Platform Security

0-day exploits come and they get patched. It’s just a matter of time and not trusting systems like this if you’re a super spy or somebody who would have nefarious hackers targeting you to get your precious datas.

I’m sure SmartThings is already working on it, right @Ben?!

Article said Smartthings already handled their patch, which is far less significant than the others mentioned.

2 Likes

Thanks, TLDR honestly.

SmartThings patched it last February.

2 Likes

I am a security professional working for one of the largest Security vendors in the world so this is a topic near and dear to my heart. Unfortunately, it’s a lot more complex that “0 day exploits come and they get patched.”

Some guidelines

  1. I would recommend that most people stay away from smart locks, garage openers, etc anything that can compromise the physical security of their dwelling unless the upsides far outweigh the downside, such as the case with people with disabilities. Stick to monitoring and lights. Maybe smart thermostats. Anything more too risky until this market is more mature.

  2. Run local when possible (currently not with smartthings) and be careful what third parties you open your system up to. You can see the vocal discussion on one third-party offering and the security risks associated on this board. Unfortunately the current Smartthings system does not provide a very robust security model for 3rd party developers to leverage.

  3. As consumers, hold vendors accountable for the security of their products. Despite what you said Keith, security DEFECTS, and that is what they are, are not inevitable and they can be tested for and they can be mitigated. Even 0 days! If you look at the behavior of your application, you can lock it down to future threats, even those that are currently unknown. We need to hold IoT vendors accountable. The other alternative is the government can step in, which has already caused a number of vendors to pay fines. (e.g. webcam vendors with serious security compromises that went unfixed for a long time)

I can go on and on about this topic, but Security is paramount as IoT matures. If the security issues are not addressed, nobody is going to adopt this technology. Security needs to be designed in from the very beginning because we have to remember that the vast majority of users are not going to be technical in nature.

4 Likes

Hopefully not one of those same large security vendors that get hacked themselves. :wink:

3 Likes

that is pretty much all of us, no? :smile:

Yea that was my only point, everything gets hacked eventually. It’s just a matter of evaluating what you have to lose and making the personal decision if the reward is worth the risk.

Other than doing your own due diligence to keep an ear out to the news, and complete the other laundry list of security DO’s.

One thing I find helpful when thinking about security and systems like SmartThings is to ask yourself “what could someone do if they got into my system?”… that is, what have you installed/enabled. The functionality you choose to enjoy with your system.

Then think about what you can do to either mitigate that. If you choose to have your front door locks or garage door on the system, set up your system… or a different system… to notify you every single time those doors open. Yes, we all get blind to overly-frequent notifications, but it’s better to have the option to check.

Also, having a backup system like a Dropcam that’s possibly not even connected to SmartThings… it adds some level of accountability. “Someone broke into my house and I got them on video that’s backed up to the cloud”.

It’s not perfect, but if you create a potential opening for hackers, treat it kind of like a tower defense game… have a backup defense, at least as a notification or logging system, that can provide information that might help catch the people. I mean, you can get broken into just by someone kicking open your door… it’s not like a smart home system necessarily makes it easier… so accountability and notification should be part of your thinking anyway. Just don’t tie it all into the same system hackers could get access to and disable before they break into your house.

Cause doors can’t be kicked in and windows can’t be broken.

Smart locks just keep honest people out. Just like dumb locks.

Security is an illusion and a matter of equilibrium. If my neighbor has no locks, I have one. If my neighbor has a security system but no sign in the yard, but I just have sign. Who gets broken into?

End of the day, security is an illusion. Make the audience believe it is secure. The prestige is in the reveal. Never learn the magician’s secrets.

3 Likes

That’s correct. This is not a new issue and anyone with an online SmartThings Hub has already been patched.

Every online platform has a known vulnerability. The User.

The more control you give a user, the more risk there is.

The biggest weakness in any User, is there password. Weak passwords are a huge problem.

However, ST could do a better job at security.

-2 stage authentication
-Required password changes
-Guest access read only modes
-IDE accounts separate from user accounts
-OAUTH Credentials separate from user accounts
-Account lock out measures, stop logins after x bad attempts
-Last logins list
-Notify me if a new login occurs
-Send me a text to authenticate new users

These would make ST more secure, but nothing will be completely secure.

Behind the scenes, I would love to see ST tell us how they keep our data secure, but of course, without revealing exactly how.

What keeps a rogue ST employee or contractor from accessing my data? What audits are in place to make sure that access is logged? Are they pursuing anything like SAS70 certification? Does anything like SAS70 exist in this space?

I am in a trust but verify mode. Security isn’t absolutes, its about if it is getting better or worse.

Having Samsung behind ST, I am sure Samsung has done massive reviews of the security models in place and any known vulnerabilities are patched or in the works.

However, I would like to see the above features added to create better security from an end user perspective.

But all things in time…

3 Likes

While I agree that dumb locks and windows can be broken, by their nature connected devices are even more vulnerable. Most of the “smart” locks have all the vulnerabilities that dumb locks do based on physical exploits, plus all of the software based vulnerabilities as well. Plus, the scale at which devices could be defeated is a few orders of magnitude larger.

Old fashioned bad guy decides to break into old fashion lock. He breaks into one house.

Evil genius hacker bad guy disables ALL ABC Corp. smart locks across the tri-state area. Organized criminal gang hits 1000s of houses.

Of course in either case, if you live in the house being robbed, your stuff is just as gone.

And that is why we all carry insurance.

Seriously…

You can’t stop the bad guys. Only make you less of a target.

Buy a barking dog, or a sonos with a motion sensor that sounds like a barking dog.

Get a sign that says protected by remotely monitored alarm and surveillance. (doesn’t matter if its real, until the neighbor gets broken into and wants to see your footage)

The sky is falling, my door locks are hackable… Yeah, so is the computer you are on. Your identity is 100x times more likely to be stolen then the stuff behind a smart lock in your house.

Oh, and thankfully we still have law enforcement that will catch organized crime syndicates breaking into 1000s of houses. But then again, they have moved on to stealing identities and internet currencies anyway. They don’t want to have to carry my stuff out of my house when they can steal something that is weightless.

It’s a simple paradigm, why steal what you have to carry, when you can steal from 1000s without leaving your home?

No one is going to hack your home and unlock your doors and steal all your stuff. Yeah, some guy, somewhere claimed it happened. I read it on the internet.

Anyway. Security is an illusion. Don’t believe me, have you flown recently? Most important TSA number, how many people through the screening per hour. Not how many terrorists they have stopped.

But then again, if you see a black van parked down the street with the windows blacked out, you might want to block the door with something and bar the windows… Just saying…

1 Like

[quote=“ADamL, post:6, topic:19766”]
I would recommend that most people stay away from smart locks, garage openers, etc anything that can compromise the physical security of their dwelling unless the upsides far outweigh the downside, such as the case with people with disabilities. Stick to monitoring and lights. Maybe smart thermostats. Anything more too risky until this market is more mature.
[/quote]My house has a multitude of large windows and sliders at grade, so they are the weak link (openable via any large heavy object.) Not ever having to have a key, being able to give one use codes out to guests or workers, being able to remote unlock/lock the doors is priceless.

For me, the simple rule of automated doors is never automatically unlock them. As you said, persons with disabilities would probably be willing to exchange the additional risk of incorrect unlocking as well.

1 Like

Why is there any more risk in automatically unlocking based on presence sensors? As long as you’re intelligent about it and have the doors re-lock, you’re not really putting your home at more risk than with manual ‘connected’ locks.

1 Like

Simply due to false positives unlocking your door. Assuming it’s got a keypad anyway, you’re saving yourself the hassle of either punching in the code, pressing a button on a keyfob, or at worse using the app to unlock the door, for the risk of having smarthings unlock your door because it decided you were “home”.

I wouldn’t do it, but that’s just me.

Plus, why would you want your doors to be unlocked when you are home? I just use the auto lock feature and code entry parts of door locks. That way my doors are always locked and I can get in.

Tying a presence sensor to a door unlocking is a perfect example of I can do it, but should I do it?

Why would your mobile phone presence sensor show you as home when you’re no where near it? That’s really the only additional risk compared to limiting access to a PIN. If it’s tied to your ST hub, it’s at the same risk level, aside from a mobile presence error.

I’ve not ONCE seen ST mistakenly show a device ‘home’ when it was not. I have seen it the other way around, which is fine with me. I can see your fear of having the lock ‘connected’ at all, and it’s valid, but tying it to presence doesn’t change it much, and sure makes it handy when you’re walking up with arms full of groceries.

So, you arrive home, your doors unlock. Sure that’s convenient.

You are about to go to bed, you lock the doors.

The presence device hiccups and marks you away (default state) comes back online and now your code unlocks the door.

For the rest of the night, you are sleeping in a house with unlocked doors.

Sure, you could restrict the time, but seriously, same scenario exists during the day. You thought you locked the door, presence hiccups, it unlocks.

You take a shower or are in the basement and a “door to door” salesman comes to the door, looks in the window, sees no one is home, see’s that expensive gadget on the counter, tries the door, its unlocked… Easy pickings.

Again, not ST’s fault per sea, its really a user usage. Sure I’d like presence sensors and devices to be 100% accurate but that isn’t going to happen.