t-jayw / pleasetakecareofmyplant Goto Github PK

1. 2016-06-23 11_57_31.482370-07_00_screengrab.jpg
2. 2016-06-23 13_07_58.112890-07_00_screengrab.jpg
3. time_stamp_screengrab.jpg

Theses are the three images I can't open. I don't know if it is just me or if these files are corrupted or something. I have downloaded and extracted the zip download.

The screengrab 2016-08-11 23_01_02.087444-07_00_screengrab.jpg is a 0 byte file.

The web service used to consume sensor readings from subject 126 (species: Zebra) is communciated with over an insecure interface and lacks authentication. Erroneous sensor readings could be sent to this end point to manipulate the public into killing subject 126.
The service client should be amended to use mutual TLS authentication. At a minimum digital signatures should be leveraged to prevent misuse of the service.

The killswitch should, at a minimum, make use of a secure connection (eg. TLS v1.2) to the server before the check. The published value should be digitally signed to prevent the anti-ficus alliance (they don't like zebra plants much either) or other plant-terrorist networks from infiltrating vital life-support systems.

https://github.com/tylerjaywood/pleasetakecareofmyplant/blob/579dac5224c52655d3559ab9559aacdd4a089c7f/config.py#L33

Similar vulnerabilities exist in the weather inquiry that when leveraged would allow plant-rights separatists to dissuade the public into a panic wherein the either drawn or starve our noble hero. Examine the vendor interface and determine if TLS is supported and if there exist any further forms of API verification. In the worst case, consider reading data from a secure local sensor safely ensconced behind the demilitarized zone.