It was reported today that security researchers hacked hair straighteners from Glamoriser, a U.K. firm that bills itself as the maker of the “world’s first Bluetooth hair straighteners,” allows users to link the device to an app, which lets the owner set certain heat and style settings. The app can also be used to remotely switch off the straighteners within Bluetooth range. The researchers found it was easy to send malicious Bluetooth commands within range to remotely control an owner’s straighteners. The researchers demonstrated that they could send one of several commands over Bluetooth, such as the upper and lower temperature limit of the device — 122°F and 455°F respectively — as well as the shut-down time. Because the straighteners have no authentication, an attacker can remotely alter and override the temperature of the straighteners and how long they stay on — up to a limit of 20 minutes.
https://twitter.com/leahprinz/status/1149697258469953536
Expert Comments:
Ben Goodman, SVP at ForgeRock:
“IoT is revolutionizing industries from agriculture to consumer goods with connected devices which creates a complex web of captured data, and command and control information traveling all types of networks. IHS Markit predicts that there will be nearly 125 billion IoT devices in 2030, and organizations like Glamoriser must hold themselves accountable for securely establishing and maintaining the full lifecycle of IoT devices. No one wants their Bluetooth hair straightener, or any other connected device, to be hacked, yet IoT projects often prioritize connectivity and data consumption and look to security and privacy as afterthoughts. . To save their customers from losing control of the devices and potential injury, Glamoriser must consider how they will definitively identify their devices, the users that use them and secure the communication between the two. Incorporating device authentication and authorization, and leveraging root of trust-based signing and encryption, and secure device attestation are key technologies to consider. IoT is here to stay and the identities of connected devices, services and users and their associated credentials must be trusted and usable across numerous connected ecosystems to prevent man-in-the-middle as well as other types of attacks.”
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.