal adversaries who want you to eat undercooked onion rings
- Reference: 1618918625
- News link: https://www.theregister.co.uk/2021/04/20/cisco_talos_corosi_fryer_flaws/
- Source link:
Specifically, Cisco's infosec arm [1]said it had tested and confirmed that the Cosori Smart 5.8-Quart Air Fryer CS158-AF, version 1.1.0, could be exploited by a theoretical fried-chicken-hater. As we've confirmed, the device – and we note there is a virtually identical "non-smart" one for the same price – is still widely available for sale.
[2]
The two flaws (CVE-2020-28592 and CVE-2020-28593) are both server code execution vulnerabilities. An attacker could exploit them by cooking up and sending a specially crafted packet to the device that contains a unique JSON object, which would then allow them to execute arbitrary code.
Determined chip monks , fryer tucks attackers can then "change temperatures, cooking times and settings on the air fryer, or [even] start it without the user's knowledge."
[3]
[4]The Internet of Things is a security nightmare, latest real-world analysis reveals: Unencrypted traffic, network crossover, vulnerable OSes
[5]So you're doing an IoT project. Cute. Let's start with the basics: Security
[6]IoT security? We've heard of it, says UK.gov waving new regs
[7]Teach citizens IoT dangers, engineering students cybersecurity, Uncle Sam suggests
Talos [8]said in the vulnerability reports that Corosi had not responded "appropriately during the 90-day period as outlined in the policy" before it went public. Which means that air-fryer users sadly have no fix from the vendor, despite the fact that the researchers apparently first contacted them about the issue just before most people had air-fried their 2020 Christmas goose.
We've contacted Corosi for comment.
Cisco's infosec arm advised that folks using open-source network intrusion detection system Snort to sniff out suspicious traffic (whom we doubt would be the same peeps appending Wi-Fi air fryers on their home network) could detect exploitation attempts using the 56729 rule. Check with [9]Snort.org for the most current rule information. Or, you know, just boot it off the network and use it like a normal airfryer.
The kicker? "The adversary must have physical access to the air fryer for some of these vulnerabilities to work."
Yes. It's someone you've spent... oh, a little bit of time with in lockdown. What was that? I'm typing too loudly?
[10]
Guess what, love. Nobody likes soggy chips. MUAHAHAHA. ®
Get our [11]Tech Resources
[1] https://blog.talosintelligence.com/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YH76mYxBpHCC98L2oq1yCgAAAJg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YH76mYxBpHCC98L2oq1yCgAAAJg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] http://www.theregister.com/2020/03/11/internet_of_things_security_nightmare/
[5] http://www.theregister.com/2018/06/25/iot_best_practices/
[6] http://www.theregister.com/2020/01/28/uk_government_cracks_down_on_iot_security/
[7] http://www.theregister.com/2018/01/09/us_govt_cybersecurity_recommendations/
[8] https://talosintelligence.com/vulnerability_reports/TALOS-2020-1216
[9] https://snort.org/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YH76mYxBpHCC98L2oq1yCgAAAJg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://whitepapers.theregister.com/
Yes, although it does a lot of other things as well. Very useful it is too.
No, it is not "connected".
Nope. I have once of the Ninja ones and it gets used 3 or 4 times a week for baking, roasting and frying.
It's one of those gadgets that really has made a difference in my kitchen and thankfully does not have the option of needing to connect to the intertubes.
I've got a Cusinart one that's probably going in the trash. It's failed miserably at everything its tried to cook.
Next to the low fat grill thing and the old dark room kit?
Why?
That is all
Re: Why?
Because it will sell. That's all.
Re: Why?
Exactly!
The crime here, is connecting an air fryer and many of its other kitchen cousins to the interwoo.
Re: Why?
Can you then connect it to your Karcher power washer via a Bluetooth App?
Re: Why?
Because otherwise it couldn't connect to Alexa
Re: Why?
It gets worse. A friend of mine has some clever boiler thing for cooking carrots at the perfect temperature. He is able to monitor progress from anywhere in the world using an app on his phone.
Worse still, the carrots have to go in a specially sealed plastic bag (single use).
"there is a virtually identical "non-smart" one for the same price"
Jolly good show! Common sense prevails after all? Why on earth would you want your fryer to talk to your phone? Although it's not a deep fryer (extremely dangerous) it must still pose some hazard, so you should be watching it. Furthermore, according to Business Insider, the "smart" features " aren't as useful as they could be ".
I strongly suspect that, apart from the "digital = good, analog = legacy" angle, app control works out cheaper to manufacture than having physical controls on the appliance, which is largely why items like DVD players have progressively dropped front panel controls in favour of "remote only". The most extreme example of such cost cutting is $15,000 dollar oscilloscopes with minimal unergonomic multi-function front panel controls but touch screen control. That's right, spend fifteen grand on it then cover the information screen with finger marks and scratches.
Re: "there is a virtually identical "non-smart" one for the same price"
To be fair, the majority of users for things like oscilloscopes will use the web interface anyway. You want the connection to be able to capture data anyway, and if you're doing delicate experiments that don't want humans nearby, or dangerous ones where you really don't want anyone nearby, a remote interface is by far the best option. The touchscreen is essentially just optional local access to the normal controls, instead of having to implement an entirely separate second control system using knobs and such. We have oscilloscopes that haven't been touched in a decade or more other than to occasionally plug in a different cable.
Re: "there is a virtually identical "non-smart" one for the same price"
"you should be watching it"
That's what the kitchen-cam is for.
Capitalism has a lot to answer for lol
That Lol Creme from 10cc, is he some kind of comedian?
Hmm, yet another company...
...that makes a "cool connected gadget", sells it, then ignores problems.
There's a part of me that suspects a lot of these companies can't fix bugs, as their involvement was barely more than slapping their own logo on something mass produced in the Middle Kingdom.
Re: Hmm, yet another company...
I think it is more that they are kitchen appliance manufacturers who just don't understand what selling computers involves.
false dichotomy
They are mass-produced Chinese kitchen appliance rebranders who just don't understand what selling computers involves.
Cisco's infosec arm advised that folks using open-source network intrusion detection system Snort to sniff out suspicious traffic [...] could detect exploitation attempts using the 56729 rule.
Katrinab advises that people could avoid this hassle by using a dumb airfryer.
It doesn't have robotic arms to take the chips or whatever out of the freezer, and put them on the plate when cooked. So you still need to physically operate it. Once you are finished putting the chips [etc] in it, it is surely far easier to press the physical on button on the thing than mess around with a smartphone app to do the same thing.
Flame bait
Chip pan fires used to be enough of a thing in the UK that we had Public Information Films about wet tea towels and not throwing water at them, so I could see the benefit of an appliance that called the emergency services when you set the kitchen on fire. I guess ordering a new product and tipping off local painters & decorators might be taking it a bit far though.
Re: Flame bait
"I could see the benefit of an appliance that called the emergency services..."
Benefit to whom? Purpose-built smoke and fire detectors made by experienced safety appliance manufacturers have frequent false positives and false negatives; why would you trust a Chinese air fryer manufacturer to get it right? The only people who'd benefit are firebugs who can get away with setting fires somewhere else while emergency services are tied up responding to false alarms triggered by crap kettle firmware.
Re: Flame bait
>Chip pan fires used to be enough of a thing in the UK that we had Public Information Films
Chip pan fires used to be enough of a thing until we got oven chips.
Only true [1]connoisseurs of the deep fried vegetable still used chip pans after McCain's breakthrough
[1] https://www.london-fire.gov.uk/news/2014-news/brigade-blames-posh-chips-for-rise-in-chip-pan-fires/
Deserve what you get ...
Well ...
Anyone stupid enough to purchase a connected anything for the kitchen deserves what they get for such nonsense.
O.
Does anybody have an air fryer that isn't boxed up in their attic?