Well shit, you might just get the whole south riled up about cyber security now.
this post was submitted on 04 Jul 2024
3 points (66.7% liked)
Cybersecurity
5754 readers
68 users here now
c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.
THE RULES
Instance Rules
- Be respectful. Everyone should feel welcome here.
- No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
- No Ads / Spamming.
- No pornography.
Community Rules
- Idk, keep it semi-professional?
- Nothing illegal. We're all ethical here.
- Rules will be added/redefined as necessary.
If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.
Learn about hacking
Other security-related communities [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
Notable mention to [email protected]
founded 1 year ago
MODERATORS
Why does a grill even need to be that high tech?
Because some people want to jump straight into bbq without experience and have a bunch of money to compensate for knowledge about timing and when to test temps and what smells you're waiting for.
Also, more precise temperature control for the cook who wants to try out other methods for elevating their bbq game.
This whole problem could be avoided by running the API on the grill itself, fully locally on the lan.
Seems like the grill is a dumb client that polls the cloud API to determine what action to take, and then the phone app pushes commands to the cloud for the grill.
An overly complicated setup that only forces you into their walled garden.
This is the best summary I could come up with:
Keen meatheads better hope they haven't angered any cybersecurity folk before allowing their Traeger grills to update because a new high-severity vulnerability could be used for all kinds of high jinks.
With summer in full swing in the northern hemisphere, it means BBQ season is upon us, and with Traeger being one of the most trusted brands in grilling and smoking, there's a good chance that many backyard cookouts could be ruined if crafty crims have their way.
Successful exploits could allow a remote attacker to execute day-ruining commands such as temperature change controls or shutting down the grill altogether.
Should the temperature be adjusted mid-cook from a gentle low flame to searing heat, it could be the difference between a backyard gathering for the ages and the worst day of a host's year.
To get the ball rolling, they retrieved a pairing token from the Traeger API after making a POST request and registered it to an AWS IoT Cognito identity.
A second, less severe vulnerability (4.3 – medium) was also disclosed by Bishop Fox after researchers found a way to remotely force Traeger's GraphQL API to list every grill registered with the manufacturer with a short POST request.
The original article contains 709 words, the summary contains 200 words. Saved 72%. I'm a bot and I'm open source!