To hack Halo 3c, they discovered that if they could connect to one above the network on which it was installed, they could build Brutus to guess its password practically without speed limits due to a defect on how he tried to limit those hypotheses. “It is trivially possible to guess passwords with the same speed with which it can answer you,” says Nyx. This meant that they could guess about 3,000 passwords per minute and break an insufficiently complex password relatively quickly.
Once they had the access of the administrator to a Halo 3C, they discovered that they could update his firmware to anything had chosen: despite his security measures that tried to request that these firmware updates were encrypted with a certain encryption key, the key one was actually included in the firmware updates available on the Halo website. “They are delivering you a blocked box in which the key is recorded on the lower side,” says Nyx. “As long as you know you watch over there, you can open it.”
A spokesman for Motorola Solutions has declared in a declaration: “Motorola Solutions designs, develops and distributes our products to give priority to data security and protect the confidentiality, integrity and availability of data. A firmware update is available and we are working with our customers and channel partners to distribute the update together with our additional advice and the best practices of the sector for safety.”
Marketing material available online states that Halo 3C uses a “dynamic algorithm of detection of the vapus” that can perceive nicotine, THC and when someone is trying to mask their vap with aerosol. Halo can also “notify Motion Security Team after hours” and includes a “spoken keyword features”.
“The Smart Halo sensor can detect specific spoken keywords that immediately warn the security of a potential problem. Default keywords such as” help “are particularly precious in environments such as schools, in which bullying is a concern or for teachers who need assistance, as well as nurses and hospital patients”, adds the marketing material. Another section says that the sensors can be used to detect “bullying or aggression” in schools.
The marketing material also states that the Alone sensors have been used in public housing units in New York. “The sensors helped SSHA [the Saratoga Springs Housing Authority] Reduce risks, apply non -smoking rules and protect vulnerable residents, with plans for further installations throughout the housing authority, “he says.
Nyx argues that the notion of requesting public homes residents to maintain a hackable device that can become an audio interception tool in their apartment can represent the most disturbing application of the Halo 3C. “This type of a notch has taken it as much as the entire product line is striking,” says Nyx. “Most people have the expectation that their home is not annoyed, right?”
Since sensors like Halo 3c proliferate among schools and even houses, Vasquez-Garcia states that the largest takeaway of his Nyx discoveries should be that putting microphones and Internet connections in every device of our life as simple as a smoke detector is a decision that involves a real risk. “If people remember something from this, it should be: do not blindly trust every internet of Things device just because she says she is for safety,” says Vasquez-Garcia. “The real problem is confidence. The more we accept devices that say” do not record “at the nominal value, more normalize surveillance without really knowing what is inside or cares to question it.”