Sure, just super not what I think of when I read the headlines. I read the headlines and I expect the things to be on Shodan.

You are safe until you are a real target. The exploit someone have ready for your safe browser was not used yet in the wild.

Edit: maybe where I was coming from is not entirely clear, tried specifying it better here: https://news.ycombinator.com/item?id=47255003

========

I can materialize that smell for you, you're indeed more secure because you're behind NAT. Admitting this does not necessarily entail:

- suggesting that it's a good security solution

- suggesting that it's a security solution to begin with

- suggesting that it somehow prevents all avenues of remote exploitation

What it does do is make these stories sound a lot less dramatic. Because no, John Diddler is not going to be able to just hop on and get into your child's smartwatch to spy on them from the comfort of their home on the other side of the world at a whim, unlike these headlines and articles suggest at a glance. Not through the documented exploitation methods alone anyways, unless my skim reading didn't do the paper justice.

Remaining remote exploitation avenues do include however:

- the vendor getting compromised, and through it the devices pulling in a malicious payload, making them compromised (I guess this kinda either did happen or was simulated in the paper, but this is indirect and kind of benign anyways; you implicitly trust the vendor every time you apply a software update since it's closed source)

- the vendor being a massive (criminal?) doofus and just straight up providing a public or semi-public proxy endpoint, with zero or negligent auth, through which you can on-demand enumerate and reach all the devices (this is primarily the avenue I was expecting, as there was a car manufacturer I believe who did exactly this)

- peer to peer networking shenanigans: not sure what's possible there, can't imagine there not being any skeletons in the closet, would have been excited to learn more

List not guaranteed complete. But this is the kinda stuff I'd be expecting when I see these headlines.

Sure. Or you might step out the door and a fridge falls on you. Equally likely.

Yes, it's an exploit. It should be fixed. But the endless hyperventilating over fringe exploits mostly has the effect that people now ignore all security conversations.

I guess I managed to mention everything but what I was actually, specifically fishing for: I wanted to confirm this claim and claims like it:

> The watch had an insecure network service that anyone could access via the internet.

Sure, but that’s increasingly likely to be a private IPv4 address as a result of:

Carrier-grade NAT (CGN or CGNAT), also known as large-scale NAT (LSN), is a type of network address translation (NAT) used by Internet service providers (ISPs) in IPv4 network design. With CGNAT, end sites, in particular residential networks, are configured with private network addresses that are translated to public IPv4 addresses by middlebox network address translator devices embedded in the network operator's network, permitting the sharing of small pools of public addresses among many end users. This essentially repeats the traditional customer-premises NAT function at the ISP level.

Having said that, NAT isn’t a firewall.

Because just like all other types of ISPs, they usually put their customers behind cgNAT.