It's not just home broadband routers that have hopeless security: according to security outfit Veracode, cloudy home automation outfits also need to hang their collective heads in shame.

With nothing but standard by-the-manual configurations and network traffic capture but with no attacks against the devices or the cloud services the testers reckon they turned up a variety of vulnerabilities in kit from Chamberlain Group, SmartThings, Ubi and Wink.

It seems that if you're the kind of uber-lazy gadget-fan who can't imagine pressing a button to do something voice control is possible, you're matched by uber-lazy device developers. Versacode found that all but one of the devices it tested failed even its non-hostile vulnerability tests.

The products tested were Wink's WinkHub and Wink Relay home automation controllers; Unified Computer Intelligence's Ubi always-on voice activation system; SmartThings' home automation and home access control hub; and Chamberlain Groups' MyQ Garage (an Internet interface to garage door systems) and MyQ Internet Gateway (which extends control to switches and electrical outlets).

The tests covered:

The Veracode white paper is available with registration here.

Sponsored: Network DDoS protection

View post:
Your home automation things are a security nightmare

In the latest blow to Internet of Things (IoT) security, an analysis of smart home devices has found flaws that could give attackers access to sensitive data or allow them to control door locks and sensors.

The research was performed by a team from application security firm Veracode for six up-to-date devices acquired in December and found serious issues in five of them. The tested devices were the Chamberlain MyQ Garage, the Chamberlain MyQ Internet Gateway, the SmartThings Hub, the Ubi from Unified Computer Intelligence Corporation, the Wink Hub and the Wink Relay.

All of these devices enable remote control and monitoring over the Internet of various home automation devices and sensors, including door locks, interior switches and power outlets. Most of them connect to cloud-based services and users can interact with them through Web portals or smartphone applications.

The Veracode team didnt look for vulnerabilities in the firmware of the tested devices, but instead analyzed the implementation and security of the communication protocols they use.

The researchers looked at the front-end connections, those between users and the cloud services, as well the back-end onesthose between the devices themselves and the cloud services.

For front-end connections, they found that with the exception of SmartThings Hub, none of the devices enforced strong passwords. In addition, the Ubi did not enforce encryption for user connections, exposing them to possible man-in-the-middle (MitM) attacks.

For back-end connections the situation was even worse. The Ubi and MyQ Garage did not employ encryption, did not offer adequate protection against man-in-the-middle attacks and did not protect against replay attacks, which enable man-in-the-middle (MitM) attackers to capture traffic and then play it back, potentially triggering unauthorized actions. In addition, the Ubi did not properly secure sensitive data.

MitM protection was lacking across all devices with the exception of the SmartThings Hub, either because TLS (Transport Layer Security) encryption was not used at all or because it was implemented without proper certificate validation.

This suggests that those who designed these IoT devices assumed that the local area networks theyll be installed on were secure. Thats an error, because research over the past several years have showed that if theres anything worse than the security of IoT devices, its the security of consumer routers. Security researchers find serious vulnerabilities in routers on a routine basis, most of which enable hackers to perform man-in-the-middle attacks, and those flaws have resulted in millions of routers being compromised in large-scale attacks over the past few years.

The misguided trust of IoT manufacturers in the security of home networks is also reflected by the debugging interfaces and other services their devices expose to such networks.

See the rest here:
Researchers show that IoT devices are not designed with security in mind

Some day, we will all live in smart homes. Automated gadgets running on the Internet of Things will manage our lighting and heat, keep our appliances humming, and free us up to do more important things, like play Candy Crush Saga 24/7.

Before they do all that, though, the Internet of Things, or IoT, has a lot of growing up to do.

So far, tech startups have done a great job of churning out inexpensive gizmos that turn on the lights when you enter the room or start the coffee when you wake up, but theyve done a mostly terrible job of making sure random strangers cant also flip on your Philips Hue or control your Keurig.

Last July, Hewlett-Packard released a scathing report on the poor security of IoT devices, noting that more than seven out of 10 have some kind of vulnerability.

Over the past three years, devices like Nests smart thermostat, Kwiksets SmartKey lock, Foscams baby monitors, and thousands of home security cameras have been compromised in the lab or in the wild.

A report scheduled to be released on Wednesday by enterprise security firm Veracode details some of the ways IoT devices can be hacked, controlled remotely, and even used to spy on you.

Given the right circumstances, an external attacker could know when youre not home, open and close your garage door, turn your lights on or off, and even eavesdrop on your conversations.

Safe...for now

Thats the theory. In practice, at least for now, smart-home hacking isnt that big a concern.

IoT devices arent widespread enough yet to be tempting targets for hackers. Not when theyve got all these juicy insecure corporate databases to pilfer from.

Read more:
Your smart home will be hacked. Heres how to stop it

Beware of Those Tiny Batteries
http://homesafety.tk You could be chosen to receive a Home Security System at no cost to you. Your security system is ready to once we receive your details, please go here: http://a2trk.com/?a=...

By: Best Items

Original post:
Beware of Those Tiny Batteries - Video

4. Safe Public Spaces - Child Poverty Solutions NZ
http://homesafety.tk You could be chosen to receive a Home Security System at no cost to you. Your security system is ready to once we receive your details, please go here: http://a2trk.com/?a=...

By: Best Items

See the original post:
4. Safe Public Spaces - Child Poverty Solutions NZ - Video

DIY - How to make a power bank by yourself
http://homesafety.tk You could be chosen to receive a Home Security System at no cost to you. Your security system is ready to once we receive your details, please go here: http://a2trk.com/?a=...

By: Best Items

Read the rest here:
DIY - How to make a power bank by yourself - Video

Achilles Tendonitis - exercises to do at home
http://homesafety.tk You could be chosen to receive a Home Security System at no cost to you. Your security system is ready to once we receive your details, please go here: http://a2trk.com/?a=...

By: Best Items

Continue reading here:
Achilles Tendonitis - exercises to do at home - Video

4. Safe Public Spaces - Child Poverty Solutions NZ--8oDIX8ViCs
http://homesafety.tk You could be chosen to receive a Home Security System at no cost to you. Your security system is ready to once we receive your details, please go here: http://a2trk.com/?a=...

By: Best Items

Read the original:
4. Safe Public Spaces - Child Poverty Solutions NZ--8oDIX8ViCs - Video

Cooking to Live Longer
http://homesafety.tk You could be chosen to receive a Home Security System at no cost to you. Your security system is ready to once we receive your details, please go here: http://a2trk.com/?a=...

By: Best Items

Continue reading here:
Cooking to Live Longer - Video

ADT Danville CA | Call or Click Order ADT Home Security Services Danville CA Deals
Call 1-877-310-5363 or Click: http://getalarm.net | For a Free ADT Home Security System When You Sign Up For Alarm Monitoring From ADT in Danville, CA: the #1 Home Security Provider in North...

By: GetADTDeals15

Read the original:
ADT Danville CA | Call or Click Order ADT Home Security Services Danville CA Deals - Video