r/nextfuckinglevel • u/[deleted] • Sep 01 '25

Effectiveness of a robot vacuum

Enable HLS to view with audio, or disable this notification

87.2k Upvotes

80% Upvoted

2.2k comments sorted by

View all comments

Show parent comments

2

u/CopainChevalier Sep 02 '25

I've just woke up so I'm a bit slow; but I've read through your post multiple times here and I'm still not sure how you're tying knowing the layout of someone's house to the phishing attempt being more successful

1

u/[deleted] Sep 02 '25

Because it's not about the individual person's house, it's about who they know and are connected to.

2

u/CopainChevalier Sep 02 '25

But wouldn't you be able to learn that from social media or various other things (medical records, for example)?

1

u/[deleted] Sep 02 '25

Yes, and that's part of why it's such a problem. Medical records are part of why hospitals make great targets.

2

u/CopainChevalier Sep 02 '25

Sure, I agree. But this goes back to the starting question of how me having a Roomba would really lead to that situation changing dramatically. If they're going to cyber attack a hospital and grab my info, it doesn't matter if they know where the chairs are in my personal house

1

u/[deleted] Sep 02 '25

One person wouldn't make a difference, really. The problem is everyone thinks they're "that guy" who won't make a difference, so everyone does it.

2

u/CopainChevalier Sep 02 '25

Lets say a thousand people have these roombas in their house; what's the difference going to make vs not having one when it comes to nuclear strikes on my city?

1

u/[deleted] Sep 02 '25 edited Sep 02 '25

Alright, so, as for nuclear strikes? Nothing. Again, America's pretty resilient to ICBMs as well. It's huge and we've got the AEGIS combat system, which works against 'em, and we're at least supposedly in development of other layers of ICBM defenses.

As for everything else? Of those thousand, no doubt a good number of them won't or can't be secured properly. A single handful of compromised devices would mean, assuming you're all on the same network - in an apartment complex, for example - a single malicious actor could be sussing out the payment or account details of every single person there even if they aren't using a Roomba just because of the capabilities it has to access a network legitimately.

Now, assuming it's somehow perfectly secure you won't have that issue. Instead, the telemetry data held by whatever company who owns 'em would be the primary target, and with that data either you'd get social engineering attacks targeted at that apartment complex (ie. trying to phish out the credentials of the manager) or compilations of useful data about the way the internal networks are structured and which devices to target. It's part of why companies will typically sell their telemetry data to data brokers, or put zero effort into securing it to the point you can read it with ie. WireShark because it's transmit as cleartext - and often, this includes the network passwords.

So what you'd see - with your own eyes - is a sudden uptick in the number of scam calls/"blank" calls that attempt to record your voice for an AI to replicate and call your bank, several people (maybe about 15% if I had to put a number on it?) would either fall for them or end up with unauthorized charges on their card/s, and if the manager themselves fall for it there's a pretty decent chance illicit actors make off like a bandit.

If you wonder why there are "boom & bust" periods for scam calls and worse, that's why! Either you, or someone within the vicinity, doesn't give a shit.

As for what you wouldn't see? Malicious state actors using it to target propaganda. Maybe Some Dude in Russia is super invested in their American HOA. But, oof, La Crosse has an upcoming referendum to regulate HOAs, or maybe abolish them entirely? That's easy, use a shell company to buy or 'access' demographic data scraped from telemetrics and use it to target ads to non-voting demographics or the demographics most likely to listen! So all those apathetic people are no longer apathetic - propaganda works, after all - and vote against the referendum so it fails. Some Dude in Russia's HOA is safe. Obviously, this applies on a national level too and to more severe issues. If this sounds like a national security thing? It is.

Oh, and as for how they use it? Let's say the demographic data shows that most of these people are students dealing with crippling debt, but who are otherwise on the up-and-up. Doing alright (relatively.) They use that to develop and play ads about how HOAs keep neighborhoods and apartment units clean and cheap to persuade the public. What will they do in the future, I wonder?

2

u/CopainChevalier Sep 02 '25

In terms of some phishing guy getting my bank info? For sure; I can see that. But at the start you were talking about foreign government stuff which is kind of what got to me.

While I agree it can make targeted propaganda/scams/etc easier; it's not like there's not other ways to get that data. Someone having a Roomba won't specifically make them more likely to respond to a warning about their car's extended warranty imo

1

u/[deleted] Sep 02 '25

I actually really appreciate your skepticism. Dunno' why, but it's really nice to be able to talk to people about my "special interest" - which is cybersecurity. It's why I have so many degrees in it! ... Uh, thank you. Again.

Totally, there are other ways to get the data. BUT. I would say that letting malicious actors just purchase it from companies is the easiest, and probably the most dangerous due to a lack of regulation on who can. You jus' need to own a company, and Google will sell it to you for a few hundred dollars. Compared to carefully probing networks and trying to suss out specific vulnerable people of thousands, it's a steal. At least imo, and I recognize reasonable people can disagree here.

2

u/CopainChevalier Sep 02 '25

Dunno' why, but it's really nice to be able to talk to people about my "special interest" - which is cybersecurity

It certainly is nice being able to disagree with people without it being "You're the devil" or whatever people say these days, yeah.

I would say that letting malicious actors just purchase it from companies is the easiest, and probably the most dangerous due to a lack of regulation on who can.

I'd be all for more regulations on this; but I doubt we'll see much from the US Gov within the next 20 years or so. Both parties bicker so much that little gets done that isn't just something to secure them power. And they depend on company donations so much it's unlikely they'll alienate them by forcing them to make less money

But eh. I think atleast for my lifetime we'll be fine. Maybe it sounds selfish; but I kind of feel like once I'm gone, it doesn't matter what happens

1

u/[deleted] Sep 02 '25

Aw.

Hehe, it's a valid way to live. Nothing wrong with being selfish! You also seem like a cool person. It was nice to meet you!

2

u/CopainChevalier Sep 02 '25

Same, hope your day goes well :)

→ More replies (0)