Your smart fridge might be good for storing cold beer, but it definitely isn’t good for storing your Gmail credentials, as those can be easily stolen. During the recent DEF CON hacking conference, the vulnerability was unveiled at the IoT hacking challenge run by Samsung.
The fridge that got owned was the RF28HMELBSR smart fridge. It downloads Gmail Calendar information and displays it on an on-screen display. The device does implement SSL, but it fails to validate SSL certificates, thereby enabling man-in-the-middle attacks against most connections.
According to a report by The Register, hackers from the Pen Test Partners that managed to get into the local network are able to grab the Gmail credentials through the fridge.
"The internet-connected fridge is designed to display Gmail Calendar information on its display", explained Ken Munro, a security researcher at Pen Test Partners. |It appears to work the same way that any device running a Gmail calendar does. A logged-in user/owner of the calendar makes updates and those changes are then seen on any device that a user can view the calendar on".
"While SSL is in place, the fridge fails to validate the certificate. Hence, hackers who manage to access the network that the fridge is on (perhaps through a de-authentication and fake Wi-Fi access point attack) can Man-In-The-Middle the fridge calendar client and steal Google login credentials from their neighbors, for example".
Pen Test Partners’ Pedro Venda added: "We wanted to pull the terminal unit out of the fridge to get physical access to things like a USB port and serial or JTAG interfaces, but ran out of time. However, we still found some interesting bugs that definitely merit further investigation. The MiTM alone is enough to expose a user’s Gmail creds".
Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.
Photo Credit: Bloomua/Shutterstock