SmartThings Platform Security - Response from Alex

[JDRoberts]

@tgauchat

Is there some reason that select Community members and prominent Developers were not informed of this research sooner? (i.e., besides the obvious risks of disclosure, but … ?).

Actually, why did Community and all Customers, actually, have to wait to find this out in the media instead of being notified through SmartThings’s own channels ahead of the press-release?

You ask the same question in another thread, so I’ll just point to my answer there, but this is standard industry practice.

Researchers say there are serious security problems in Samsung’s SmartThings

That’s the usual method for handling security flaws discovered by third parties. The researcher contacts the company to inform them of the flaw and of their publication date. The company agrees to wait to announce until that date, but will work with the researcher on fixing as much as possible and the researcher will normally note that cooperation and any flaws that have been fixed as an addendum to the original work. Publication date comes, researcher releases their paper, company puts out their reply press release on the same day or the day after. That way researchers have a motivation to work with the companies but still preserve the freshness of their own research. That appears to have been what was done here. On May 2, there was an official post to the smartthings blog about th…