bolha.us is one of the many independent Mastodon servers you can use to participate in the fediverse.
We're a Brazilian IT Community. We love IT/DevOps/Cloud, but we also love to talk about life, the universe, and more. | Nós somos uma comunidade de TI Brasileira, gostamos de Dev/DevOps/Cloud e mais!

Server stats:

247
active users

#iot

9 posts9 participants0 posts today

BSI-Bericht: Erhebliche Schwachstellen bei #Fitnesstrackern & Co.
heise.de/news/BSI-Bericht-Erhe

"Die Experten wählten demnach zehn Produkte für "eine detaillierte Sicherheitsuntersuchung" aus. Darunter waren sechs vernetzte Uhren wie #Smartwatches, drei #FitnessTracker und ein #SmartRing. Die Forscher deckten dabei insgesamt 110 Schwachstellen auf, die sie als "mittel" oder "hoch" einstuften. Keines der Geräte war komplett frei von #Sicherheitslücken."

Ist doch vollkommen egal, wohin man seine persönlichsten (Gesundheits-)Daten schickt. Oder? 🤔😈

heise online · BSI-Bericht: Erhebliche Schwachstellen bei Fitness-Trackern & Co.By Stefan Krempl
Replied in thread

Zwecks Auffindbarkeit ein paar Hastags dazu:
Untersuchte Hersteller: #Huawei #Sungrow #GinlongSolis #Goodwatt #GoodWe #SMA
Allgemein: #PV #WR #Wechselrichter #Solar #Inverter #SunDown #Forescout #China #Hacker #SmartHome #IoT
forescout.com/research-labs/su
@bsi

Recommendations
Manufacturers
Development • Devices: holistic security architecture including secure boot, binary hardening, anti-exploitation features, permission separation etc
• Applications: proper authorization checks on web applications, mobile applications and cloud backends
Testing • Regular penetration testing on applications and devices • Consider bug bounty programs
Monitoring Web Application Firewalls Remember that a WAF does not protect against logical flaws

Users
Residential and commercial users • Change default passwords and credentials • Use role-based access control • Configure the recording of events in a log • Update software regularly • Backup system information • Disable unused features • Protect communication connections
Commercial and utility installations (in addition) •
Include security requirements into procurement considerations
• Conduct a risk assessment when setting up devices • Ensure network visibility into solar power systems • Segment these devices into their own sub-networks • Monitor those network segments

#Microsoft used its #AI-powered #SecurityCopilot to discover 20 previously unknown vulnerabilities in the #GRUB2, #UBoot, and #Barebox #opensource #bootloaders.
GRUB2 (GRand Unified Bootloader) is the default boot loader for most #Linux distributions, including Ubuntu, while U-Boot and Barebox are commonly used in embedded and #IoT devices.
bleepingcomputer.com/news/secu #ITSec

Replied in thread

@t3n Dafür verkauft #bosch Spülmaschinen, bei denen teilweise (Grund-)Funktionen nur per App und Extra-Account über einen Cloudservice genutzt werden können...

Falsch verstandenes #iot und Industrie 4.0.

"[A] team of researchers recently set out to determine just how much companies like Amazon, Apple and Google are using the data gathered through their voice assistants to profile us –– track and monitor our behavior –– across the internet.
(...)
The study focused on the behaviors of the three biggest voice assistant platforms: Amazon’s Alexa, Apple’s Siri and Google Assistant. What researchers found was that how concerned you should be about your smart assistant profiling you varies greatly depending on which device you use.

But in order to figure this out, they had to essentially trick voice assistants into profiling them.

They downloaded publicly available information that Google compiles on every user based on their searches, like gender, age range, relationship status and income bracket. Using those labels, they were able to design questions that could easily convince the platforms that they were, for example, married, had children or were a homeowner not a renter.

The researchers then recorded themselves asking these questions and replayed the audio to voice assistants over and over again. Over the course of 20 months, they conducted 1,171 experiments involving nearly 25,000 queries.
(...)
What they ended up finding was that Alexa exhibits the most straightforward kind of profiling behavior: It’s all based on your interest in products.
(...)
However, with Siri and Google Assistant, things are more complicated.

After reaching out to Apple to get their data, the company insisted “they had no data on us,” Choffnes says, “which means we couldn’t even test anything or prove any hypothesis about whether there was any profiling happening.”
(...)
Meanwhile, Google Assistant was the strangest of the bunch. The researchers found that it was clearly profiling its users but often incorrectly."
news.northeastern.edu/2025/03/

Northeastern Global News · Your voice assistant is profiling you, just not in the way you expect, new research findsBy Cody Mello-Klein