Author Topic: Smart Home Hacking  (Read 1156 times)

TheDrake

  • All Members
    • View Profile
Smart Home Hacking
« on: July 09, 2018, 01:02:36 PM »
I'm starting to look around at smart home stuff. Among the items I'm looking at are a smart camera (doorbell), and a smart lock (deadbolt).

I've read a fair amount about hacking these devices, and I wind up asking myself two questions. Do I care, and does it happen?

In the case of the camera, it's going to face the exterior. If someone hacked this camera, do I care? It can see pictures of me (and anyone else) arriving and leaving the home. But who cares? I don't expect to be actively stalked or hunted. I don't expect to be ripe for blackmail. From the wifi end I somewhat care, because it could mean entry into more interesting parts of my network, but not for its own sake. Any attack requiring physical access seems silly to worry about.

As for the lock, similar cases exist. Are criminals going to run around actually doing this, or is it just a puzzle that security nerds like to solve? I tend to think forced entry would be the burglary to worry about, and it wouldn't be that hard to bust out my window. Meanwhile, my garage door is far easier to hack with its simple security. And yet I have never read an actual news report about people doing this in significant numbers, although I have heard nerds talk about how they did it to prove they could.

How worried should people be about such things?

Seriati

  • Member
  • All Members
    • View Profile
Re: Smart Home Hacking
« Reply #1 on: July 09, 2018, 01:17:50 PM »
Not to be coy, but why would you want a smart deadbolt?  If you feel like you need to lock your doors there's a lot to be said for not undermining the security of a physical system.

As far as cameras, they will be hacked.  Weird people hack them all the time, was reading of a women's whose baby monitored was hacked so someone could watch her breastfeed.  If you have any women in your life, someone has an incentive to see them.  Seems to me that using it to case your house (to know the comings and goings of everyone) is far too labor intensive to be a real concern, unless you have something really valuable or a stalker.

TheDrake

  • All Members
    • View Profile
Re: Smart Home Hacking
« Reply #2 on: July 09, 2018, 03:07:26 PM »
Quote
why would you want a smart deadbolt?

Reasonable question. Giving a friend a code instead of a spare key when I'm out of town. Not fumbling for my key. Not needing a key if I accidentally lock myself out (no more key under a fake rock). Not having to take a key with me if I'm going to the neighborhood pool. Being able to check to make sure I locked the doors when I left, or to never have to worry about it because they always lock behind me.

And yes, cameras can get hacked with a varying degree of difficulty, not to mention footage getting hacked or other compromises. I'd be a lot more hesitant with an interior camera for privacy concerns, and I don't really see any value to it other than spying on the cat when I'm away. Which is to say, no value. The major motivation with the camera in this case is to discourage package theft from my front door or at least record that it happened. I don't anticipate anyone getting naked or breastfeeding on my front lawn, although in theory it could be used to spy on my neighbors across the street if they leave the drapes open...

D.W.

  • Member
  • All Members
    • View Profile
Re: Smart Home Hacking
« Reply #3 on: July 09, 2018, 05:15:16 PM »
For the labor intensity of the camera monitoring to determine windows for a break-in, I guess it would depend on if they have built in motion sensors on when they activate or not.  It SEEMS like that would be a good pairing of technology... 

If there was, then having something monitor when it activates, as opposed to actually "watching" could generate a report after X amount of time.  Assuming you hacked into a type of product, and could get many of them reporting, then cherry pick as need be, it wouldn't be all that labor intensive.  Still, a tech savvy B&E targeting homes?  That seems more like a waste of talent than a waste of labor.  ;)

I kinda get the desire for the smart lock though.  I was discounting it as a silly idea, until I realized I use my garage door opener (and keypad) the exact same way... 

As a rule, I keep my home low tech.  The only compulsion to get a security camera on the front porch would be to check to see if the doorbell is potentially someone I want to talk to or someone soliciting for donations / sales or something else who I'd prefer to chicken*censored* my way out of by pretending not to be home.  :P

Seriati

  • Member
  • All Members
    • View Profile
Re: Smart Home Hacking
« Reply #4 on: July 09, 2018, 05:24:08 PM »
On the labor side, I was thinking that to make it work, you'd have to build a profile and monitor the situation for weeks (not that you'd have to watch the entire tape).  Would such a system cover other doors and the garage as well?

I also think there's a lot of work involved (but I could be wrong) in making sure that your hacking and monitoring can't be tracked by to you.  Otherwise the clever stake out plan really becomes not so clever.

TheDeamon

  • All Members
    • View Profile
Re: Smart Home Hacking
« Reply #5 on: July 09, 2018, 05:30:22 PM »
Not that much work involved when you're talking digital and have the right tools.

It is called Facial Recognition Software.

So if for example your electronic doorbell uploads its video feed to Google for example, they can then potentially ToS their way into doing facial Recognition on any video uploaded to them. And run it against Google+ and YouTube among other social media sites they have fingers in, and use it to better target both you(based on seems to visit often and their known preferences), and your visitors based on your known preferences.

After all, the video is already digitized, so they just need to be given access.

TheDrake

  • All Members
    • View Profile
Re: Smart Home Hacking
« Reply #6 on: July 10, 2018, 08:43:32 AM »
I've hunted extensively, and I can't find a single instance of a smart lock actually being hacked in the wild. It's all security conferences and people who work in security fields, however:

Quote
Googling a very simple phrase led me to a list of “smart homes” that had done something rather stupid. The homes all have an automation system from Insteon that allows remote control of their lights, hot tubs, fans, televisions, water pumps, garage doors, cameras, and other devices, so that their owners can turn these things on and off with a smartphone app or via the Web. The dumb thing? Their systems had been made crawl-able by search engines – meaning they show up in search results -- and due to Insteon not requiring user names and passwords by default in a now-discontinued product, I was able to click on the links, giving me the ability to turn these people's homes into haunted houses, energy-consumption nightmares, or even robbery targets. Opening a garage door could make a house ripe for actual physical intrusion.

So I think I'll be careful about how I make anything available outside my firewall. If my phone bluetooths to my lock, fine and good. Unlock remotely via wifi over http? Maybe not.

I'm considering using Nest as my full ecosystem, which has solutions for lock, doorbell, thermostat, garage, etc. A larger company is more likely to patch and update promptly, and it gives me a single point of failure as opposed to several different companies each having unique exploits.

But as in the above case, a lot of these exploits are only happening for typical users (like default passwords on cameras and routers, the chronic "admin admin" problem). First thing I'm going to do with any device is ensure that the password is changed and unique from my other passwords.


TheDrake

  • All Members
    • View Profile
Re: Smart Home Hacking
« Reply #7 on: July 16, 2018, 09:37:42 AM »
So I've mucked about with some smart lights, and I can now voice control my kitchen lights. This is coming in more useful than I thought. Not having to cross the room isn't a big convenience, but it feels nice. This switch also operates manually, which is nice if I have guests.

My stairway is a smart bulb. That basically means that I still have switches that should never be used. Here, any untrained guest is just going to toggle the switch back and forth - leaving it in the off position 50% of the time. I would be tempted to just cap the switches - but I need to turn it off to replace the bulb at minimum.

Meanwhile, now Amazon has information on when my lights go on and off. This isn't a huge deal, but I wonder what they might be able to infer. Because I've given meaningful names to my lights (stairway, nightstand, kitchen), this could potentially be useful for marketing. Coupled with my use of FireTV, Music, ordering....

They really start to have a pretty complete outline of my daily routine. They know how much time I spend doing which activities, and where. Compared to web ads and other apps that just hammer me with my last search term. Wayfair is stalking me now because I browsed ceiling fans once...

How about a ceiling fan? What you need is a ceiling fan. Notification - don't miss these new ceiling fans.

AAUGH! I don't mind smart ads, but please, no dumb smart ads.

NobleHunter

  • Member
  • All Members
    • View Profile
Re: Smart Home Hacking
« Reply #8 on: July 16, 2018, 09:58:13 AM »
Smart ads! The best way to reach a customer after they've already bought what they were looking for!

yossarian22c

  • Member
  • All Members
    • View Profile
Re: Smart Home Hacking
« Reply #9 on: July 16, 2018, 10:09:43 AM »
Smart ads! The best way to reach a customer after they've already bought what they were looking for!

Gen 2 of smart ads. You just bought a ceiling fan now you get lots of adds for ladders, medical supplies for treating electrical burns, and contractors that fix ceiling damage.

TheDrake

  • All Members
    • View Profile
Re: Smart Home Hacking
« Reply #10 on: July 18, 2018, 11:30:19 AM »
Was just listening to IoT Podcast

They touched on a Times article (paywall) that discusses smart home devices as tools of domestic abuse!

Quote
One woman had turned on her air-conditioner, but said it then switched off without her touching it. Another said the code numbers of the digital lock at her front door changed every day and she could not figure out why. Still another told an abuse help line that she kept hearing the doorbell ring, but no one was there.

Their stories are part of a new pattern of behavior in domestic abuse cases tied to the rise of smart home technology. Internet-connected locks, speakers, thermostats, lights and cameras that have been marketed as the newest conveniences are now also being used as a means for harassment, monitoring, revenge and control.

In more than 30 interviews with The New York Times, domestic abuse victims, their lawyers, shelter workers and emergency responders described how the technology was becoming an alarming new tool. Abusers — using apps on their smartphones, which are connected to the internet-enabled devices — would remotely control everyday objects in the home, sometimes to watch and listen, other times to scare or show power. Even after a partner had left the home, the devices often stayed and continued to be used to intimidate and confuse.

I feel ill.

I also didn't really comprehend how deeply this technology has penetrated.

Quote
In 2017, 29 million homes in the United States had some smart technology, according to a report by McKinsey, which estimated that the number was growing by 31 percent a year.

Quote
(One in three women and one in four men have been victims of physical violence or stalking by an intimate partner, according to a 2010 Centers for Disease Control report.)

Quote
One of the women, a doctor in Silicon Valley, said her husband, an engineer, “controls the thermostat. He controls the lights. He controls the music.” She said, “Abusive relationships are about power and control, and he uses technology.”

Quote
“If you tell the wrong person your husband knows your every move, and he knows what you’ve said in your bedroom, you can start to look crazy,” she said. “It’s so much easier to believe someone’s crazy than to believe all these things are happening.”

TheDrake

  • All Members
    • View Profile
Re: Smart Home Hacking
« Reply #11 on: October 15, 2018, 02:47:24 PM »
Is a smarthome hazardous? Just connected up my hashtag#nest thermostat, really excited! This morning my internet was down. alexa was incapable of turning off my alarm, and my nightstand smartbulb also ignored my pleas for it to turn on. I groped around, pulled the plug on alexa and hunted for the remote for my overhead light. Is my home getting too smart for its own good?

I feel like I need some lights connected to the internet that come on automatically, because it is starting to feel like I'm having a state of emergency when the internet is down.