back to article Brit-American hacker duo throws pwns on IoT BBQs, grills open admin

American hardware hackers have ruined Christmas cooks ups across Australia, revealing gaping and pwnable vulnerabilities in Internet-connected barbecues. Hardware hackers Matthew Garrett and Paul McMillan revealed how the Internet-of-things CyberQ exposed its remote administration facilities and could be owned over the …

  1. Mark 85


    Imagine that. I think the commentards here already know this. I would hope that maybe they'll get some non-tech oriented media coverage. Currently, the media fawns all over IoT as being the next, best, big thing... and the person on the street believes it.

    New acronym.. IoG.

    1. dotdavid

      Re: Internet-connected-garbage

      You do realise that some marketing exec will read that and think "internet connected garbage cans! They could email you reminders of your collection day!"

      1. Anonymous Coward
        Anonymous Coward

        Re: Internet-connected-garbage

        Do not joke about things like that!

    2. Anonymous Coward
      Anonymous Coward

      Re: Internet-connected-garbage

      If you're stupid enough to buy an internet connected BBQ then you probably deserve to have it compromised.

      I hope some script kiddie overcooks their steak.

  2. raving angry loony

    New acronym proposal

    New dual-purpose acronym for Internet of Idiots: IoI. Can double for what anyone with a clue does when faced with the relentless marketing for it.

    1. dan1980

      Re: New acronym proposal

      To defend the manufacturer (just a little), this isn't specifically an 'IoT' device - it's a standalone device that was born without any connectivity whatsoever and then added wireless access at the request of users.

      So far as I can tell, they don't even provide instructions with the device to tell people how to make it available over the Internet.

      I don't really consider it an 'IoT' device as such because no part of its functionality requires access to the Internet. It is designed to be able to be controlled from your living room so if someone wants to manually go and setup their router to make that interface accessible over the Internet then that's kind of their problem.

      I'm sure the manufacturer doesn't encourage users to leave a BBQ/smoker unattended while they head off and rely on monitoring/controlling it over the Internet.

      1. a_yank_lurker

        Re: New acronym proposal

        The general use case for IoT aka idiot devices is to slap a Internet connection on a perfectly functional device. Toasters, grills, 'fridges, etc. work perfectly fine without any Internet connection and there is minimal need for them to be connected. The main reason for the idiot devices is manufacturers are looking for a marketing hook that can be sold as a truly new "feature". Since very few appliances have any connectivity it seems to be a "good" idea to add it.

        1. Robert Helpmann??

          Re: New acronym proposal

          I'm sure the manufacturer doesn't encourage users to leave a BBQ/smoker unattended while they head off and rely on monitoring/controlling it over the Internet.

          My submission: IoT BBQ POS DIAF!

          1. Bert 1

            Re: New acronym proposal

            My proposal is I(di)oT.

            1. Graham Marsden
              Thumb Up

              Re: New acronym proposal

              Inter-connected Devices for the Internet Of Things...

              1. Version 1.0 Silver badge

                Re: New acronym proposal

                Hook up Siri/Cortana for voice control/feedback and you can have ...

                Caring Understanding Network Thing.

                1. jake Silver badge

                  Re: New acronym proposal

                  The acronym already exists. ID10Ts.

      2. NotBob

        Re: New acronym proposal

        "I'm sure the manufacturer doesn't encourage users to leave a BBQ/smoker unattended while they head off and rely on monitoring/controlling it over the Internet."

        Based on their marketing, it's perfectly acceptable to fire up the grill, slap on some food, and leave. (I believe the example is going to the store.) They also advocate using it to monitor cooking while "watching the game."

        Based on the advertising drivel, it's definitely intended to be set up as world+dog facing in the interwebs.

      3. Turbo Beholder

        Re: New acronym proposal

        > I don't really consider it an 'IoT' device as such because no part of its functionality requires access to the Internet.

        But the same applies to I.D.I.o.T. devices in general: no part of a garbage can usage or ironing process needs access to the Internet (or even is going to be significantly improved by it), either.

  3. Anonymous Coward
    Anonymous Coward


    Confused about the reference to Australia when this is Kiwicon, held in Wellington, the capital of Kiwiland.

    Ah, it's to get a rise out of Kiwis about us being just a part of Straya. We'll played Reg. Well played.

    1. nijam Silver badge

      Re: Australia

      I think they're refererring to West Island

  4. dan1980

    Sorry Darren - what's the Aussie angle?

    So far as I can tell, this is an American hacking team giving a presentation in New Zealand of their exploit of an American-made product mostly used by Americans.

    It works with charcoal-fueled kettle-style BBQs, like Webers so is not really going to be in use by that many Australian's over Christmas given we tend to prefer the standard gas-powered grills.

    Not that the Weber doesn't get a fire now-and again when the temperature is far too hot to consider turning the oven on but that'd usually be for the bird and so it's not really a the type of thing that this is device is aimed at which is slow-cooking and specifically smoking large, tougher pieces of meat, such as brisket, which is barely even available in Australia*.

    I mean, generally Aussie's don't go in for smoking as much as our American cousins whatever the time of year or the cut of meat - it's just a difference of cultural tastes I suppose. Our slow-cooks are more likely to be a lamb shoulder and if that's done in a Weber, we don't traditionally aim for a smoked flavour.

    Further, the device itself must be imported as I can't find any Australian stockists and it comes with one of those flimsy US two-prong plugs and so must be run with an adapter. They are also set as F so must be changed manually in several places for C.

    Further, as I understand it, the hack relies on the devices being discoverable over the Internet but in Australia, residential ISPs routinely block port 80 so all such devices will need to be running on non-standard ports. This is in contrast to most ISPs in the US that allow port 80.

    It's still an interesting article of course and it is right for Darren to be presenting it as he was actually at the conference so no arguments there, just a little perplexed by the choice of by-line: "American hardware hackers have ruined Christmas cooks ups across Australia."

    But, back to the device itself, I don't think it's specifically aimed at being accessible from the Internet. Anything is, of course, if you setup your router correctly, but the reports I've read suggest that there are no instructions included with the device to show people how to set their router to forward the port to the device or find their public IP or to put that IP into the phone app.

    I guess what I am saying is that this doesn't seem to be specifically designed and marketed as an Internet connected device. From what I can tell, the purpose is to allow you to monitor the temperature from inside using your phone so you don't have to go out and check every so often. Or indeed so you can leave it over night or whatever.

    Looking at the history of the device, it seems that the original was simply a temperature control unit - similar to others on the market that work by closing the main air intake for the smoker and instead using an electronically-controlled fan. People requested a wireless-capable unit that could be controlled via a http interface or phone app and the company duly made one.

    That said, when they did so, it seems they botched that because there were reports of people having to disable WPA2 in favour of WPA to get the thing to even connect to the wireless network.

    So, it seems it's not some rubbish hype device marketed as 'rar rar Internet' but a normal, standalone device that had connectivity added on top later on due to customer demand.

    Of course, this highlights one of the core problems with the IoT mentality, namely that devices that perform some function that is not primarily reliant on any connectivity at all (let alone Internet connectivity) are getting Internet connectivity bolted on as a feature. The inevitable consequence is that these add-on bits of circuitry and programming are just bought largely off-the-shelf and never patched.

    They aren't hardened in any meaningful way because any customisation that is done for that specific device tends to revolve solely around the UI - pretty buttons and apps and so forth - not security.

    Seems to be the case here as the manufacturer isn't in the business of making network-connected devices so they just don't have the expertise to ensure that their device is secure.

    * - Closest cut that would be readily available would be the shank but, while that's certainly a tough, muscular cut, it's not really the same thing due the the anatomical structure of the cow and the load-bearing nature of the brisket.

  5. Anonymous Coward
    Anonymous Coward

    IoT BBQ?

    You can get the net on some bricks arranged in a U shape with a slab of old plate steel on the top?

    I may need to look that up on my wheelie bin.

    1. frank ly

      Re: IoT BBQ?

      Your wheelie bin's been reading the RFID tags on the discarded packaging. I won't say anything but this is going to be really embarassing for you when more people find out how to access it.

  6. Anonymous Coward
    Anonymous Coward

    Internet of Tat

    Do not buy.

  7. robertcirca

    Too stupid ....

    If someone is too stupid to control a basic device like a barbecue manually, he/she should go to a restaurant. No, not the good and expensive ones, the dirty and greasy ones.

    IoT - not in my house. And I will never allow a TV set to connect to my wireless LAN.

    The less people know about technology - the more they are interested in "high end features".

    1. Anonymous Coward
      Anonymous Coward

      Re: Too stupid ....

      "IoT - not in my house. And I will never allow a TV set to connect to my wireless LAN."

      Then what happens when you find out your TV has a Whispernet capability that can't be killed without killing the TV itself...and then you find out that ALL TVs going forward have this capability AND that all old TVs have been scrapped because they lack it?

  8. Richard Taylor 2

    Truly a southern hemisphere problem at this time of the year

  9. Anonymous Coward
    Anonymous Coward

    I'm sorry, what?

    An Internet capable barbecue?

    Let me guess, it cuts out the meatsack and posts pictures of what it's cooking to Instagram?

    1. DwarfPants

      Re: I'm sorry, what?

      Maybe they use the packets falling out of the end of the wire as fuel. I cannot think of many other reasons for attaching a fire to the internet. Maybe a firery conflagration is an aspirational goal for all the other IoT

  10. Anonymous Coward
    Anonymous Coward

    Just a CSRF vulnerability?

    The fact that the owner of the bbq needs to visit a malicious page just implies it's a simple CSRF vulnerability. Visiting the page with the user's logged in credentials sends the cookie automatically and so provokes the cross-site POST request (the forgery) to their bbq to carbonize whatever they are cooking.

    CSRF's are still common everywhere on the internet, just like XSS - hell, there are even CSRF vulnerabilities on the but the only reason this even makes news is that it has some kind of real-world effect... like making your sausages extra crispy... if this was found on a website would it be news? nope.

    Nothing to see here folks... move along...

  11. Mage Silver badge

    What next?

    Internet connected toilets? IoT

    Vacuum cleaners, wood burning stoves, coal bunkers, mirrors, beds, floors ...

    All madness.

    1. 080

      Re: What next?

      What next?

      Internet connected toilets? IoT

      I was just thinking along the same lines and, those wonderful Japanese heated toilets. A singed sausage is one thing but, the prospect of a scalded scrotum should concentrate your mind on security.

  12. Jimboom

    Not a big problem

    The only internet connected BBQ's that I could find online were gas BBQ's. And no self respecting Aussie would own one of these, let alone use it for cooking. Just doesn't taste the same as a good ol fashioned carbon-burning barbie.

    1. werdsmith Silver badge

      Re: Not a big problem

      You sure about that? Check out Dan1980's comment above.

      1. Jimboom

        Re: Not a big problem

        While I will grant you that there is still an ongoing debate about this, you will find that the reasons they tend to use Gassers are either because they are conscious of bush fires (their parks tend to have these instead of the charcoal kinds), or from a time aspect (ie, just want a quick meal, not having to go through the whole ceremony of the other kind of BBQ). Dan1980 is entitled to his opinion, however as a South African I can tell you that the gas BBQ is heresy in all the circles I run in and every Saffer I have ever met would never use a gas BBQ unless there was absolutely no other option available to them. Even an oven is preferable (a gas bbq is just an outside oven after all)

        The only people I generally have met who use Gas systems are people who A. can't start a "proper" fire. (They are out there. Once watched someone try to start a fire for about an hour, and even tried cooking over the fire lighter itself, before eventually giving up and wheeling out the gas BBQ).

        B. English people and Americans

        C. People who have many kids and need a quick option for cooking or want something that even the wife could do

        For me though, if you are going to do it, then do it right!

  13. NotBob

    Can't you see?

    This is just a new way for heated arguments to develop into full-blown flame wars

  14. Gene Cash Silver badge

    "Can't sign in to Google calendar on my Samsung refrigerator"!topic/calendar/UhfpcwO0X0c

    If there was ever a need for the facepalm icon, this is it.

  15. Anonymous Coward
    Big Brother

    Insecure internet-connected BBQs, the new frontier of government surveillance!!

    "Grill248 to NSA_HQ. Grill248 to NSA_HQ! What this citizen is doing to steaks is a crime!!!"

  16. jake Silver badge

    This thing is not for barbequing.

    It's for grilling. Both are useful cooking techniques, but there is a difference. I grilled a pizza for the wife & I's supper tonight, and I have a pork shoulder in the BBQ ... pulled pork tacos for lunch tomorrow :-)

    Grilling[0] is hot & fast. BBQ[1] is low & slow.

    [0] Over-fired ("broiling"), or under-fired. It's hot & fast direct heat. Heat source unimportant, the food isn't on the grill long enough to pick up any more flavo(u)r than the Maillard Reaction impairs[2].

    [1] Small Masterbuilt[tm][3]. 220 degrees, 18 hours-ish[4]. On smoke for the first four hours.

    [2] Unless you're daft enough to use petroleum based "charcoal starter". Why would anyone want their food to taste of petroleum? Thanks, Mr.Ford ...


    [4] Remove when the internal temperature is about 200F. Rest for about half an hour, then pull and enjoy.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like