Warning

 

Close

Confirm Action

Are you sure you wish to do this?

Confirm Cancel
BCM
User Panel

Site Notices
Posted: 7/30/2017 4:46:20 PM EDT
Spare y'all the details, but someone hacked my ecobee account and was screwing with my settings and schedule.

Customer Service confirmed that some one had accessed my account out of country.


If you have an Ecobee, be warned!
Link Posted: 7/30/2017 4:48:07 PM EDT
[#1]
How bored would someone have to be to hack that?.....
Link Posted: 7/30/2017 4:48:19 PM EDT
[#2]
How did they hack it though? Was their user database compromised or did they get your info through some other means?

That kind of matters when you tell everybody to beware about account hacking for a particular service.
Link Posted: 7/30/2017 4:48:55 PM EDT
[#3]
I think I would stay away from that home automation / IoT shit.

Posted from a conference hall at DEFCON 25
Link Posted: 7/30/2017 4:49:39 PM EDT
[#4]
Discussion ForumsJump to Quoted PostQuote History
Quoted:
How did they hack it though? Was their user database compromised or did they get your info through some other means?

That kind of matters when you tell everybody to beware about account hacking for a particular service.
View Quote
They wouldn't tell me, other than that the logs showed that my Ecobee web portal was accessed out of country and I needed to change my password.
Link Posted: 7/30/2017 4:50:20 PM EDT
[#5]
That is one bored mother fucker.
Link Posted: 7/30/2017 4:51:59 PM EDT
[#6]
Is that like a FlowBee?
Link Posted: 7/30/2017 4:52:03 PM EDT
[#7]
all the told me was to change my password.

Link Posted: 7/30/2017 4:54:59 PM EDT
[#8]
Discussion ForumsJump to Quoted PostQuote History
Quoted:
How bored would someone have to be to hack that?.....
View Quote
That was my question.  Shit.
Link Posted: 7/30/2017 4:58:34 PM EDT
[#9]
Link Posted: 7/30/2017 5:01:03 PM EDT
[#10]
Discussion ForumsJump to Quoted PostQuote History
Quoted:
There is a well known web site that use software to search the internet looking for devices connected to it. The robot software tests to see if the passwords are default and posts their results to publically open databases for hackers to use as they see fit.
View Quote
Password was not default, and not generic.
Link Posted: 7/30/2017 5:03:51 PM EDT
[#11]
Discussion ForumsJump to Quoted PostQuote History
Quoted:
That was my question.  Shit.
View Quote View All Quotes
View All Quotes
Discussion ForumsJump to Quoted PostQuote History
Quoted:
Quoted:
How bored would someone have to be to hack that?.....
That was my question.  Shit.
Extortion, gaining persistent access to your home network, for the lolz. Take your pick.

Here's an older story about ransomware.
https://slashdot.org/story/314689
Link Posted: 7/30/2017 5:07:08 PM EDT
[#12]
Discussion ForumsJump to Quoted PostQuote History
Quoted:
Password was not default, and not generic.
View Quote View All Quotes
View All Quotes
Discussion ForumsJump to Quoted PostQuote History
Quoted:
Quoted:
There is a well known web site that use software to search the internet looking for devices connected to it. The robot software tests to see if the passwords are default and posts their results to publically open databases for hackers to use as they see fit.
Password was not default, and not generic.
The ones you know about weren't. It's the devices you didn't even know could be accessed that have the default password, and let them in that way.

It's some form of magic.
Link Posted: 7/30/2017 5:07:30 PM EDT
[#13]
Discussion ForumsJump to Quoted PostQuote History
Quoted:
That was my question.  Shit.
View Quote View All Quotes
View All Quotes
Discussion ForumsJump to Quoted PostQuote History
Quoted:
Quoted:
How bored would someone have to be to hack that?.....
That was my question.  Shit.
Could be looking for a way into people's networks.......it's already a trusted device, so packets flowing from it/to it wouldn't be as obvious.  Probably got his password from some malware on his machine or it was a simple password.
Link Posted: 7/30/2017 5:08:15 PM EDT
[#14]
My wife hacked mine and set the shit to 76.  I want it at 74!
Link Posted: 7/30/2017 6:03:28 PM EDT
[#15]
Discussion ForumsJump to Quoted PostQuote History
Quoted:
Password was not default, and not generic.
View Quote View All Quotes
View All Quotes
Discussion ForumsJump to Quoted PostQuote History
Quoted:
Quoted:
There is a well known web site that use software to search the internet looking for devices connected to it. The robot software tests to see if the passwords are default and posts their results to publically open databases for hackers to use as they see fit.
Password was not default, and not generic.
You need to change your password at every website that uses the same or a similar password or they could be compromised too.
Link Posted: 7/30/2017 6:08:13 PM EDT
[#16]
One of the things I like about the Nest (yeah, not as good) is they support two factor authentication.
Link Posted: 7/30/2017 7:27:33 PM EDT
[#17]
Discussion ForumsJump to Quoted PostQuote History
Quoted:

You need to change your password at every website that uses the same or a similar password or they could be compromised too.
View Quote
I use different pass phrases for everything!
Link Posted: 7/30/2017 7:30:21 PM EDT
[#18]
Was the password 12345, because that is the same as my luggage.
Link Posted: 7/30/2017 7:34:22 PM EDT
[#19]
Discussion ForumsJump to Quoted PostQuote History
Quoted:
Was the password 12345, because that is the same as my luggage.
View Quote
Link Posted: 7/30/2017 7:37:36 PM EDT
[#20]
Discussion ForumsJump to Quoted PostQuote History
Quoted:

Password was not default, and not generic.
View Quote
More than likely an exploit of a flaw in your firmware that bypasses your password.  Look for patches on your device type.

Here is an article on home routers.
https://www.wired.com/story/wikileaks-cia-router-hack/
Link Posted: 7/30/2017 7:41:59 PM EDT
[#21]
Mine is a RadioThermostat with the radio module on the side.

Someone screws with it, pull the radio module and it becomes a regular programmed thermostat.
Link Posted: 7/30/2017 7:42:34 PM EDT
[#22]
your password of "P@ssw0rd123" wasn't strong enough. ;)

Usually with hacks like that, it's either the company got hacked and the attackers got some list of accounts and passwords, or your password was too simple and a brute force attack got it right.

OR... you're using the same password that you use elsewhere, and THAT password got hacked.
Link Posted: 7/30/2017 7:49:48 PM EDT
[#23]
Go play around with Shodan and you will be shocked at whats out there.
Link Posted: 7/30/2017 8:00:13 PM EDT
[#24]
Discussion ForumsJump to Quoted PostQuote History
Quoted:
Go play around with Shodan and you will be shocked at whats out there.
View Quote
bro, I have been trollin' shondan since before youtube made it popular!
Link Posted: 7/30/2017 10:15:23 PM EDT
[#25]
do you save your passwords in your web browser by chance?

there's been attacks for a long time that will try and siphon those credentials that can be injected into advertising networks, so you could get hit by going to a legit site that sells ad space.
Close Join Our Mail List to Stay Up To Date! Win a FREE Membership!

Sign up for the ARFCOM weekly newsletter and be entered to win a free ARFCOM membership. One new winner* is announced every week!

You will receive an email every Friday morning featuring the latest chatter from the hottest topics, breaking news surrounding legislation, as well as exclusive deals only available to ARFCOM email subscribers.


By signing up you agree to our User Agreement. *Must have a registered ARFCOM account to win.
Top Top