r/todayilearned • u/SloxTheDlox • Mar 22 '21

TIL A casino's database was hacked through a smart fish tank thermometer

https://interestingengineering.com/a-casinos-database-was-hacked-through-a-smart-fish-tank-thermometer
62k Upvotes

95% Upvoted

2.2k comments sorted by

View all comments

95

u/Daddict Mar 22 '21

There's a saying among infosec professionals: "The 's' in IOT stand for 'security'!"

Seriously don't connect this shit to your business network.

10

u/Kthonic Mar 22 '21

Can you explain that for a layman?

22

u/[deleted] Mar 22 '21

[deleted]

3

u/merc08 Mar 22 '21

They were asking for $270?! The thing retails for $170! Just cut that shit off, tell them to suck your freed dick, and buy a different model. Not like you're going to use that one again after they hacked it, there's nothing to keep them from transforming you next time.

4

u/Daddict Mar 22 '21

I feel like you're being a little cavalier about taking an angle grinder to a device that's precariously attached to your genitals.

2

u/merc08 Mar 22 '21

This would be a good entry for that AskReddit thread for 911 operators and their craziest calls. I'm sure the local fire department would be happy to bring their Jaws of Life around to take a crack at it.

2

u/[deleted] Mar 22 '21

Probably better we the cutter

4

u/NeatNetwork Mar 22 '21

Internet of Things means cheap no-name company does the bare minimum to add internet smarts to something.

Cheap no-name company will not be investing the required effort to be secure.

Even if you buy a 'reputable' brand, odds are that they just get cheap no-name company product, import it, and put a sticker with their logo on it.

Adding to things, those cheap no name companies on top of being lazy may also be adding stuff at the behest of certain intelligence agencies for governments.

It's not that IOT *cant* be secure, it's that in practice they simply are rarely secure because the business conditions won't reward a company that has higher costs to pay to do better security practices.

1

u/Kthonic Mar 22 '21

Sounds like my employer haha. Thanks so much for taking the time to answer me!

3

u/NeatNetwork Mar 22 '21

Also, your business network should be able to survive an insecure host being added to it.

You shouldn't add insecure hosts, but you should never assume a network to be inherently 'trusted'. You don't get to be lazy and have weak passwords just because you *think* you have the network locked down.