The Landroid by Worx, inc. - a robotic lawn mower

Spoiler: I'm known for being critical of automation and this time will be no exception.

Full disclosure: although I use another Worx product, I have not done any hands-on examination on this line of mowers.

Only recently did I learn of the existence of automated lawn mowers - and apparently they've been around for awhile. In the process of discovering this, I've not changed my attitude about the automation of potentially dangerous devices. But I did learn much that I didn't know with just a bit of searching.

First, the forum conversation largely discusses limitations in the device capability, such as the issue of sensing short obstacles under 15 cm or 5 inches. It also (at default) uses a random algorithm like the Roomba vacuum cleaner in order to eventually cover all of its assigned area. This default can be changed with specified instructions, though this could be challenging for the mower's target audience, which is retired homeowners. [ :begin rant: Our wireless world now makes Joe Sixpack his own network administrator, meaning that many, many issues of technological maintenance will go undone... :end rant: ] And there's the possible odd appearance of random patterns cut into the grass.

But a search confirms many of my automation suspicions. In addition to onboard controls, the device is operated through phone applications and router connections. A location feature uses GPS information from cell towers to locate a lost Landroid should it stray from its assigned zone, which is delineated with a wire that must be installed at the area's edge, forming a "fence". And hackaday(dot)com reports the controller as using a "an NXP LPC1768 ARM Cortex-M3, and the debug pins are labelled on the backside. The manufacturer didn't protect the flash memory". This level of automation brings several possibilities to mind: there is already talk of some manufacturers of programmable mowers being able to restrict replacement parts to expensive proprietary ones, and of using later software to brick earlier versions. And if you don't get along with your neighbor, why not have his mower cut dirty words into the yard, bricking itself upon completion? And how much onboard memory and storage have we got? Spam server, anyone? Get your whole situation blacklisted, anyone? But the obvious issues to me would simply be that the connectivity is yet another route to the router, to be used to exploit more general vulnerabilities - and that wifi range is not properly sensed by the unit in order to avoid losing the ability to receive commands (to Work's credit, their site does note the issue and advises as to how possibly to avoid it). And the potential (haha) for coding issues and Personally Identifiable Information misuse always exists with manufacture-provided apps AND the phone companies through which such apps almost always operate.

So aside of questions of practicality (does an automated mower create more work for the user than it saves?), this appears to be yet another category of unpatched potential holes in someone's digital exposure. But it's an interesting category to investigate. From a pentesting perspective, the installation of such automated convenience devices could provide clues about the level of security overall, and about the psychology of the target user(s).

Third Week of StayCation: Different Uses For Multiple Boxes

One would be really dumb to try to do everything on one's phone: banking, insurance payments, stock trading, plotting illegal activities while assuming messaging is totally unmonitored... as if anybody ever actually did that. Oh, and doing one's taxes over a "smart"phone... that's a real winner.

But sitting at home on Covid-19 break, it occurred to me that there's enough PCs/Macs/Linux/whatever machines around here to be apportionable to many different needs. Imagine if one were to use dedicated boxes for specific risk levels or hardware needs. Let's list a few:

SECURE COMMUNICATIONS AND FINANCIAL ACCOUNTS - This would not argue for Windows XP. This would argue for a current, constantly-updated, antivirus-equipped (if applicable) latest-thing desktop or laptop. Don't load free gambling programs on this one.

CASUAL COMMUNICATIONS, SOCIAL MEDIA AND VIDEOCONFERENCING - This also argues for frequent patching and up-to-date hardware. But heavy malware scanning and general lack of trust would be important.

GAMING - High-performance hardware requirements and total lack of trust are the driving issues here.

CLONE/BACKUP OF OTHER UNIT - Mainly with the business/financial computer, if you have a crash you may need a quick replacement to step in.

OFFLINE ARCHIVING - Important files need to be stored in a safe place. This box doesn't need to be networked and you might even unplug this one when not used. And it's a good backup for a backup; the only place big enough to copy over an outboard HDD is another big drive.

FIREWALL/ROUTER/PROXY SERVER UNIT - If you have heavyweight networking requirements, a filtration point might be needed.

ODDBALL COMPATIBILITY UNIT - Particular jobs or situations could demand a particular operating system, application, application set or configuration(s). If the boss says to set it up a certain way, this is the box on which to do that.

So I've suggested that you need a minimum of SEVEN computers in your Undisclosed Location.

So? What's so strange about that? (everybody peers into my room, shakes head, walks away)

The Most Recent End Of The World

According to previous job descriptions, I have some experience in emergency operations of several kinds (I’ll keep details to myself since many of you know that stuff already and the internet already knows too much). Here’s my perspective on the current virus outbreak and how it can be somewhat managed:

1. Frequent hand-washing and refraining from touching the face are good moves. Using disposable gloves is also a good idea, as is social distancing whenever practical. Masks and buying lots of toilet paper are mistakes; the mask will not prevent a virus from getting through, but will help an infected person NOT infect someone that’s clear of the virus by containing the cough droplets. Also, intestinal problems are not present during most infections so the panic buying of toilet paper is misguided.

Edit: Information is not clear but it looks like masks could have some positive effect even if not 100% reliable, and on the toilet paper issue I've been told by a grocer that most of the cheap TP comes from China, where supply chain disruption has happened. So not all the TP went away from hoarding, and masks could be a good thing even in less effective contexts.

2. Many people appear to be buying more groceries than usual, perhaps since they’re not going to restaurants and bars so much. From what I’ve seen, the supply chain for produce and other foods is functioning well, but still needs overnight restocking. This is an opportunity for those of us that have earthquake kits (on the West coast), tornado kits (in the Great Plains) and hurricane kits (East coast and gulf coast) to restock and discard out-of-date canned goods, expired and leaking batteries and so forth. And in many areas take-out service or drive-through is still done at coffee houses and restaurants. And it may be a first that Texas restaurants are allowed to deliver alcoholic beverages with food orders, a measure not previously allowed in that US state.

3. Although much of the economy is being upset, many things still function. Power systems and telephone/internet transmission is good. Fuel oil, diesel and gasoline supplies are plentiful. Car repair places are still doing good business where I am (central US). The medicine I need is easy to get. Water/sewer service is unimpeded. And the weather has been mild. It could be worse.

4. The internet is rising to the occasion with not only new resource pages, but with the ones that already existed such as www.cdc.gov and www.ready.gov at least for the US.

5. Finally, remember that corona-family virii have been around for some time, and the infectious disease experts have been to this rodeo before (I think about ten times in the last 25 years or so for the US). If recent Chinese reports are accurate, the Hunan area is seeing a drop in need for bed space, treatment, therapeutic medicine and so forth, suggesting that the curve is already headed down at their locations. And early fast-spread statistics from Italy are something that I think could be explained by the close-in conversation habit that Italians consider normal. This effect would not apply to most other societies and I’ve seen at least one report that suggests that the Italians now are doing better than other European countries at social distancing practices.

I invent a new acronym...

... mainly for my own convenience: ITNA - Individually Targeted National Attack.

Here's a good Forbes Magazine article about the most recent developments in what we used to call 'wardriving'.

Driveby Vulnerability story

And here's one of the latest things on the Huawei issues.

Huawei story

At the risk of repeating myself, I'll speculate on the global possibilities of such hyper-local matters. One of the exposures of the Imperial Japanese Navy in attempting to knock out the American Pacific fleet in 1941 was the possibility that they'd be discovered as they slogged their way from Japan to Midway. They got discovered, thereby failing in their efforts. What if that trip had been unnecessary?

The whole "digital Pearl Harbor" scenario posits the internet as a remote access point to sensitive areas that an enemy would wish to use as attack vectors. Put that idea together with such things as personal data leaks and you get the possibility of attacking an enemy nation via bypassing national defense infrastructure. The Russians have already approached this by trying a cyberattack on Ukraine's municipal power grid some time ago. If citizens can be attacked directly, then there's little need for near-Napoleonic Era infantry advances. Observe this list of aspects of an individual's digital life:

Phone GPS tracking and phone company cloud data backups/saves

Smart home connections from digital assistants to smart light bulbs with insecure protocols

Financial information in data leaks

Medical information in data leaks

Email accounts, particularly free webmail

Government (national, state and local) information in data leaks

Information publicly viewable from government or Google

Resume information posted to job sites or on personal pages



First, set up a data collection project to track every citizen in the target country - let's say around 100 million people. Every citizen has a file. That file would become a dossier to use to feed an attack script specific to the person. The script could have sections for dox-ing personal contact info, for shutting down phone numbers and accounts with a phony email claiming a move to a competitor, for making unauthorized purchases that could trigger auto-shutdowns of credit, for making false police calls... get the idea?

Add those custom measures to the obvious things like attacks on police dispatch communications, remote traffic control systems, computer-controlled telephone exchanges, food distribution networks, internet-accessible remote starting in recently built cars and trucks... and all the other new exposures or vulnerabilities that have arisen over the last ten to fifteen years. And the Stuxnet worm has shown everyone that (with access to certain programs and languages) it's possible to destroy industrial devices with instructions inserted into the control points from outside.

So Country A could attack the 100 million citizens of Country B after first building the citizen files, then getting the attack scripts finished, then populating the attack script with info on the target citizen. After that, it's an access question (perhaps constructing backdoors over time) and then one simply selects a time to pull the trigger. No armies or navies needed. It's a software development project with a very large database. That sort of thing is done every day; it's just been weaponized by someone in this example.

How to protect oneself? If I were the government, I'd pull back on commercial off-the-shelf solutions and use more home-grown ideas, plus put more people onto network monitoring jobs. Individuals would benefit from my "Go to the PUB" advice: maintain Passwords, Updates and Backups. And don't load gobs of free apps onto your phone without knowing who they talk to.

Biting The Bullet: getting a Windows 10-native box due to Window 7 end-of-support

Short Report: buying and setting up the hardware was the usual three hour configuration process for a new box - but the discovery of a new OS was also usual in that one discovers yet again how Microsoft is always able to make some things marginally worse. And when it didn't really have to.

Longer Version: I got a fresh build of Win10 (not an upgrade from 7 or 8) from Office Depot's website's off lease resale page. My alternates were Tiger Direct, Micro Center and discountelectronics.com and they are probably equally trustworthy (although in my experience the last one listed has the fastest delivery time). Office Depot probably was the low price leader but took 10 days to deliver from a 3rd party refurbisher. Quality of the box was very good.

Sequence of events:

1. physical hookup and establishing of user account
2. Windows updates and related reboots
3. installation of other browser of preference
4. installation of duckduckgo and/or startpage.com search into browser of preference
5. installation of BrightFort Spyware Blaster (malware install preventer)
6. installation of Safer-Networking Spybot Anti-Beacon (blocks lots of Win10 chatty telemetry)
7. installation of other 3rd party things like openoffice.org, Audacity audio recorder, antivirus...
8. installation of iTunes VIA HAVING TO GOOGLE FOR Win10 INSTALLER rather than go through MS Store from Apple link
9. do 1st snapshot with BrightFort Spyware Blaster (a kind of short config backup)
10. do real backup (discovering that one outboard device had no Win10 driver available; used another that did)
11. test programs like mrt, disk utilities etc. to see if they work.
12. discover that "Photos", the replacement for Windows Photo Viewer, is clunkier and less stable
13. realize that "Backup" hid the control for "run now" in the More Options menu, which is stupid
14. realize that "Photos" sometimes wants connectivity to no useful purpose
15. move in remaining amount of needed data from other places if you require it

The more things change, the more they stay the same.

Kinda saw this coming...

... since Richmond had been warning us for oh, about 2 years.

I'll be complimenting one of my institutions (Chase) for NOT allowing this to happen. There are two or three ways to prevent this error message, all of which cost a bit of money. And the Info Tech people have to get it from some level of - you guessed it - MANAGEMENT and the managers at Chase, to my knowledge, understood the issue and I haven't seen this goofup at any of their ATMs. I don't actually know where this machine is, but it's at one of their competitors.

If I were Chase, I'd milk this for all it's worth, never letting the cheaper banks forget it. Hard to sweep this one under the rug.

Rank Speculations Prompting My Impending Win10 Switch

No, I'm not changing my advocacy position any. I still hate everything. But I'm now having to look at the Win10 upgrade situation due to Win7 going out of support in a few weeks (3 of my 11 currently operational boxes run some Windows or other). Is that really needed? Yes; most security problems statistically target the Win7 release. BUT going to 10 brings up a new set of problems.

(If you're interested I'm looking at buying at least one preloaded computer offlease (used) from either discountelectronics.com, tigerdirect.com, microcenter.com or officedepot.com).

Windows 10 is extremely chatty in that it monitors user activity for various reasons and excuses. Fortunately, there are lots of Win10 telemetry restriction programs, scripts and procedures available via a simple web search (I'll do a further post on some). But I speculate that it's more necessary than normal that you look into Win10 security due to the new chattiness, for the following reasons.

Unlike in the past, Windows 10 monitors user activity as well as security stance with various installed tools including a keystroke logger. This means that it sends data to Microsoft for later analysis.

But note that if this shuffling (telemetry) happens, then that means two other things. First, that it gets transmitted over probably-insecure, probably-unencrypted channels. That transmission provides the opportunity for someone to use the good-ol' MITM attack. If you don't know what that is, Goo... no, Yandex it.

And then there's a third problem I haven't seen discussed much. Microsoft would, after harvesting the info, store it somewhere. It's that storage location I wonder about. Years ago, Microsoft lost the source code to a break-in when somebody got into their network at Richmond, WA - but not directly. Rather than hit MS servers frontally, the sneaks got hold of an employee list and located a manager working from home. That's right. Security wasn't quite as good on the home laptop or desktop, so they hacked the manager. Getting in via his credentials, they swiped all of Win98SE, I think it was. Oh, I forget. Goo... no, Yandex it. And I dunno; maybe Win10 is 90% Win98SE.

This last holds the greatest number of possibilities for future bad guys in my view. Cook up a... let's call it a "Prospector Program" that searches for addresses of databases and storage locations (network, attached device, cloud, whatever). Then set up a humungous data repository for it to use as a depot. Give it an obscured and encrypted communications method. Then run the program 24x7x365 at a low-intensity level of pings, attempts, etc. You're not hitting the main web interfaces or firewalls aggressively. You're hitting a secondary area that's not being DDoS'd in spectacular fashion, for example. There's a greater possibility of overstressed admins having their backs turned.

Just a few thoughts.