YM.com associated with Rec Tec?

[this_is_my_name]

So I downloaded and installed the rectec mobile app. I have LastPass installed and it stores pswds. When I went to look at the setup, the dns for the backend was http://rectecgrill.ym.com. Can someone confirm that ym.com is safe? Is that who they got to make the mobile app? The entire site looks like Chinese.

 

[Mike]

@this_is_my_name I can't looked all that closely into the Rec Tec mobile app, but being that the grill is made in China it wouldn't surprise me in the least that Rec Tec has also outsourced the app development there too.

I'll dig more into the app when I get some time. I will say you're in a much better position than many using a password manager so kudos to you for that.

 

[this_is_my_name]

Thanks. It's kind of my industry (SWE).

Please let me know what you find. I also pinged the company as well. I used a different "account login" for the mobile than I did for their website for safety. Was concerned when I saw ym.com.

 

[Mike]

@this_is_my_name we're about to have company over so I haven't had time to really dig into it, but I did get to fire up the grill and open the app and watched what DNS requests were being made.

I don't see anything going to any part of ym.com but have found DNS requests going to http://backend-1.rectecservices.com/ which takes you to an Apache Tomcat 7.0.39 splash page.

There are two things that make me a bit sad about this - First being Apache Tomcat 7.0.39 was released in 2013 making this a VERY old version. Second is that site does NOT respond to HTTPS requests which means every thing sent to that site is sent in clear text.

 

[this_is_my_name]

Hmm that is not good. So I also relogged into the app and LastPass didn't recognize the url. I wonder if the url was for registration process and not the overall. If you create a new account, I wonder if the url shows up. Not sure. Either way, non ssl is not encouraging...

 

[Mike]

Not sure. Either way, non ssl is not encouraging...

You know what they say, "The S in IoT stands for security".

 

[Eric Hubbard]

You know what they say, "The S in IoT stands for security".

I had not heard that -- and find it hilarious!