60% of Used Amazon Echos Can Be Compromised

60% of Used Amazon Echos Can Be Compromised
Don't Sell Used Google Home, Nest, Echos, etc.!

The majority of Americans, at least those of middle income and higher, have the smart devices in their homes. It's everything from the Amazon echo all the way up through our thermostats. Are these a good idea? And what do we do when we get rid of them? 

IoT, you might've seen that before. And it stands for the internet of things, and these devices are actually computers on them. Have even more than one computer. Some of them have a lot of processing power. You look at some of these speakers, like the apple; the big apple speaker has some amazing processing belt right into it.

Of course, it also has a number of different ways that you can use it with Siri and everything else that's in it. But if you're going to sell these things, if you're going to sell your echo dot or other things, what should you be looking at? How can you do this? I had a listener who reached out to me.

[00:00:56] This was only a couple of weeks ago, and he had a problem. All of a sudden, he was getting charges from Amazon for things. Did not order. So he asked me what's the right way to go here. And, being the coach that I am, I pointed him in the right direction, which was pointed him at the Amazon security people.

[00:01:20] So he got a hold of them and spoke with them. It turned out that his Amazon echo that he had was what was used to order all of these items. And guess what? He didn't have that Amazon echo; he had sold that Amazon echo, and when he sold it if somebody bought it right, a used echo online and was using it to order things and have them shipped, not to his house.

[00:01:53] Elsewhere. So it is a really big potential problem that has been looked into, and there is a group of researchers on the Northeastern university who bought. 86 use devices. And this is an article from Ars Technica, Dan Gooden, who wrote this and what he, what they found over the 16 months is that 61% of these devices that they bought 61% had not been reset at all.

[00:02:33] No, that to me is not terribly surprising, but it's horrific. If you're trying to keep your data safe because think of what these smart devices have in them. They've got your location; they've got your wifi networks and passwords. They may have account information; what did you go ahead and link it to which accounts are on.

[00:03:00] There are a whole bunch of things that can be gleaned from them. Now he, this listener, said that he had reset his device, and you can and should do that if you're going to give it to someone in the family, which is what I would recommend as opposed to selling it. And I'll tell you why. These devices have inside of them a particular type of memory it's called NAND flash memory.

[00:03:32] And the memory is you can think of it in similar ways to your solid-state desk drive. Back in the old days, the operating system would say, go ahead and write this block of data. This 512 byte block out to Track 17 sector one, and it would go ahead and write it to track 17 sector. But the problem with NAND devices and most SSDs all of them, frankly, is that you can only write so many times before the memory goes bad and it can be 10,000 to a hundred thousand times.

[00:04:13] And if you've ever wondered, why is this solid state disc so much more expensive than the other ones? Usually it's because it's using better memory that can take more. Cycles read cycles, do it all you want all day long, cycles is the problem. So they have come up with some technology that they build into these that does a level.

[00:04:36] And what that means is track 17 sector. One is really located here at position X. And then if you right track 17 sector one, again, it's really located at a completely different position. Y so that the right now get leveled across the entire division. Okay. You don't really have to understand that in great detail, but I know there's a few of you guys being the best and brightest that really want to understand that a little bit better.

[00:05:05] So that's why certain flash memory, certain SSDs are more expensive than others. Now here's the problem. When we're talking about these smart home devices, they're using this type of memory and NAND flash memory has a problem in Ohio has a few problems, but the biggest problem is it's not terribly reliable.

[00:05:30] Especially the type of Nan flash they use in these inexpensive devices. So it's not terribly reliable. So it builds in check sums, right? So those out at the same time, so that when a treat him back, he can say, whoa, wait a minute. This is block is bad. And then it can recreate the block on that flash memory, which is really great.

[00:05:52] Now, when you erase your device, It doesn't really, excuse me. When you reset your device, it doesn't really erase your device. I want you to think of windows as an example. You might know that if you delete a file from your windows computer, it's not actually deleted. It's actually still there. It just reallocates the space that file was using.

[00:06:18] So it can use it for yet. Another file. So you you delete something it's still there. So when you're getting rid of that computer, what you used to do with a spinning hard disk is you would run multiple rights on that desk, solving entire desk. You'd drive zeros, you'd write ones, you'd write random patterns and you'd be.

[00:06:43] And there are fancier ways to do it, the government, and it, many of the government contractors actually shred the desks. They have shredding machines, you can feed a whole computer into these things are just amazing. And then they send it off for recycling. What we do is we remove the platters inside the desk, the aluminum platters, and we melt them down in a furnace that we.

[00:07:10] I still had furnace. Now there's nothing readable on it. Cause all comes out as a big blob of aluminum. One word. Resetting your device just like deleting a file on your windows. Computer does not actually remove it. And nowadays we're reusing this leveling technology in these SSDs and NAND chips.

[00:07:34] We are really not getting rid of it. It might not be rewritten for a very long time. Because again of the leveling technology. So there's another process you can do known as off chip, which will require you to completely just assemble a desalt or the flash memory, and then mess around with it a little bit more.

[00:07:57] But here's the problem. Even though the listener said that he had reset factory reset his device before he sold it. It still had all of his information on the device. So all of the bad guys had to do is remove those chips and. And right inside, there was his Amazon account information, password, everything, it needed, the key to make orders with Amazon.

[00:08:29] Now that is a problem. If you ask me and it isn't just Amazon, this isn't just echo devices. We're talking about. The same thing can be true for that smart thermostat that you bought that Google thermostat, that smart. Doorbell that you have on the front of your house, though, those all contain this type of memory.

[00:08:51] So what I tend to do is take a hammer to. If you don't have a, what do you call it now where you can melt it down a furnace where you can melt them down, specifically designed for doing this type of thing. Then here's what I advise you to do. Get a drill with L fairly large bit. You want at least a three-quarter inch metal bit that you can put on to that drill.

[00:09:16] I used to use a drill press that we have and drill three. Large holes into the platter. So you don't have to open up the disc drive at all, but you'll notice there's a round section of the drive. That's where you want to drill into that round section of the drive, three big holes. And that disc is for all intents and purposes unrecoverable.

[00:09:40] So the bad guys can't get your bank information. They ha they can't get it. That spreadsheet that you have with all your passwords, you not in person Best and brightest come on guys. And they can't get anything off of that. So when I'm talking about IOT devices, what do we do? What do we do?

[00:09:59]Basically, I would say don't sell them. They're cheap enough. You can get an accurate. For well, under 50 bucks, 80 bucks at the high end for the ones with the video and everything built into them. When you're done with it personally, I would destroy it, physically destroy it. Cause that's the only way to make sure your data is not going to be.

[00:10:25] Hey, stick around. You're listening to Craig Peter son. Make sure you get my newsletter. The free one is at CraigPeterson.com/subscribe.