Smart homes are hackable homes if not equipped with the latest tech
- Reference: 1654083125
- News link: https://www.theregister.co.uk/2022/06/01/which_smart_tech_hacked/
- Source link:
The report by consumer rights organization Which? paints a grim picture for people who have equipped their residences with gadgets, many from trusted tech names.
As with pretty much everything in IT, if you connect a device to the internet, ensuring it's patched and has a decent password is the very least owners can do. Even then, there are no guarantees that this is secure.
[1]
Unsurprisingly, the Which? team found that out-of-support devices were relatively straightforward for hackers to compromise. The example of an early Amazon Echo smart speaker was given where researchers were able to take control without the user being aware.
[2]
[3]
Other devices, such as smartphones and routers, were also exploited. The Which? team were able to infect a Samsung Galaxy S8 smartphone with malware disguised as a delivery text. Siphoning of user data was then possible.
However, in both cases the devices were out of support and "the attack would have been better blocked or detected by a device that was still receiving security updates," Which? noted.
[4]Insteon's vanishing act explained: Smart home biz insolvent, sells off assets
[5]IoT biz Insteon goes silent, smart home gear plays dumb
[6]Amazon Alexa can be hijacked via commands from own speaker
[7]Hive View security camera customers left in the dark as some gear gives up the ghost
Other devices Which? tested included a Google Nest Hello video doorbell, a HP Deskjet printer, and a Philips TV, "which is supposed to still be supported with updates" but "could be hacked using an easily guessable default password."
The problem with IoT devices is that consumers tend to treat them as appliances. This writer, for example, has a set of speakers more than 30 years old. It is hard to imagine a smart speaker having that sort of longevity in terms of security updates. [8]Insteon springs effortlessly to mind when one thinks about smart devices abandoned by their makers.
[9]
There are a few relatively simple steps you can take to deal with the issue. One would be to ditch meaningless terms like "lifetime updates" and label devices with clearer indications of when support will end. Another, according to Which?, would be "mandatory minimum periods for how long different types of smart products must be supported."
"There should be stiff penalties for companies that fall short of standards," the organization said.
Ultimately, the research is yet another reminder user need to take care as they fill their homes with connected gizmos. You might end up with your data unexpectedly siphoned or be an unwitting part of the next big botnet. ®
Get our [10]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/edgeiot&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YpeNJNlSilT3H1GnRhiFzwAAABQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/edgeiot&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YpeNJNlSilT3H1GnRhiFzwAAABQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/edgeiot&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YpeNJNlSilT3H1GnRhiFzwAAABQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2022/04/22/insteon_shutdown_explained/
[5] https://www.theregister.com/2022/04/19/insteon_cloud_shutdown/
[6] https://www.theregister.com/2022/03/03/amazon_alexa_speaker_vuln/
[7] https://www.theregister.com/2022/01/24/hive_view_issue/
[8] https://www.theregister.com/2022/04/22/insteon_shutdown_explained/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/edgeiot&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YpeNJNlSilT3H1GnRhiFzwAAABQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
Well.... der.
In other news: "SKY DISCOVERED TO BE BLUE"
I've never seen blue sky that didn't become cloudy ... and when it gets cloudy we normally see a thunderstorm.
Evidence right there of the danger of allowing the atmosphere to be hacked.
Either apply the latest patch or, if there isn't any, get rid of it.
"Either apply the latest patch or, if there isn't any, get rid of it."
I think it's OK, just saw a patch of blue sky ...
As they say - the "S" in IoT stands for "security"
Anything equipped with the latest tech not hackable now will be next week. Its previous generation won't work because the servers have been turned off. In due course there'll be a new generation and it will have become the previous generation in its turn unless the data that's being slurped pays more than they expect to make from the next generation sales.
"The problem with IoT devices is that consumers tend to treat them as appliances."
No. The trouble with IOT devices is that they are SOLD as appliances.
If "consumers" knew how much effort and risk was involved with them, they probably wouldn't buy them.
Re: "The problem with IoT devices is that consumers tend to treat them as appliances."
No. The trouble with IOT devices is that most are SOLD at all.
Re: "The problem with IoT devices is that consumers tend to treat them as appliances."
Fair point, well made.
Re: "The problem with IoT devices is that consumers tend to treat them as appliances."
Lots of my family believe I am paranoid for refusing to put in an Alexa/Google thingy anywhere in my place, I doubt they would care.
Re: "The problem with IoT devices is that consumers tend to treat them as appliances."
A relative bought us an Alexa thingy as a gift. It was rather embarrassing telling him we didn't want it and can he get his money back for it.
Re: "The problem with IoT devices is that consumers tend to treat them as appliances."
Yeah, I know that feeling - but unfortunately it was either accept it or downgrade WifeV1.0 to ExV1.0
So I set up the WiFi to isolate it from the rest o the network.
Re: "The problem with IoT devices is that consumers tend to treat them as appliances."
No the problem is that they *require* internet connectivity.
These things need to have local interfaces/APIs only - at that point you then have a simple VPN (something like tailscale) to connect with the devices remotely.
It's infuriatingly difficult to find stuff that doesn't require a public connection.
Re: "The problem with IoT devices is that consumers tend to treat them as appliances."
Even worse than *requiring* an internet connection, they frequently give you zero info about what they will do/is required and all the instructions say is
Scan this QR code & install the App.
NO!
Apart from permitting somebody to remain seated on their arse, what actually benefit so these so-called smart devices bring?
My door is controlled by an odd shaped piece of metal. It even works in a power cut. It is hackable, but not remotely.
My lightswitch doesn't fail when connectivity drops out. It's been working reliably since before I was born.
My car starts with another odd shaped piece of metal (and no stupid "button"). It doesn't care whether there are clouds present, or not.
For many people those control devices aren't accessible.
Of course there is also the ability to monitor my home, and to reduce energy use.
One of the things I have done is build a smart heating system. I now only heat the rooms that need heating at any given time, and one room which was *never* warm enough previously is now easily heated.
Part of the reason that room was never warm was that the hall thermostat was a long way away - and the room only ever got the dregs of the hot water from the boiler - now when it calls for heat it's often the *only* radiator which is doing so, so it gets all the heat it needs.
I also have logs of the temperatures in each room - which means I can predict when I need to add heat to each room. There is one room where I now know that the radiator basically never turns on - it gets enough heat from the room below it almost all the time.
Most homes in Denmark decades ago had a much simpler system: a thermostat on each radiator, end off. I first time encountered a central thermostat in the UK and wondered how that would play with the radiator mounted ones.
The prevalence of the system just may have something to do with Danfoss and Grundfos.
Well, all my UK radiators have their own control knob (from minimum freeze protection up to six). Same at my parent's place. There is the main thermostat in the hallway but you can restrict the water flow per room on each radiator. Hive do posh, remote controlled, ones now, but they cost way to much to justify in my small house.
Since I'm tight, my main temp is never set at more than 18 and if we are cold we put an extra layer on!
They work well as long as the radiators nearest the thermostat are on and you don't place the main thermostat in a stupid place, otherwise the boiler will pump water which never make it into a radiator.
Sounds like a good setup, but none of the devices you use need access to the internet to do what you're doing with them do they? Unless you need to control/monitor it when you're away from home, your heating could be managed with devices on your LAN which are blocked from all web access.
The problem is that the plug-and-play consumer devices (i.e. stuff that my mum could make work) all require web access. For example, it's easy to set up some home security cameras if you buy them from one of the big snooper companies cos the app does it all, but to set up your own cameras, server, monitoring, remote storage, etc. is a whole nother thing - which is why I've got two cameras in the loft and "Get those cameras working" has been hovering near the top of my To-Do list for a year or so.
Two things. TRV's Thermostatic Radiator Valves
and correct balancing of your radiators will do that for you.
No IOT required. lower your heating bill without increasing your electricity bill
If you have a cold room, your rad's aren't properly balanced.
Current devices on in my home:
Computer & monitors which I'm working on
NAS which stores files I'm working on
Router & Hub
Fridge
Freezer
Alarm Clock in bedroom
Please tell me how your IoT devices (which I presumably consume power themselves) are going to help me reduce energy use.
As for heating, well it's May so the heating isn't on. If it were then I have individual thermostats on the radiators and I can tell if the room is warm enough by standing in it. No need for logs.
" Of course there is also the ability to monitor my home, and to reduce energy use. "
So, you're using little electric gadgets to try to reduce your electricity use? Perhaps less tech would be the answer?
That being said, all of this sort of functionality should be quite happy working within the confines of your LAN. The only thing that has a justifiable need to talk to the outside is a smart meter for reporting consumption. Though for obvious reasons any smart meter that's worth a damn won't be spewing its guts over a domestic network connection.
The weakness, and the reason for the hackability, is that so many of these devices are tethered to the mothership for absolutely no reason other than blatant data fetishism by the manufacturer. And that's what is expected of us. Devices are increasingly designed to need the mothership. To fail in its absence.
" I also have logs of the temperatures in each room "
Wow. I live in an old farmhouse with stone walls. Gets pretty cold in the winter, but I got used to that at boarding school and an insane desire to keep the dormitory windows open in the middle of winter. So, heated blanket and a hot chocolate and I'm good. ;)
Accordingly, my yearly electricity bill is less than some people I know pay for a single month in the winter.
> what actually benefit so these so-called smart devices bring?
You just have to understand what "smart" means. Special MARketing Tricks. It is just a sales method to sell the latest shiny thing to people. This item lasts for three years. Then you sell another latest shiny thing. It is all about the SALEs. Gotta get more Sales. Don't care about customer.
People like us with old cars and speakers are really not popular with these Sales people as they need to make their Percentage.
Smart is so the Salesman has a gimmick to promote, not for the making the customer happy.
Also that same Salesman loves this Which report and now they have another reason to tell you to upgrade.
"what actually benefit so these so-called smart devices bring?"
We ended up having a so called smart meter installed as it was getting too difficult for me to get on my hands and knees on the floor and climb halfway into the cupboard to read the old meters. It hasn't worked since it was installed. The display only shows gas usage not electricity. I've reported the fault to Shell (our energy provider) on four occasions now and they've done nothing. So I've turned off the display unit and tossed it into a drawer with other defunct electronic kit. So much for smart meters.
To be fair the media are on about turning off "vampire" devices, my one has a sodding battery in it (Why?).
If I had the choice when moving here I would have had the oldest metres possible, but previous owner had pre-paid metres and I didn't spot they were pre-paid until I moved in and suddenly realised I should have took a closer look (Fun trying to setup a gas card and leccy key! :middle finger to how stupid it is to get them).
Don't you pay a horrific surcharge on key meters?
Wrong headline?
Surely the headline should be "Smart homes are hackable homes if equipped with the latest tech"?
I get the point about needing updates but it's the latest tech that is causing this problem, not solving it.
One problem is that IoT stuff is designed to be always connected - even if it doesn't need to be. I had a WiFi puck that I bought to play music from Mac to HiFi over the LAN. If I blocked it from web access with my firewall it wouldn't work. I understand it's important to keep stuff updated, but I'm happy to manage that manually rather than just leave stuff permanently connected. Only my Mac and phone get unfettered* access.
There need to be standards for these things and also education/warnings. I've just bought a DAB radio and the first 2 pages of the manual are full of safety warnings like:
"Unplug the unit from the mains socket during a lightning storm."
"If you spill any liquid into the unit, it can cause serious damage. Switch it off at the mains immediately. Withdraw the mains plug and consult your dealer."
"Make sure the unit is not resting on top of the mains cable, as the weight of the unit may damage the mains cable and create a safety hazard."
"If the mains cable is damaged it must be replaced by the manufacturer, its service agent, or similarly qualified persons in order to avoid a hazard."
If IoT kit came with similar alarmist warnings like "This unit should only be connected to the internet by a suitably qualified IT engineer or you risk having your bank account emptied" then maybe people would be more circumspect.
* Their access is a bit fettered.
Please remember this is Centrica/british gas that has been caught THOUSANDS of times ripping off the elderly.
In trading standards cases, new boilers were fitted, a single wire was disconnected and British gas called.
because the engineer was on commission they'd tell the elderly resident (actor/actress IRL) they needed a brand new boiler as the current one was dangerous.
Not just one area, but this has happened all over the UK, indicating corruption from on high.
Who would trust them with home security?
Alternatives
" You might end up with your data unexpectedly siphoned or be an unwitting part of the next big botnet "
Or you might even find your home stripped of its contents becuase someone found out how to circumvent your 'connected' front door lock.
Re: Alternatives
And then your insurer refuses to pay out because there's no evidence of "forced entry".
if you connect a device to the internet
Now I will say I have no smart home thingys so might be missing something, but in my old school mind 'if you connect a device to the internet' means give a public IP. Am I missing something? Do these devices somehow manage to make themselves accesbile via the internet themselves? So is this UPnP of something? Again never felt the need for UPnP and would diable it without thinking further.
My elderly neighbours have a fancy IoT thermostat installed that was supposed to save them money on their gas bill. One day last winter their internet connection went down for several hours and it was apparently impossible for them to turn their heating on. I suppose in that respect it did actually save them some money, just not in the way they envisaged.
keep it at home
> if you connect a device to the internet
... then you have lost control.
However, if you can run everything off a personal hub, without the need for "cloud" services then not only do you free yourself from the forced upgrades, programmed obsolescence and security requirements imposed by third parties, but your latency will be lower, broadband outages can be laughed at, price increases and changes to Ts & Cs ignored and your system becomes truly your own.
And when there is one that is designed properly and robustly it could stay operational for decades.
"Smart homes are hackable homes if not equipped with the latest tech"
upgrading to the latest tech may, at best, upgrade smart homes to not-yet-hackable homes.
Cobblers
Anything connected to the internet can be cracked, exploited or hacked if you have someone with the know how trying to get in.