Smart Kettle iKettle 2.0 Leaking WiFi Key

A smart kettle which it is possible to cook over the local Wi-Fi network water seems to leak the WiFi key. This has security researcher Ken Munro of the British Pen Test Partners discovered. The iKettle 2.0 is developed by Smarter kettle which is operated via the smartphone.

In the first version of the kettle was found that the device is vulnerable to an attack where the malicious attacker a Wi-Fi network setup. The kettle simply showed the SSID to use for authentication. Once the kettle with the malicious Wi-Fi network connection allows an attacker can retrieve via Telnet the WPA key of the original Wi-Fi network in plain text and connect with this.

Munro since the problems with the first iKettle in June demonstrated there is a new version appeared on the market, the iKettle 2.0. This version, despite the new version number with the same problems to worry, says Munro. Ascertaining the WiFi key would be especially easy when the Android app is used for operating the kettle, but the attack is also to perform in users of the iPhone app.

The researcher advises owners of smart kettle to turn it on only when water should be boiled and then off again.Furthermore, any update from the manufacturer must be installed directly. Also advised is not nonsensical 'Internet of Things' devices being connected to the home network, unless the security of the manufacturer has been tested and proven.

Karma-Attack Is Still Dangerous For WiFi Users

Consumers who wifi on their laptop, tablet or smart phone use still run the risk of being the target of a Karma attack, allowing an attacker could then intercept the traffic of the user. The Karma attack in early 2005 for the first time demonstrated.

The attack is possible because some computers and mobile devices continues to Wi-Fi networks nearby. It sent the name of the Wi-Fi network. A malicious access point can occur later as the network, allowing the laptop, smartphone or tablet automatically connects. An attacker could then perform a man-in-the-middle attack, as he is between the user and the Internet. Although Karma attack is over 10 years old, he is still usable.

For example, the latest Mac OS X version still appears to look for nearby networks where the network name is sent. Also in the case of Ubuntu 14:04 platform is vulnerable to the Karma attack. Windows 7 does not appear to be vulnerable by default because it is not looking for Wi-Fi networks. Researcher Will Dormann of the Software Engineering Institute at Carnegie Mellon University found that the wifi adapter which he used Windows or made ​​vulnerable. The wifi software made ​​to it that there to Wi-Fi networks was sought.

It also appears that older Android versions as Gingerbread vulnerable. In Ice Cream Sandwich was the problem rectified. Also iOS devices proved to be vulnerable. Consumers who want to protect are advised not to use open Wi-Fi networks and previously used Wi-Fi networks that are saved by the system to remove from attack. Dormann also recommends to disable wifi when not in use and keep an eye on what WiFi network the device connects. He further recommends that to connect to networks that have a hidden network name (SSID).