Smart home appliances are becoming the "dark gateway" for hackers, and your mnemonic phrase may have been monitored!

Original Title: Be Careful, Your Vacuum Robot and Coffee Machine May Steal Your Bit?

Original Author: Deep Tide Techflow

Source text:

Compiled by: Daisy, Mars Finance

Robotic vacuum cleaners and other smart home appliances can be easily hacked to record your password inputs or mnemonic phrases. Imagine waking up one morning to find your robotic vacuum out of control, your refrigerator demanding ransom, and your cryptocurrency and bank account funds completely drained.

This is not the plot of Stephen King's 1986 horror film "Maximum Overdrive," which tells the story of a rogue comet triggering a global machine killing spree.

On the contrary, the real risk of hackers invading your computer through smart devices in your home may lead to serious consequences. With the number of IoT devices worldwide expected to reach 18.8 billion and an average of about 820,000 IoT attacks occurring daily, the likelihood of such scenarios is increasing.

"Unsecured IoT devices (such as routers) can become an entry point for intruding home networks," said Tao Pan, a researcher at blockchain security company Beosin, in an interview.

As of 2023, the average American household owns 21 connected devices, with one-third of smart home device consumers experiencing data breaches or fraud incidents in the past 12 months.

"Once compromised by hackers, attackers can move laterally to access connected devices, including computers or phones used for cryptocurrency trading, and can also capture login credentials between the devices and the exchange. This is particularly dangerous for users trading cryptocurrencies using APIs," he added.

So, what information can hackers steal from your home, and what damages can they cause?

"Magazine" has collected some of the most bizarre hacking incidents that have occurred over the past few years, including a case where an access sensor was hacked to mine cryptocurrency. We have also compiled some practical advice on protecting data and ensuring cryptocurrency security.

Invasive Coffee Machine

In 2019, researcher Martin Hron from the cybersecurity company Avast demonstrated how hackers can easily access home networks and their devices.

He chose a simple target: remotely hacking his coffee machine.

Hron explained that, like most smart devices, the coffee machine uses preset settings to connect to WiFi without a password, making it easy to upload malicious code to the machine.

"Many IoT devices first connect to the home network through their own WiFi network, which is only used for setting up the device. Ideally, consumers will immediately protect that WiFi network with a password," Hron explained.

"But many devices do not come with a password set to protect the WiFi network, and many consumers also do not set a password," he added.

Original video link

"I can do whatever I want because I can replace the firmware, which is the software that operates the coffee machine. And I can replace it with anything I want. I can add features, remove features, and even break through built-in security measures. So, I can do whatever I want," he said in a video released by Avast.

In his demonstration, Hron displayed a ransom note through a coffee machine, which was locked and could not be used unless a ransom was paid.

You can choose to turn off the device, but that means you won't be able to drink coffee anymore (Avast/YouTube)

However, in addition to displaying ransom notes, the coffee machine could also be used to perform more malicious operations, such as turning on the heater to create fire hazards, or spraying boiling water to threaten the victims.

What is even more terrifying is that it could quietly become an entry point into the entire network, allowing hackers to monitor your bank account information, emails, and even your encryption mnemonic phrases.

Invasion of the casino fish tank

One of the most famous cases occurred in 2017, when hackers infiltrated a connected fish tank in the lobby of a Las Vegas casino and transmitted 10GB of data.

The fish tank is equipped with sensors for regulating temperature, feeding, and cleaning, which are connected to a computer on the casino network. Hackers accessed other areas of the network through the fish tank and sent data to a remote server in Finland.

The fish tank may look like this (Muhammad Ayan Butt/ Unsplash)

Despite the casino deploying regular firewalls and antivirus software, the attack was still successful. Fortunately, the attack was quickly identified and dealt with.

Nicole Eagan, CEO of cybersecurity company Darktrace, told the BBC at the time, "We stopped it immediately, and there was no damage done." She also added that the increasing number of internet-connected devices means "it's a hacker's paradise."

The door sensor can also mine secretly.

In 2020, during the global office shutdowns due to the COVID-19 pandemic, the cybersecurity company Darktrace discovered a secret cryptocurrency mining operation—hackers were illegally mining by using servers that controlled the office's biometric access control.

The clues of this incident come from the server downloading suspicious executable files from an external IP address that had never appeared in the network before. Subsequently, the server repeatedly connected to external endpoints associated with the privacy token Monero mining pool.

This type of attack is known as "Cryptojacking". Microsoft's threat intelligence team discovered more cases of such attacks in 2023, with hackers targeting Linux systems and internet-connected smart devices.

A Microsoft investigation found that attackers initiate attacks by brute-forcing internet-connected Linux and IoT devices. Once inside the network, they install backdoors and then download and run cryptocurrency mining malware. This not only leads to soaring electricity bills but also directly transfers all mining profits into the hacker's wallet.

Cases of this type of cryptocurrency hijacking are emerging one after another, with one of the latest cases involving the embedding of cryptocurrency hijacking code into a forged 404 HTML page.

Hacker Intrusion into Smart Devices: Destroying the Power Grid

Even more terrifying is that security researchers at Princeton University have proposed a hypothesis: if hackers can control enough high-energy-consuming devices, such as 210,000 air conditioners, and turn them all on at the same time, it could lead to a blackout affecting approximately 38 million people, the equivalent of California's population.

These devices need to be concentrated in a certain part of the power grid and activated simultaneously to cause an overload of current in certain power lines, which can damage or trigger the protective relays on the lines, causing them to shut down. This will shift the load to the remaining lines, further intensifying the pressure on the grid and ultimately triggering a chain reaction.

However, this situation requires precise malicious timing, as fluctuations in the power grid are a common phenomenon during extreme weather (such as heatwaves).

The robot vacuum is watching you.

Last year, robotic vacuums in many parts of the United States suddenly started activating by themselves. It turned out that hackers discovered serious security vulnerabilities in a Chinese-made Ecovac robotic vacuum.

According to reports, hackers can remotely control these devices to intimidate pets, shout profanities at users through built-in speakers, and even use built-in cameras to spy on the user's home environment.

An image from a hacked Ecovac robot vacuum's live feed (ABC News)

"One serious issue with IoT devices is that many manufacturers still pay insufficient attention to security issues," said cybersecurity company Kaspersky.

It is obvious that if hackers gain access to the video of you entering your password or recording your mnemonic phrase, the consequences would be unimaginable.

How to protect yourself from smart device hacking?

Looking around, you may find that almost all devices in your home are connected to the internet - robotic vacuum cleaners, digital photo frames, doorbell cameras. So how can you ensure the safety of your Bitcoin?

One option is to adopt the approach of professional hacker Joe Grand: completely avoid using any smart devices.

"My phone is the smartest device in the house, but even so, I am reluctant to use it, only for navigation and communicating with family," he once told Magazine, "but smart devices? Absolutely not."

Avast's Hron stated that the best way is to ensure that passwords are set for smart devices and to avoid using default settings.

Other experts recommend using a separate guest network for IoT devices, especially those that do not need to share a network with computers and phones; disconnecting when devices are not in use; and keeping software updated in a timely manner.

In addition, there is a networked fee-based search engine that can help users view the networked devices in their homes and potential vulnerabilities.