40% of Smart Homes at Risk to Hackers | Hacker News Reader

40% of Smart Homes at Risk to Hackers

sensorstechforum.com

58 points1dunn026 comments

Only 40%?

Considering all the shit shows I've seen with "smart" devices, I think a dedicated adversary could break into pretty much all smart home setups, and I'd guess more than half would be vulnerable to scripted/automated attacks.

These devices have vulnerabilities, sure, but how exploitable? Any device on my network has a non-routable IP address it gets via DHCP, and the only port I have open on my public network is SSH which is forwarded to one specific internal IP address.

Back in the day, you could reboot some people's routers anywhere you could embed third-party-hosted images with tricks like:-

  <img src="http://192.168.0.1/admin/reboot.htm?Reboot=Reboot">

There are many avenues to exploitability, which makes most of this about surface area, and what types of threats you need to protect from.

Just a few potential weaknesses off hand: - Devices that have internal web servers, can be exploited through loading a bad web page, that makes requests forgeries to the device - Many smart home products use non wifi wireless (or even wifi) that when in range of your home network can be exploited. - The non wifi network can leak information. For example if you're detected as home or not. If I want to break into your home, it's much safer to know if someone is home. - While devices with automatic updates are badly needed, if the mechanism to provide updates can be spoofed, it can pull in a bad image (this require compounded exploits of course). Also think about a company hat goes out of business, and someone buy's up the update domains?? - If you invite a guest to your network, or a device that has been compromised before purchase (think store employee's), that can be a window into exploiting additional devices. - Some devices may use dynamic port forwarding (sorry can't remember the protocol name off hand), that may create dynamic forwarding rules in the model if the modem feature is enabled. I'm not saying this is common, but I could see people mistakenly believe that the device is protected behind a firewall when it isn't.

Anyways, I think my message is, while allowing inbound connections to a smart home device significantly increases the risk, there are still many risks that exist even within your own network, that depending on the vulnerability does leave certain risks.

and your closed source ISP mode+router combo probably routes traffic in both directions. An attacker just have to put your public IP as the gateway for 192.168/24 and he probably can access all those devices.

The popularity of "smart devices" continues to baffle me. There is simply no way that I'll install any type of smart anything in my home.

Security is certainly one aspect, but more than anything: I don't need yet another device to manage! I deal with enough badly design software at work every single day. Having yet another piece of software flake out when I get home is extremely low on my list of wishes for the future.

We can't even get smart TVs right. You have to go out and pay for a smart TV, ensure that it's only online long enough to get the firmware updated and then you have to buy something like an AppleTV on top of that to actually get streaming to work smoothly.

The title seems like a bit of a misrepresentation of the content due to the particular definition they use in the report for a "smart home". The notion of smart home usually refers to home automation and recently to IoT [0]. But you will notice that the definition here is "having any kind of device that can be hacked, except computers and smartphones which won't be considered".

> The majority of connected devices users have at home are still computers and smartphones which connect via Wi-Fi through the home router. Excluding these three types of devices [...]

> Top ten smart home devices per country (excluding PCs, smartphones, and routers)

Having a router is enough to treat it as a "smart home" and it appears they are the most hacked device. IoT doesn't actually feature too prominently in the report, despite the title.

[0] https://en.wikipedia.org/wiki/Home_automation

Original source (PDF):

https://cdn2.hubspot.net/hubfs/486579/avast_smart_home_repor...

Avast have a vested interest in selling security products, so their claim that (paraphrasing) "if one device is vulnerable then the entire home is compromised" isn't at all surprising. Easy way to get that 40.8% figure.

The publication is quite clearly an ad for their Avast Wi-Fi Inspector product.

Let me guess: RSA week?

That's next week, but basically yes.

Yeah, I'm seeing more and more people pick up products like UniFi, and putting IoT stuff over on a Private VLAN so that they only get to talk to the gateway and not be able to pivot to anywhere else on the network.

I put some thought into this last month. There are not a lot of consumer grade routers out there that support multiple LANs. Once you get into the business edge router type gear, it starts to become pretty easy. There's a few brands that will do it, and certainly a pfsense appliance on an x86 system with a few network adapters will do it. Running a router on an old computer is getting a bit out of style though...

My solution is really quite shoddy but it satisfies me. I took an old router and set it up with its WAN as a LAN client, and its LAN as an IoT network. The router does not have NAT translation on the LAN interface. It does however perform NAT on the openvpn interface. My new IoT network, which is on its own vlan/ssid/however I split layer 2, runs the packets through the vpn and out onto the Internet in some other network, and in theory never shall the two LANs touch. If the vpn goes down, there is no NAT to leak them out my home ISP directly. Sure, I'm doing double nat, but for my IoT stuff, who cares. It's just dye going in the river, just make it go away from me.

I adopted a recurring cost of 3 bucks for a vpn. But I didn't have to get shiny new gear or run an entire computer. My little way for the sake of sharing. Love to hear any criticism of it since I am still thinking about it quite a bit.

An obstacle here is that most of these business routers don't support UPnP. I don't want to argue the merits or pitfalls of UPnP, what's relevant is that lack of it becomes an obstacle to online play for modern video game systems such as Xbox. Add to that scenarios where router type is mandated by a particular ISP (Verizon in the US is applicable here) and there's quite a few scenarios where people may have the ability t manage such a protection scheme but other factors get in the way.

Yeah, kudos on you for thinking this through.

I really like Private VLANs over vanilla separate LANs(Physical or via VLAN) because it prevents each client from talking to each other even when they're on the same LAN. From the IoT device's perspective all they can reach is your gateway(192.168.1.1 or whatever) and no other device. So their ability to pivot/snoop on other devices in the network is curtailed.

Sadly it requires hardware support to do right since it's essentially disabling all the switching that exists at the ARP/Switching layer and forcing the device to route through the gateway.

On the UniFi gear this is literally just a checkbox when you're setting up the LAN(guest network vs LAN/corp network) and they handle the rest.

This is exactly what I did. I have an IoT VLAN and I also limit the ports accessible to those devices. I just wish this setup was available to the average consumer that doesn't know how to do this.

That claim isn't surprising even if it came from a company with no vested interest.

Most people who have those smart devices aren't really in the technical field. They won't have VLANs segmenting their network, or sniffers watching, let alone a proper firewall.

Look at Mirai; took over smart devices and instead of gaining footholds into everyones network; just used all the outbound traffic.

I wouldn't dismiss the claim just because an AV company said it.

I bought some name brand smart junk on Amazon day awhile back. Eventually I got around to trying to set it up. The first thing it asked me to do was to configure my router to expose the devices to open internet.

I immediately put it back in the box and haven't touched it since. I hesitate to resell it because part me feels it is my civic duty to destroy it rather than pass it along to another rube.

Wow, that's heinous. At worst they could use a VPN, and at best they would just download firmware updates or poll for config changes from the Internet the same way other clients on the network do. Out of curiosity, do you remember what brand(s) and or product(s)?

You'd be surprised how many hardware devices do this shit.

The next Mirai botnet will knock portions of the internet offline.

I'm adding RGBW LED strip lighting to my home office, and I wanted the option to eventually control the lights programatically. This was my first foray into home automation, and I settled on using Z-Wave for the communications.

AFAIK, the typical design for Z-Wave systems is to route most/all control through a home-automation "hub" (IIRC the terminology correctly). I was alarmed at the number of hubs for sale that required connectivity to the outside Internet.

I've decided to use a Raspberry Pi (with a Z-Wave modem) with a home-automation distro for my hub, and one of my main motivations was to avoid this huge external dependency / attack surface.

I feel bad for people with less savvy or computer skills who don't realize the potential hell they're risking.

Isn't this certainly a massive underestimation

The HN headline is definitely ambiguous and, I'd say, wrong. Anything is "at risk to hackers" if you include all varieties of cracking (not just remote exploits, but physical attacks, social engineering...).

The site's current headline ("40% of Smart Homes Currently Vulnerable to Hacking") is somewhat better ("vulnerable" instead of "at risk"), but they clarify in the first paragraph ("... are vulnerable to remove (sic) hacks ...").

This is blogspam for Avast's report: https://cdn2.hubspot.net/hubfs/486579/avast_smart_home_repor...

I took a quick look on Avast's blog and didn't see this report. I'm not sure where it came from.

I don’t care anyways, I only installed smart devices to make my wife happy. I don’t cate if my garage door opener gets hacked.

> I don’t cate if my garage door opener gets hacked.

Wouldn't that be an easy way for burglars et al to gain entry to your house?

Correction: 100%.

Reply on news.ycombinator.com