Smart ovens shouting out to servers in Russia and China

https://svrooij.io/2023/01/25/disconnect-your-smart-appliance/

by pseudotrash • 3 years ago

98 116 3 years ago

Havoc• 3 years ago

I spent last weekend moving my access point behind an opnsense firewall so that I can see what's happening. Things having wifi is grand...but needs to work locally.

I've also had one case already where it works locally (HA) but eventually the device hits a overflow issue if it can't resolve the phone home address.

bognition2• 3 years ago

The device in the article (an internet connected oven) is checking for internet connectivity by pinging: google.com, baido.cn yes, and yandex.ru every 5 minutes.

My guess is this isn't about sending data to those sites, but rather using relying on high availability urls that you can connect to from most countries.

Is this bad engineering? Probably. Is it nefarious? Probably not.

One thing to keep in mind is that the companies making these smart appliances do not make their money from the internet connected features. Internet connectivity may be enough for to push a buyer over the edge or for the device to qualify for some rebate.

The manufactures make them from selling ovens. This means they probably don't have the best software development team or processes.

pyrolistical• 3 years ago

You can never tell if it’s a covert channel.

Maybe it’s signalling bits by slightly differing the timing of each ping. The bandwidth would be extremely low but it’s always connected

mstolpm• 3 years ago

What would be the information the oven can expose over thus a channel? How often I cook? How much energy I use for cooking? The oven will not even know if I'm at home or not if not used. I can't think of any critical spying done that way?

Of course if the oven had cameras and microphones - but then again, the bandwidth of a covert channel would be rather limiting.

tarotuser• 3 years ago

Moreso, you never know if there's some logic bomb inserted in the response.

And it's not at all far-fetched. We have the Sony PS2 Linux yanked away after it being a sold feature. And with a joke of a response to that, indicates that any internet connected device is a rental to the ever-changing terms of the real owner.

sizzzzlerz5• 3 years ago

For now, maybe its only pinging the servers (for which we still don't have the full story) but who knows what happens with the next update, assuming it doesn't brick your device, that is.

jchw• 3 years ago

No fan of the internet of shit here or anything, but I don't think these aspects of the firmware will get any more nefarious. The other terrible things about smart home devices are already well-known.

As usual, I just recommend sticking to only smart home equipment that can work over local radio or some other bus that's not internet connected. Strongly recommend people check out home assistant; for moderate power users it's pretty easy to wrangle a bunch of Bluetooth LE, ZigBee and Zwave devices. I can find off the shelf Zwave devices at my local Lowe's and ZigBee at my local Best Buy (Philips Hue devices work fine for me out of the box.) Of course, when it comes to ovens, you're probably shit out of luck. But whatever. Not sure what serious value add a radio on an oven adds. Guess you can see the timer from the couch...

I'll be keeping my Samsung appliances off the network personally. No real need for whatever SmartThings might offer anyways.

pphysch2• 3 years ago

And literally any piece of Internet-connected software could start doing nefarious things, whether or not it pings google.com (or non-Western equivalents).

This is a sensationalist piece of blogspam, probably designed to get picked up by a unscrupulous tabloid and boost the author's engagement metrics.

Aperocky• 3 years ago

looks like an OR relationship.

Since such an oven won't be able to connect to google.com if it is located in China, looks like lazy/resourceful engineering instead of malicious intent.

kurthr• 3 years ago

I'm stunned that almost anyone would go through the effort of connecting their oven to WiFi. I'll be more concerned when these become 5G connected and start charging you a monthly fee for connection. I wouldn't be surprised if in the future you can get $100 OFF! by signing up for the $5/mo service that you just can't seem to cancel (or it's free for the first year when you sign up with a credit card).

rcme2• 3 years ago

Device manufacturers are starting to build mesh networks so pretty soon your devices won't need to connect to your WiFi in order to phone home.

gkfasdfasdf3• 3 years ago

The best feature of an internet connected oven is that the clock is always accurate. No more manual updates after a DST change.

noefingway• 3 years ago

Just finished reading "Ubik", I found it partly amusing and also prescient that to get thru a door or make coffee required putting a nickel in the slot. Practically everything required a small payment in order to use it. We seem to be almost there: cars, ovens, tv's, dishwashers...the list goes on.

BizarreByte3• 3 years ago

I worked on a project that did this very thing to determine if the software was online. It’s a very common way of doing it, even if it’s not the best way, because it’s reliable, simple, and cheap.

megous3• 3 years ago

Well, just connect to your own service, then? If it's offline, then you will not be able to "sync data" or whatever anyway, even if the device is connected to "The Internet". These connectivity checks sound completely pointless.

distances• 3 years ago

I can't imagine this passing code review on any project I've worked on.

cnorthwood• 3 years ago

When I worked at the BBC, there was a substantial proportion of all traffic to the homepage which were just some devices checking for an internet connection. I believe as part of the move to HTTPS-only there was serious discussion over whether or not there was a public service responsibility to not break some random devices out there, as moving from a 200 to 301 response on http://www.bbc.co.uk might have broken some things.

luckylion• 3 years ago

There should be official services for that. I'm sure Google (or in Germany, heise.de, which publishes multiple IT-related magazines since forever) sees a lot of that as well. The BBC's home page currently weighs in at around 45kb compressed or 230kb uncompressed. Imagine how much traffic is needlessly generated just by connectivity checks, not to speak of the amount of computing power.

jameshart• 3 years ago

Given that nuclear subs were supposed to use the ability to pick up BBC Radio 4 as a signal to determine if London had fallen, I think, no matter how improbable, it would at least be prudent to check the MOD didn’t have any alarms set to go off if the BBC website stopped responding on port 80.

forgotusername6• 3 years ago

I was on the phone with my BT customer support a while back and part of their debug process was to ask me to ping bbc.co.uk.

United857• 3 years ago

Perhaps they just want to make it useful in the Chinese market where Google is blocked by the great firewall without having to have a separate firmware build just for that.

red-iron-pine• 3 years ago

that was my thought -- ping google, which is reachable in the Americas and Europe, and hit the Chinese and Russian sites that might limit Google.

Guess you're out of luck in Turkmenistan, but works well enough most other places.

amelius2• 3 years ago

Is this bad engineering? Probably.

Curious, how would you implement it?

iforgotpassword2• 3 years ago

Yeah I sighed when I got to that point. You have no problem to expose your oven to the internet, but then a ping to Yandex or Baidu is taking it too far? If they wanted to exfiltrate data they'd surely find a way to piggyback it on the legitimate traffic to the cloud service they're using...

counttheforks2• 3 years ago

They're actually making their money from negligence. If you plan to sell an internet connected device you better be prepared to to put care and effort into designing & maintaining it.

karmicthreat• 3 years ago

So what IS the correct way?

gloyoyo• 3 years ago

You can supposedly keep the internet alive with just this method of using your stove...

If you want more look up doomsday survival plan using stoves.

jesprenj• 3 years ago

Why would an oven need Internet access? You physically need to open the oven and put stuff in it and then take it out. Food over IP is not a thing yet.

Unless it has an internal camera with which you can observe the food while it's cooking, I see no advantage of using an Internet connected oven.

edit: okay, preheat, fair - that's actually useful

harveywi• 3 years ago

The electromagnetic radiation from the wi-fi antenna helps the food cook more quickly.

simonsarris• 3 years ago

I'm against stuff like this and totally eschew even offline gadgets, but its not that hard to come up with some use cases.

After you left the house: "Did I turn off the oven? Did I turn off a burner (eg slowly cooking a bean bot)?" Now you can know.

Is a (top or interior or anywhere) burner slowly leaking and should alert the owner? Maybe.

And as you said, pre-heating, though this is actually a feature that makes things more dangerous! If you or someone else was temporarily storing something not-ovenable in the oven and pre-heated remotely, you could come home to something very bad.

nerdponx2• 3 years ago

I'd much rather have the oven connect to a physical device on my home LAN instead, which I could then access through a web interface with a tunneled port or whatever. Same with security cameras, smart lightbulbs, etc. None of this stuff should ever be connecting to the Internet directly.

rcme2• 3 years ago

You could add a camera to the oven to see what's inside from the app.

cbm-vic-20• 3 years ago

I wouldn't mind having "read-only" or "make-safe" functionality: in addition to "Did I turn off the oven?" above, things like timer and burner status would be nice.

A "Turn off oven NOW" button on an app would be an example of "make-safe". Worst case situation is that your dinner is undercooked.

pphysch2• 3 years ago

Preheat, give warnings, etc.

All potentially lethal/flammable objects in your household would probably benefit from some kind of remote monitoring capability, assuming you can do that securely.

sizzzzlerz5• 3 years ago

Maybe they're preparing for a ST:TNG future where you can use an app to tell your food replicator to make tea, Earl Grey, hot while you're arriving home.

dfxm12• 3 years ago

Why would an oven need Internet access?

So Frigidaire, or whoever, can sell data about how and when you use your oven. Maybe this info will be used to show you ads for turkeys on your phone, or even on the oven if future versions have screens.

If one's life is such a blur that they can't wait the 20 min it takes to preheat the oven, with the risks that comes with (is there something already in there that you don't know about, like a flammable cleanser, etc.) then I dunno. I think they can find other things in their lives much more useful.

sizzzzlerz5• 3 years ago

Not to mention most ovens have the ability to schedule pre-heating your oven to a set temp at a later time just using the oven controls.

barbazoo2• 3 years ago

Who buys such data and why I wonder.

MrOwnPut2• 3 years ago

"Oh no did I leave the oven!?"

Opens app.. "whoops I did, toggle off"

"Oh I'll have to cook soon"

Opens app.. "start preheating to x degrees, notify when ready"

"Oh how long do I have left on my roast?

Opens app... "ok cool 30 minutes, I'll continue my workout."

I mean... putting the food in is only one short step in the very long process of an oven.

stuaxo2• 3 years ago

Give phone to child to entertain them - come home to find out they have somehow turned the oven on hours ago.

OT- give a two year old child a device and watch them crash it just by jabbing their finger at it.

barbazoo2• 3 years ago

Interesting those are totally valid use cases but I would NEVER use those through a vendor specific app/cloud. Only locally connected to Home Assistant or something like that via MQTT or some other protocol. I wouldn't want someone from the outside turning my oven on or worse, start the super hot cleaning cycle when I don't expect it the same way I wouldn't want someone having control over my front door or garage.

abruzzi• 3 years ago

not a internet thing, but some Jenn Air ovens had (and maybe still have) a "sabbath mode". Observant Jews would prepare their Saturday dinner, place it in the oven before sundown on Friday, then the oven would turn iself on sometime on Saturday afternoon to begin to cook the food so it would be ready at sundown on Saturday.

A similar use could be used for internet connectivity. not for people skirting sabbath rules, but someone that has the turkey in the oven but doesn't know when exactly they'll get home to eat, but want to start baking it while you're away. Not saying that is a likely of common need, but it could happen.

jeffffff• 3 years ago

i have jenn air appliances and tried to connect to my dishwasher solely because i was curious as to why anyone would want their dishwasher to be connected to the internet. i could never get it to actually work, so i am still in the dark as to what i am missing out on in the world of internet connected dishwashers.

vel0city2• 3 years ago

Many fancy ovens have temperature probes which relate to cooking profiles you can use as well. Being able to actually look at a glance how the roast is doing would be nice. Sure, one could also do this with another device, but having it all integrated is cool.

imtringued• 3 years ago

House fire as a service...

JonChesterfield• 3 years ago

I started to write "surely the network connection can't control the temperature" but, ah, on second thoughts you're probably right. Expect it gives root access if asked sternly too.

somat• 3 years ago

The real wtf here, I mean once you get past how stupid it is that your oven is now connected to the internet. Is why does it need to check if the internet is available? There are two cases, it can reach it's api endpoint and will work, or it can not reach it's api endpoint and will not work. The availability of several well known domains has no effect on this. The only reason I can think of is so you can have a different error message for "the oven service is down" and "unable to access the oven service". Even then you only need to make that check when the api access fails.

Tangently: I don't quite buy the prewarming use case, the only halfway legitimate use case for a internet connected oven is if you are the type to worry if you left the oven on.

pixl97• 3 years ago

Prewarming notification/timer complete is nice especially when I'm gaming/programming and tend forget the world exists.

Also reaching out for NTP and keeping the time updated is useful.

But yea, keeping these internet of shit devices on their own VLAN and monitoring what they are up to leads to a lot of 'um, what is going on' moments.

TheCapn• 3 years ago

Ovens with a probe: is my roast at temperature yet?

Of all appliances in my kitchen the oven makes the most sense to have network features. Fridge perhaps a distant second, and that's only because I really wish I knew my compressor had failed and could've rescued the $350+ of groceries that spoiled if something had alerted me to the temp rising while the compressor was still attempting to run.

iforgotpassword2• 3 years ago

Not that I'd ever connect an iot device to my wifi/internet, but yes, that only reason is the reason. I absolutely would want to know if it's potentially a problem on my end or their end.

tgv3• 3 years ago

the only halfway legitimate use case for a internet connected oven is if you are the type to worry if you left the oven on.

Do they still sell ovens without a timer? Mine (which is quite old) requires setting the time in advance. Forgetting is simply not an option.

Of course, they could start selling ovens without timers to stimulate the sales of internet-connected ones...

jakear• 3 years ago

Certainly they do, mine has 3 primary modes, either just go indefinitely, go indefinitely but ring a bell after a set time, or go for a set time. The easiest mode to get set up is "go indefinitely", so that's what we use the most. Time isn't a great sopping criteria for most baking anyways, probing the interior is much more reliable.

rascul2• 3 years ago

There are some without timers but I've never seen one with a timer that required the timer to be set.

ryandrake• 3 years ago

Checking whether they can connect to google.com, baido.cn, and yandex.ru in order to know whether "the Internet is up" is like me driving to Walmart, Target, and McDonalds to check if the highway system is working. When my actual goal is simply to get home.

The only reason I can think of is so you can have a different error message for "the oven service is down" and "unable to access the oven service".

To the user, there is no difference, because the user wouldn't take different corrective action for each case. How can the user correct it if the appliance's cloud service is down? Just ping your own cloud service and if it doesn't respond, tell the user "Unable to access the oven service. Check your Internet connection, and if it's fine, please wait a bit more."

pokepim• 3 years ago

Tbh as American should I be more worried if my data is shared with some far away government agent who is probably pronouncing my name incorrectly or our domestic favourites NSA or FBI? I believe the current paranoia about China completely overshadows the real danger for american citizens, but maybe that is the intention.

jeoqn• 3 years ago

Wow… Russia AND China… that’s like the axis of evil, dude!

RobotToaster• 3 years ago

Now the entire CCP knows I just burnt this souffle, my god!

BitwiseFool• 3 years ago

Individually the vast majority of IOT data points will not be of any espionage value. But I'm sure intelligence agencies will be able to glean insight from the data in unexpected but still useful ways in aggregate.

tgv3• 3 years ago

Imagine being able to turn on all electric ovens at once in time of war. That already might be enough to cripple your enemy's electric grid.

fwungy• 3 years ago

My oven and refrigerator pump out RF beyond the range of my RF meter.

I found the wifi chips in both and pulled them out. There was no way to turn them off through the interface for either.

Finnucane2• 3 years ago

We have a simple rule: do not buy anything with wifi that does not actually need to have wifi. Which is most things. I've survived my entire life with dumb appliances. Maybe I am just becoming a cranky old man, but there aren't any smart 'features' that seem worth the surveillance and security hassles, as well as the eventual obsolescence and failure of the smart components, which will only serve to shorten the useful lifespan of the appliance. Are we being promised support for 20 or more years of service?

stuaxo2• 3 years ago

Yeah, an oven you can turn on remotely, I'm glad it's secure but that really should not be a thing, no no and no again.

snapetom• 3 years ago

I fucking hate the "It's because of security" excuse companies default to so god damn much. Really burns my hide. 99% of the time it isn't. It's just an excuse to cover lazy or poor product management and engineering.

I'll at least give this company credit for giving an example, but like usual, the response is flimsy. There's almost always much better ways to handle situations these companies claim they're covering.

I recently discovered I couldn't change my email address at Target.com. When I asked the rep why, they responded "It's because of security." I told them, "I know you have nothing to do with the policy, but please let your managers know there's better ways to handle this. One thing you guys can do is never again hire an MFA as a CISO in the future."

dsfyu404ed• 3 years ago

I fucking hate the "It's because of security" excuse companies default to so god damn much. Really burns my hide. 99% of the time it isn't. It's just an excuse to cover lazy or poor product management and engineering.

See also liability/safety and in a more limited set of contexts, national security and children.

The people who really make me want to break out ye olden guillotine are the ones who'll spot the BS in one context but who's knee-jerk reaction is to take it right down the throat or even defend the BS without even a hint of critical thought in another. Have some self-awareness people.

danabrams• 3 years ago

Those spies are going to know I burned the roast!

consumer451• 3 years ago

You know what's much worse? When I was playing with blocking shady countries via pfSense, I found that making a NVIDIA GeForce Now account uses .cn servers by default.

Why?

jonathanlydall2• 3 years ago

My Siemens dishwasher is smart and it’s got a nice feature where from my phone I can set it to start or finish washing at a certain time.

Except, if there is a power failure it forgets the schedule. At the moment in South Africa we lose power 2-4 times a day for 2 hours at a time due to load shedding (useless government and power utility). This powerloss scenario is not a rare edge case here.

It’s a pity because I would like to schedule the dishwasher to start after the power is due back (the load shedding is on a mostly reliable schedule), but with this loss of memory, that doesn’t work.

Relatedly, on my oven (and the AEG one at my previous place) you can’t turn them on until you set the clock, as someone who lives where there are multiple power outages a day, this seems like the most counter productive “feature” ever, is it actually useful in some way?

anonomousename• 3 years ago

If your dishwasher is simply idle until you schedule it, a small UPS may be able to do the job, as during a power outage it would just be powering the electronics and not anything else.

Unrelated, but it sounds like scheduled power outages is a great use case for a backup inverter for your home.

jonathanlydall2• 3 years ago

I actually do have an inverter and solar panels and I have my house divided into two circuits, essential and non-essential.

Non-essential loses power when grid is disconnected, essential is on UPS. I have 10kw/h of batteries, but I’ve set their minimum charge (while on grid) to 40%.

Things on my non-essential: - Geyser - Stove and Oven - Pool pump - Dishwasher - Under floor heating (which is on a timer to only run during sunlight hours).

I have been considering moving the dishwasher to the essential circuit, but if someone accidentally runs it when the grid is offline, it drains the batteries very fast.

What would actually be nice is if the dishwasher could out the box integrate with some sort of home automation system and it could then make decisions to stop it during power outage automatically.

pleb_nz• 3 years ago

This article got me thinking about the use of the term smart. I'm not sure why we call the every connected device smart. For the most part they're connected devices not smart devices. Smart to me means more than just being able to be controlled remotely. I think this is likely been pushed by marketing, but just because corporations say it's 'smart', does that mean we should all blindly start following suit.

On a bigger note, we probably do this blindly for lots of products and services, trust and use the terms we're sold by entities that are mostly only interested in one thing...

I'm as guilty as anyone, bit it would be good if we wised up to this stuff a bit more.

Smart ovens shouting out to servers in Russia and China

Related Stories