Smart ovens do really dumb stuff to check for Wi-Fi
- Reference: 1674768432
- News link: https://www.theregister.co.uk/2023/01/26/smart_ovens_do_dumb_stuff/
- Source link:
The latest word on the subject comes from Stephan van Rooij, a software architect with Smartersoft BV in the Netherlands and a Microsoft MVP in security.
Van Rooij is the owner of two AEG smart appliances – the AEG Built In Combination Microwave (KMK768080B) and the AEG Oven (BSK798280B). As he noted in a [1]write-up this week, these appliances weren't purchased for their connectivity – the fact that they had Wi-Fi was only discovered after they'd been acquired.
[2]
Internet-connected devices, van Rooij explained, often check to see if Wi-Fi is available, so they can phone home and do whatever it is they need to do. Companies like Apple, Google, and Microsoft have dedicated endpoints to receive network availability checks.
It checks three public websites every 5 minutes
Van Rooij argued other manufacturers should follow this example and set up their own endpoints so they're not relying on an external site that may be unexpectedly unavailable.
Nonetheless some suppliers looking to verify wireless network connectivity simply query popular public websites, figuring they'll probably be available. According to van Rooij, that's what Electrolux-owned AEG has done.
[3]
[4]
"AEG chose the easy route, and checks three public websites every five minutes when connected to your Wi-Fi," he said, noting that its smart ovens ping google.com, baidu.cn, and yandex.ru.
Google.com is widely recognized. People in the US and Europe may be less familiar with Baidu.cn, a popular search engine in China, and Yandex.ru, a widely used search engine in Russia. (Incidentally, Yandex had its source code [5]allegedly stolen by a former employee and leaked online as a 45GB archive.)
[6]
"I really don't like the fact that my oven connects to China and Russia just to check if it has an internet connection," said van Rooij. "If that is the only thing it’s doing."
[7]Why do Smart TV UIs suck?
[8]President Biden still wants his cybersecurity labels on those smart devices
[9]Reg reader returns Samsung TV after finding giant ads splattered everywhere
[10]Smart fridges are cool, but after a few short years you could be stuck with a big frosty brick in the kitchen
This sort of network activity, contacting servers in other countries, is commonplace among smart appliances, not to mention software applications and many of their incorporated SDKs. As noted in a [11]2019 research paper [PDF] on the topic, "Information Exposure From Consumer IoT Devices," 72 of 81 devices examined were found to send data to third parties.
There's nothing necessarily nefarious about network availability pings, but given the abundance of IoT security vulnerabilities and the needless emission of IP address data to search firms in China and Russia, concern may be warranted.
Van Rooij noticed the network traffic because he uses Pi-hole software to do DNS-based ad filtering. And [12]others who have implemented similar network filtering report being similarly surprised by the chattiness of their kit.
The Register asked the US spokesperson for Sweden-based Electrolux to comment and we've not heard back.
[13]
When we spoke to van Rooij, he said that he had just heard back from the manufacturer's press department on Thursday morning, which he had messaged after failing to get a response from customer support. "I couldn't get anyone to talk to me," he said. "Now they're talking."
Van Rooij said he was particularly concerned about undisclosed connections to China and Russia and argued that a connectivity check could be done through the oven's existing undocumented API, which is used to control it remotely – a separate security risk – using a mobile app.
"My suggestion is the oven already has an API in the cloud that should be used to check connectivity," he said.
Asked what he'd like to see happen with these sorts of appliances, Van Rooij referred to his blog post remarks calling for local control over Wi-Fi rather and for making any cloud connection optional.
"I think that companies developing appliances that want to "smartify" should first consider having local control on the current Wi-Fi network, and then make the cloud optional," he said. "You don't buy a device for a year – they last five to 10 years. I'm worried that people may rely on the cloud functionality and these companies don't have the incentive to keep the cloud running for years." ®
Get our [14]Tech Resources
[1] https://svrooij.io/2023/01/25/disconnect-your-smart-appliance/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y9MGEKQC0yvVZY61gjT59QAAAE8&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y9MGEKQC0yvVZY61gjT59QAAAE8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y9MGEKQC0yvVZY61gjT59QAAAE8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.securitylab.ru/news/536078.php
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y9MGEKQC0yvVZY61gjT59QAAAE8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2012/11/21/feature_why_do_smart_tvs_suck/
[8] https://www.theregister.com/2022/10/20/biden_administration_iot_security_labels/
[9] https://www.theregister.com/2021/11/05/samsung_tv_ads/
[10] https://www.theregister.com/2020/06/08/smart_fridges_support_periods/
[11] https://moniotrlab.ccis.neu.edu/wp-content/uploads/2019/09/ren-imc19.pdf
[12] https://www.linkedin.com/feed/update/urn:li:activity:7024361746597335040?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A7024361746597335040%2C7024365496611262464%29&replyUrn=urn%3Ali%3Acomment%3A%28activity%3A7024361746597335040%2C7024368262712848384%29
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y9MGEKQC0yvVZY61gjT59QAAAE8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[14] https://whitepapers.theregister.com/
Ditto my microwave oven, which was chosen on it cheepness from Argos about 20 years ago. It has two dials, one sets the power level and the other is the mechanical timer that turns it off when it runs down.
It also gives a satisfying clockwork type “ding” when it has finished, rather than the soul penetrating beeep…Beeeep….BEEEEEP!
20+ years ago most cheap appliances were still being built well enough to last a long time, now though you'd be lucky.
Being over built for the purpose used to be norm.
Microwave...
Bought mine when I bought my first flat, age 21. That was August 1989.
Still works fine 33 1/3 years later.
My other half has had 3, maybe 4, in the 14 years I've known her.
"Smart TVs" just as bad
My Panasonic smart TV tries to connect to Panasonic end-points on a regular basis to check for connectivity. My PiHole log shows regular SERVFAIL responses from these end-points. It also tries to contact a dedicate "usage..." domain (blocked) and apparently funnels all traffic through Panasonic servers for a "consistent experience". Consistently sub-par being the result. Needless to say I use other devices that I trust only a little bit more (looking at their traffic) and don't use any of the smart features on the TV.
Is it me? I just do not get why you would want to take a simple piece of kit and add a mass of complexity with who knows what vulnerabilities and which shortens the useful life of the kit all to add 'Using a mobile phone' to the features?
As the previous commenters have said, these things should last decades and I would struggle to find a single reason why being able to use a remote control is actually a good thing. OK, a remote for a TV is good but why allow the manufacturer to change the user experience after you have bought it or to track what you choose to watch.
It’s not you.
It’s them.
The manufacturers want these to be useless sooner rather than later. What use is there making something that lasts 20+ years when they can force you to buy a new one after four or so years? Might not be the same manufacturer but if they all do the same thing then all of them sell more kit over time.
Baidu.cn and Yandex.ru.
Here in Europe (and UK) we know all about these nefarious websites that allow you to bypass super-injunctions by celebrities amongst other things you won't find on google and I'm not talking about illegal stuff. Just stuff you wont see at home. I don't think there is one super-injunction I have never been able to find or scandal involving
As for all this sneaky wifi I only have one question. Why? What do they hope to gain? Shut off after a few years? Who knows?
Frightening
The whole idea of being able to switch on/off or operate a domestic appliance when you are not in front of it just fills me with dread. Especially one that gets hot enough to burn your house down, or wet enough to flood the place. Since you filled the oven or washing machine this morning, how do you know what has happened?
I'm sure the handbooks for these devices used to say "never operate this machine unattended" or similar (maybe they still do) but now they want you to actually operate it when you are miles away with no visual or other sensory connection.
And there are people lapping this up as a great advancement?
God help us.
"You don't buy a device for a year – they last five to 10 years."
That's really, really terrible. My "dumb" oven came with the house that I've lived in for about 20 years now. It had fake woodgrain on the control panel until my better half covered it in contact paper.