Researchers demonstrate new ways to hack your stupidly complex smart home

It seems that some homes may be too smart for their own good. 

On Monday, March 5, researchers at the San Francisco RSA conference presented to an assembled crowd of journalists and cybersecurity experts an unexpected approach for hacking into the device-enabled homes of the modern day George and Lydia Hadley. 

Notably, they explained, it’s not solely our internet of things that includes cameras and refrigerators we need to worry about. Instead, as people add more and more smart devices to their lives we also need to pay attention to the systems managing the interactions between those tools. 

Sounds fun, right?

At the core of this vulnerability is what the two Trend Micro senior threat researchers, Stephen Hilt and Numaan Huq, call “complex IoT environments” (CIE). In a corresponding paper detailing the threat, they define such an environment as typically (but not exclusively) a smart home with ten or more IoT devices linked up to one another. It’s how these smart gadgets interact, via a so-called IoT automation platform, that’s the problem. 

Imagine setting up your smart doorbell to tell your smart lights to turn on when it detects a predetermined amount of outside light. Your automation platform would be the connective tissue wrapping those two services together. 

“An IoT automation platform serves as a brain of sorts for the CIE and allows the creation of smart applications by functionally chaining the devices through custom rules, thus allowing devices to interact and affect each other’s actions,” reads an accompanying Trend Micro blog post. 

If these brains can be accessed — and it turns out that many of them can be — then the entire system can be exploited. Examples provided by the researchers were chilling. 

Say you set up your smart home to send you a photo, via Slack, every time your outside camera detected movement. Great, right? Well, maybe. Because, if attackers can gain access to the platform facilitating this communication between the camera and Slack, then they can intercept that image and functionally get push notification photos for your house. 

“As you’re adding more and more stuff, the attack vector […] is steadily increasing,” Hilt told the crowd. 

Or how about a program that, upon detecting your smartphone has joined the home Wi-Fi network, unlocks the front door smart lock. This is super futuristic and fun, until a hacker tricks the program into recognizing her phone as well and then walks into your house while you’re at the beach contemplating how much easier life has been made by your networked smart home. 

Frustratingly, according to Hilt and Huq, there are plenty of exposed IoT automation servers that can be quickly and easily found via the IoT search engine Shodan. A slide shared during the presentation noted that the researchers had discovered thousands. 

What’s more, these servers sometimes give specific latitude and longitude data for the house in question. This means that not only could a bad actor control a smart home online, but they could find it in real life. In one troubling example, the researchers noted that they located an exposed smart home system belonging to a house that just so happened to be quite close to their physical location. 

So what does this mean for you? It means you need to pay attention to not only the security of your smart bulbs, but to the security of the system that ties them to your IoT-connected washing machine as well. 

Because as we continue to add more networked devices to our homes, the under-explored problems that come with the resulting complexity are increasingly likely to rear their ugly heads.