Security exposure with internet connected homes
-
I am a pretty active forum user over on the QNAP forum and there has been a number of viral threads there and on reddit about the spread of ransomware on these NAS.
I wanted to post here to say that this is a fresh reminder to be very cautious with the current state of the affair when it comes to smarthomes and the trend towards IOT we are observing from all these companies attempting to make our homes cloud dependent, opening so called "secure tunnels" to their servers which can turn into very real exposures to your LAN (home network).
In order to mitigate it, QNAP released a firmware which now has autoupdate enabled by default (reminds me one other company...) and IMHO is the climax of absurdity but in fact when I come to think about it is how the amazon echos and ecobees work for example without even offering the ability to disable.
I am in no way a security expert but have had enough exposure and interest about it to recommend using a real firewall for your home network to block these backdoors if you have a smarthome and avoid these cloud oriented platforms and devices as if they were COVID.
-
I'm your man if you want to talk about cyber security
Doing that for the last 25years! -
It's better in two ways that I can see:
- They don't auto-update their firmware by default. This exposes you to surprises when you come back to a broken system. I went on a very long tirade on the ecobee forum years ago about how risky such a feature is only to find out the amazon echos are doing the same thing. I was very happy to get rid of all of these devices. These companies think that this is a security feature because they automatically load security patches in these updates for ignorant users. The problem is the downtime these automatic updates create and risk of breaking something during the update or within the firmware itself. It is not so different from the nightly heal philosophy. The thought of automating a maintenance is all good intention but it is pushing downtime and often very high risks of breaking something without any control.
- They don't send your voice recording for processing if it can process locally. It does send the STT (Speech to text) output though whenever it can. This is more a privacy issue than security.
They are still cloud connected devices so there is still an exposure. If their servers get hacked and your credentials are exposed, one can actually take control of your homekit. The connection from their server to your device though is much more secure (than QNAP's default scheme which exposes a lot of things). Maybe @DesT will have more knowledge of this.
Homekit isn't by any stretch of the imagination more secure than the Google or the Amazon platform. It is just a bit better in terms of privacy and much better in terms of performance and reliability. The ideal security is for it not to be connected to the cloud at all which was Rhasspy or Mycroft are offering. -
yeah.... rule #1 in my work is:
Connected=hacked
Cloud=leakSo of course, I'm also a non-cloud user as much as possible and it's one of the reason why almost all of our clients are not "cloud" too!
I'm 100% for doing regular update BUT never automatically and even more for firmware. Firmware can break thing often and it's always too late after!
We are also always checking what's the RELEASE NOTES are saying about an update to check if something can break and also checking on internet if ppl are complaining about an update that break something.
The problem with things like QNAP it's the service they offer to allow people reaching their "data" from Internet by using their cloud service to send you back inside your home network! That's why I will always prefer having a VPN connection from my device directly to the home network when necessary.
Just google what happen with Solarwinds and you will have more fear about being "connected"!
-
Totally agree
And being a long term QNAP User myself, I’ve so far (touch wood) avoided any of these attacks, but I put that down to the obvious and never exposing my NAS to the internet, I’m amazed at how many people place theirs at the perimeter - and I agree QNAP don’t help, as they have add-ons that almost encourage it.
I appreciate nothing is going to be 100%, but for a while now I’ve been happy with my UniFi Secure Gateway (Router) with it’s VPN capability which allows me to connect back in as/when I need to.
-
I am still following the events unfolding. It is indeed amazing to me how many people had their NAS open and accessible directly through port forwarding...
-
Another week has passed and now there is a breach in the Eufy security camera platform and we have seen what has happened to the Colonial pipelines in the US... I wonder who is next. Highly encourage people to be much more deliberate and conscientious with what device you buy and install in your homes...
-
@sender said in Security exposure with internet connected homes:
@rafale77 it functionality vs usability... if you do not forward specific ports (smtp, ftp, etc) you van not use the device as intendes. And placing it behind a vpn is not workable in that sense...
Well that rather depends on the device. Alexa, for example, requires no port forwarding. A NAS probably would but can be accessed via a VPN.
For example my mail server does need very specific ports (obviously) but they are not forwarded. I connect to my own VPN end point.
The only port I have open is a non-standard SSH port. However Alexa creates her own connections which may be insecure.
So not quite sure what case you're looking at here.
C
-
@CatmanV2 is correct. It's not just about port forwarding. In many case it is the cloud server getting hacked, exposing your credentials and allowing people to access your account. The reason for my post about being careful with the devices you buy... is more related to smart home devices or I would say IOT devices getting hacked from the "I" internet. The latest as of this morning about Eufy cameras is an example. See here
https://www.reddit.com/r/EufyCam/comments/neayuo/access_to_random_cameras_in_another_country/It always blew my mind that anyone would want their cameras to stream anywhere outside their own network besides through a direct VPN but... you see all of these cloud doorbells and cloud cameras services but the same is true for all the other smart thermostats etc... which I have either eliminated or am isolating and aggressively blocking access to/from WAN.
-
Well this, frankly.
My alarm installer was looking some new tech that could actually interface with z-wave, which was of interest. Turns out that all its security functions are cloud dependant....
C
-
@sender said in Security exposure with internet connected homes:
@catmanv2 hence I have a separate vlan/sybnet for "tunneling" and outbound session things (mostly IOT). And specific ports forwarded to a nas (compared to a vpc but locally managed)
I should really do the same thing. But I'm not convinced that there's really much benefit. My Alexas still need to talk to HA bridge. I guess I could put HA bridge on a separate machine and then allow only connections from that IP into the main device but that doesn't seem any more robust than the current set up.
Perhaps a better piece would be to separate all my critical services so keep NotVera and HA bridge and Alexa all on a separate subnet.
C
-
Could be a bizarre follow up to a post I made on another thread but it may be more related to this topic so I am posting here. Oddly things are unraveling... It is confirming my own observations that Android devices seem to send a lot of data, a lot more than iOS devices even when you don't them to. This is odd because of how hit and miss geofence on android has been yet I am observing that they update Google about where your device is a lot more frequently and with a lot more "details" than iOS devices do.
'Apple is eating our lunch': Google employees admit in lawsuit that the company made it nearly impossible for users to keep their location private | Business Insider India
Google misled phone makers into hiding privacy settings users liked in order to collect more location data, according to newly unredacted documents.
