The smart home makes many things more convenient within your own four walls, but also creates a number of additional technical problems — not least with regard to the security of your own data.
The market for smart home solutions is divided into two large groups:
- One includes control systems that are permanently installed by certified tradespeople.
- The other group includes components from various manufacturers that can be easily retrofitted by non-professionals and transform simple lights or thermostats into smart devices.
With the latter devices, there are a whole range of annoyances that most users don’t think about when buying. This short guide shows firstly how you can minimize the risks before you buy, and secondly how you can find and close weak points in existing devices.
Further reading: How to keep your home network secure: Smart tricks and settings
Forced to use the cloud? Best to switch off
Many manufacturers force customers to allow their devices to connect to the internet because this is the only way to control them from any location. For example, the devices from Chinese manufacturer Xiaomi (Mi Lamp and fans) can only be controlled via a smartphone app (unless you use the switches on the devices, but you don’t need a smart home for that).
Unfortunately, setting up the app and therefore using voice assistants such as Alex or Google Home is mandatory.
Open VAS (also included with Kali Linux) analyzes the local network and all devices for vulnerabilities and configuration errors.
Open VAS (also included with Kali Linux) analyzes the local network and all devices for vulnerabilities and configuration errors.
IDG
Open VAS (also included with Kali Linux) analyzes the local network and all devices for vulnerabilities and configuration errors.
IDG
<div class="scrim" style="background-color: #fff" aria-hidden="true"></div>
</div></figure><p class="imageCredit">IDG</p></div>It is therefore hardly surprising that the Shodan search engine can also be used to easily gain insights into other people’s rooms — thanks to unsecured and rarely updated webcams.
It is advisable to read the reviews before making a purchase and to pay attention to such a compulsion to use the cloud. There should be no need for this within your own four walls.
With alternative bridges such as the Raspbee or Conbee, control is also possible without the cloud (provided the device is compatible).
And you should always ask yourself whether a function is actually needed: If you’re looking for convenient temperature control for heating or ventilation, you don’t necessarily need a function that recognizes via smartphone that you are approaching the building (which can only be achieved by connecting via the internet).
When we talk about security risks here, we are not just talking about the security of the data within your own network. If hijacked devices in the network belong to a botnet, they can no longer be used, not to mention all the legal complications.
The Shodan search engine produces astonishing results. Inadequately secured webcams often allow people to look into other people’s homes.
The Shodan search engine produces astonishing results. Inadequately secured webcams often allow people to look into other people’s homes.
IDG
<div class="lightbox-image-container foundry-lightbox"><div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large enlarged-image"><img decoding="async" data-wp-bind--src="selectors.core.image.enlargedImgSrc" data-wp-style--object-fit="selectors.core.image.lightboxObjectFit" src="" alt="Die Suchmaschine Shodan fördert erstaunliche Ergebnisse zutage. Zu wenig abgesicherte Webcams erlauben oft den Blick in fremde Wohnungen." class="wp-image-2434897" width="1200" height="637" loading="lazy" /><figcaption class="wp-element-caption"><p>The Shodan search engine produces astonishing results. Inadequately secured webcams often allow people to look into other people’s homes.</p>IDG
</div></figure><p class="imageCredit">IDG</p></div>Wi-Fi? A question of connection
Security risks can be minimized by choosing the right hardware and its connectivity. At first glance, devices that connect to Wi-Fi seem convenient. Although an app is usually required to set this up, it is only used to store the network key in the device.
However, using Wi-Fi also exposes the devices to all the attacks that attackers use against a wireless network.
In the descriptions of their devices, manufacturers only emphasize the convenience and ease of setup. References to the standard used tend to remain hidden. Devices that follow a different standard, such as Zigbee, are better than having countless devices in the house that connect to the home’s own Wi-Fi.
Tip: If it absolutely has to be Wi-Fi (because you have already purchased the lamps or radiator controls), you can isolate the components in a separate network. The Fritzbox, for example, has an additional “guest network” that can be used for these devices.
The router as a weak point
In all efforts to achieve greater security for IoT devices within your own four walls, you should always prioritize the router. This is where the biggest vulnerabilities are usually hidden.
These include forgotten port authorizations that you created once to try something out. In addition to the port shares, also pay attention to protocols that are particularly frequently exploited by attackers. These include UPnP (Universal Plug and Play), for example.
UPnP makes it easier for devices within a network to find each other and establish connections. However, if a device (and its firmware) is allowed to set up port sharing independently, it is conceivable that this simple protocol can also be accessed externally. This is then easy prey for any bot.
The best strategy for hardening the network is to consistently start from a blacklist. Switch off all external connections to devices that are not absolutely necessary for functionality. In short: Everything that is not needed should also be switched off.
Transparency through your own platforms
Every manufacturer recommends a separate app for controlling the devices. With a large number of devices, this is anything but smart and convenient in the long run. Apple’s Homekit or Google Home and Alexa aim to rectify this, at the cost of no longer being able to take care of potential vulnerabilities.
Security-conscious users with expertise can use applications such as Open HAB, Domoticz, or iobroker to put together a customized environment that is easier to maintain, offers more transparency, and also enables cross-device processes.
Detect and close vulnerabilities
Login to add comment
Other posts in this group
There’s a common misconception about PCIe 5.0 SSDs that since they’re
Microsoft’s controversial Windows Recall has now been generally relea
Microsoft is sending the next annual feature update for Windows 11, v
Smart appliances are great since you can control them from your phone
Does your CPU come with a cooler in the box? Do you need to buy a sep
