Bugs in Samsung IoT Hub Leave Smart Home Open to Attack

This. This 100x. Complete client isolation in air and in the wire. You'll sleep better.

What is somewhat frustrating is that some vendors still design their equipment, and especially their setup process, in a way that it requires (W)LAN without client isolation.

I don't want to call out names, but vendors out there, please, please, please with sugar on top, built your IoT setup process in a way that I can complete it without assumption that both device and client will be able to connect to same WiFi and be able to communicate directly with each other. E.g. modern, well behaving IoT do it along the lines of:

  1) on fresh start device creates WiFi access point (AP) or is visible via Bluetooth (not big fan of the latter, but...)
  2) Connect to temp hotspot (or BT) with your laptop, or phone
  3) Setup device (e.g. which WiFi to use, create account, ...)
  4) At the completion of the setup, device shuts down temp AP, and device and laptop/phone connect back to their WiFis
  5) From this point-on, all communications from client to device go via internet / service provided by IoT device manufacturer (ideally over TLS).

I recognize that by design I am now in a strong vendor lock-in. E.g. should manufacturer of given device go out of business or discontinue service, that particular IoT will become useless just the same. So it goes...

> If you're going to run IoT devices in your house I highly recommend isolating them to their own VLAN+Wifi SSD to limit their exposure to the rest of your network.

This goes both ways, too. You don't want someone to pivot from an IOT device to your PC, but you also don't want someone to pivot from your PC into an IOT device like a security camera or door lock.

I'm not a big fan of the Smart Things architecture. It's designed to allow you to create custom device types for devices they don't support, and custom extensions for new behavior, which is great. The problem is, anything you add outside of the stock code will only run on their cloud, and not on the device itself, meaning my motion sensor has to go to the cloud and back before turning on my basement lights. I'm currently looking into alternatives because this is a terrible way of implementing a home hub.