How to break a smart home, again

Speaking as a former HVAC&#x2F;mechanical maintenance engineer, technology like Nest is obscenely underdeveloped. Commercial HVAC systems like Liebert dont get 5-6 strikes at the plate to figure out how to avoid shutting off a customers heat in the dead of winter. Screw up the HVAC in a nursing home or elementary school, and you can kill people.<p>Honeywell&#x27;s commercial offering should be the gold standard here in my opinion. Its fully ipv6 and ipv4, and relies on time tested probes and monitors to determine what the hell is going on. You cant force it to short-cycle motors until they burn up, and it cant be forced offline from the control interface if environmental conditions are outside a certain range (Desert summer, for example.) Januaries update even included EC25519 for console and PFS support for the web interface. Best of all, if something is egregiously screwed up in the system, it failsafes to a simple thermostat or pulls settings from a cluster.

Yet another article that went out and found the shadiest cheapest worst IoT devices and extrapolates in headlines that the entire ecosystem is that bad.<p>Where&#x27;s the analysis of Nest? Where&#x27;s the pentesting of SmartThings? Where&#x27;s the article about how they tried 12 different ways to get into another reputable brand?<p>Don&#x27;t think for a second that I&#x27;m saying anyone should get a pass, they shouldn&#x27;t, but this to me seems like the equivalent of reviewing $3 luggage locks and talking about how insecure they are, then concluding that all locks are insecure and you shouldn&#x27;t use them...<p>I will say that this article is better than most at keeping the criticism specific to these devices (except for the headlines), but they don&#x27;t name the devices, so the analysis isn&#x27;t doing any good (I still have no idea which device it is, and therefore can&#x27;t protect myself by not buying it...)

&gt; An interesting fact is that the bulb does not interact with the mobile application directly. Instead, both the bulb and the mobile application are connected to a cloud service and communication goes through it.<p>That convinces me to not buy a smart lightblub. The lifespan of an LED is ~30 years. The lifespan of a IoT&#x2F;cloud company can be much shorter.

The connected lamp in the article is, one can read from the pics, the Xiaomi Yeelight. I have a couple of those. They are wifi-connected and you use an app to interact with them (by default). What you can do is to, in the app, enable &quot;developer mode&quot; which enables a local-network interface. Then, you can control them on the local network over TCP.<p>They have a really nice build quality, a well-documented API for local control, very nice light with adjustable color temperature. And, they have built in support to simplify things (eg &quot;go to 100% over a period of 3 seconds by dimming slowly&quot;, or &quot;fade to 3000K color temp over 10 seconds&quot;). And they cost only about 15€.<p>The non-RGB variant cannot change color temperature and is in my opinion too cold so I can&#x27;t recommend it.

Personally, I think a &quot;smart&quot; home is one that provides maximum comfort for minimum effort.<p>Having to (eg) update the firmware on my lightbulbs sounds about as smart as having to hand-wash my clothes. Hours of effort to save myself 2 seconds a day toggling lights? Not too smart, IMO.

Does anyone have secure home security camera recommendation that doesnt operate on a subscription model?

So, if an attacker is already physically on your network, and they trigger a firmware update on the lightbulb, and they have modified your router&#x27;s DNS to request a malicious site, AND they have set up a rogue firmware server likely on your own network, AND they have crafted a malicious firmware for your smart lightbulb...<p>...they can install a malicious firmware on your smart lightbulb that will forward them your wifi password?<p>The horror, the horror.

The article makes reasonable technical points, but adds a fair amount of scaremongering. Even the title is clickbait-y (which is not surprising since the firm is in the IT security business).<p>I personally do not feel that all IoT-capable devices must be secured to the hilt. If I set min and max temp on a network-enabled thermostat I am not worried that someone will connect and warm (or cool) my home a bit within that range while I am out. At worst I might suffer a minor discomfort when I come in, but the chances are low and the fix is cheap.<p>Most IoT setups I would consider fall in the same category: low benefit for attacker and low pain if hacked. If so, I take simplicity and reliability over security. And if I ever wanted to build an IoT setup that would be more painful when hacked I would probably put together 2-3 simple, completely distinct systems that report the same data and check for discrepancies to detect intrusions rather than trying to secure one device to the max. Just my 2c.

Looks like they&#x27;ll need to add a map function to haveibeenpwned.com so you can search by your house address. =(

The most surprising thing was that they even <i>bothered</i> encrypting the root password or responding to the vulnerability reports. From what I can tell, that&#x27;s far above and beyond the average IoT manufacturer.

In the comments here and articles like this one, what is the rationale against naming and shaming? Is it legal CYA? Some kind of arbitrary hurdles for would-be exploiters?<p>I want to know what stuff to avoid what companies don&#x27;t care about security.

If GDPR was enforced, the manufacturer of such devices would be heavily fined, right ?

Is this scaremongering? I write firmware for IoT devices for a living. The client rarely has any interest in security. I put some in, but if it gets in the way (e.g. a variable password for setup depending on the device serial number) they ask to remove it. Sellers actually want a single default.<p>The latest did want encryption between the device and their upgrade server, which was good. Now it&#x27;s as secure as their server. Hack that, and of course you own the device, no ALL their devices. No, ALL the devices supported by the service that manages IoT devices for them and others.