Reply
trj
Follower
Follower

Security issues with "smart devices" like outlets, toasters, and so forth

Hello,

 

I understand that a common hack attack is to remotely gain access to a simple "smart device" in the home like a smart outlet, then use a standard brute force guessing attack to become the admin on the router.

 

I'd like to add smart outlets to my home. Is there a product or a procedure to safely use them?

 

Thanks in advance.

 

Best,

 -Terry Jones

Model: R8500|Nighthawk X8 Tri-Band AC5300 WiFi Router
Message 1 of 7
StephenB
Guru

Re: Security issues with "smart devices" like outlets, toasters, and so forth

One simple tip is to set up the guest network in your router (making sure network isolation is set).  Connecting devices to the guest network allows them to connect to the cloud services they use, but they can't access other devices on your network.

 

That's not enough though - it limits the data leakage from your home, but devices can still be hacked to launch denial-of-service attacks on others, and of course there's a risk that any sensor data they might have can be read by a bad guy.

 

The usual rules about promply applying security updates, and immediately changing default credentials on the devices certainly apply.

 

There are some other tips here: http://www.networkworld.com/article/3085607/internet-of-things/8-tips-to-secure-those-iot-devices.ht...

Message 2 of 7

Re: Security issues with "smart devices" like outlets, toasters, and so forth


@StephenB wrote:

The usual rules about promply applying security updates, and immediately changing default credentials on the devices certainly apply.

 

 

That is sound advice.A bit of further explanation may show why.

 

The fuss that might have led to your concern came about because one hardware maker shipped devices that had simple usernames and passwords "hard wired" into them, leaving the user no chance of making this simple precautionary move. (Netgear has similarly trivial security on shipped devices, but you can change the password if not the username.)

 

The maker had to recall everything and change its security strategy.

 

 

 

Just another user.

My network DM200 -> R7800 -> GS316 -> PL1000 -> Orbi RBR40 -> Orbi RBS50Y -> RBS40V
Message 3 of 7
StephenB
Guru

Re: Security issues with "smart devices" like outlets, toasters, and so forth

I've heard that some IoT devices have been hacked within 3 minutes of installation (in an IoT security presentation).  So the "immediately" phrase above was very intentional.

 

If you want to be very cautious you could block internet services in the router before you connect them to the WiFi network with all internet services blocked. Then change the credentials, and re-enable services. 

 

Also, if they don't use cloud services you could block their internet access in the router.

 

Message 4 of 7

Re: Security issues with "smart devices" like outlets, toasters, and so forth


@StephenB wrote:

I've heard that some IoT devices have been hacked within 3 minutes of installation (in an IoT security presentation).  So the "immediately" phrase above was very intentional.

 

 


 

Indeed, do it before you put the device on line.

 

Just another user.

My network DM200 -> R7800 -> GS316 -> PL1000 -> Orbi RBR40 -> Orbi RBS50Y -> RBS40V
Message 5 of 7

Re: Security issues with "smart devices" like outlets, toasters, and so forth

An industry wide problem:

 

US Federal Trade Commission sues D-Link for having terrible security

 

Is it good or bad news that the US government is getting involved?

 

 

Just another user.

My network DM200 -> R7800 -> GS316 -> PL1000 -> Orbi RBR40 -> Orbi RBS50Y -> RBS40V
Message 6 of 7
StephenB
Guru

Re: Security issues with "smart devices" like outlets, toasters, and so forth


@michaelkenward wrote:

Is it good or bad news that the US government is getting involved?

  


That might depend on what you expect the technology policies of the new administration to be  Smiley Wink  

 

Personally I think regulation on IoT security is inevitable.  I'm not keen on lawsuits - given the lifetime of the devices in many cases there won't be anyone to sue.  And lawsuits are after the fact - proactive security measures are what is really needed.

Message 7 of 7
Top Contributors
Discussion stats
  • 6 replies
  • 3313 views
  • 0 kudos
  • 3 in conversation
Announcements