Product Suggestions for Security Evaluation

[saltbae]

Hello Everyone!

I'm a Security Engineer with a background in pentesting, red teaming, hacking, bug bounties, and general mad scientist experiments. Shouldn't be a surprise that I enjoy researching all the amazing reef tank setups here. You all are inspiring.

Soon I'll be getting a smart controller for my first DT setup and will be evaluating how to set it up securely. If people are interested I could write up my process and share. Anyone out there who enjoys that sort of thing? I haven't picked one out, any suggestions on ones you'd like to see evaluated? For a full audit I will most likely have to get permission from the manufacturer first, so if anyone knows ones that are good to work and might be up for that it would be awesome! Doesn't have to be a controller, any devices that connect to the internal or local network are fair game.

I'm not one to make videos, but I'm happy to write up research and post it. :)

 

[Dan_P]

Hello Everyone!

I'm a Security Engineer with a background in pentesting, red teaming, hacking, bug bounties, and general mad scientist experiments. Shouldn't be a surprise that I enjoy researching all the amazing reef tank setups here. You all are inspiring.

Soon I'll be getting a smart controller for my first DT setup and will be evaluating how to set it up securely. If people are interested I could write up my process and share. Anyone out there who enjoys that sort of thing? I haven't picked one out, any suggestions on ones you'd like to see evaluated? For a full audit I will most likely have to get permission from the manufacturer first, so if anyone knows ones that are good to work and might be up for that it would be awesome! Doesn't have to be a controller, any devices that connect to the internal or local network are fair game.

I'm not one to make videos, but I'm happy to write up research and post it. :)

Wow, I almost understand :-)

If you have no aquarium automation except turning lights on and off, is such a security protocol necessary?

 

[BryanM]

Wow, I almost understand :)

If you have no aquarium automation except turning lights on and off, is such a security protocol necessary?

"we" in the security field are always interested.

Defcon happens every year vegas with a hacking village, people source ATMs, voting machines, etc, etc, to figure out their flaws and ultimately try and make things better.

Fortunately for us in reefing, there's no real "target" here, hackers would only really get to mess up our lives, which would suck. But most are after PII or money, or in bigger business intellectual property.

 

[saltbae]

Ah yes, the light functionality itself wouldn't be the ultimate target. Although that could be pretty funny. If it was a network connected device then it may potentially be used as a pivot point into a network. Basically as a door to other devices. I agree that there isn't much risk of individuals reefs being a targeted. A lot of the research in my free time is more out of curiosity, and I thought I might try combining two of my interests for fun. :)

 

[taricha]

I've heard some other security-type people talk about this, and the impression I got was that none of the internet connected tank automation setups are run with much thought of security at all in the hobby. Dunno if that is a device limitation or just how hobbyists choose to set them up.
So you may find lots to say, I guess!