Start researching smart home security topics on the web, and you quickly run into cover stories and reddit threads on smart home hacking. It's an unpleasant consideration: What if your new (and often expensive) smart home device gets hacked by a stranger? What could they do with it or the information it holds?
Smart home hacking has been a hot-button topic thanks to recent security breaches and general misinformation about this new type of technology many of us are living with.
At CNET, we aim to equip you with accurate, real-world information you can use to pick the best home security devices and keep your home safe. That also means understanding what smart home hacking really is, where it's likely to come from and how you can protect your devices. The good news is that your smart home tech is probably safer than you think, but let's take a deeper look.
Let's cover a few important points: "Hackers" or to be specific, cybercriminals are not likely driving around scanning for vulnerable smart homes using nefarious gadgets. Wi-Fi ranges don't usually reach far enough for this to be effective and it would take a lot of effort for slim and spotty returns. There are some reports of major companies like casinos being hacked via smart devices, but very few of someone trying to Ocean's 11 residential homes.
Likewise, burglars interested in breaking into your house don't appear to be investing in the software or equipment needed to hack a smart lock first. There are very few reported cases of smart home security systems being hacked or electronically disarmed for petty theft. A low-tech approach is easier and more realistic. Most attempt to break unguarded windows or check for unlocked doors. So how do smart homes get hacked? Here are potential avenues of attack and how they work (or don't).
These automatic online attacks from around the world that scan test nearly everything hooked up to the internet to see if accounts can be broken into, usually with brute-force password guesses that bombard devices with billions of various login attempts hoping one makes it through. Then the attack infects the device, adding it to a botnet for future cyberattacks or generalized data theft. A human cybercriminal rarely tries to seize control of your device. These mass online attacks are what created the often-cited Which? study about smart homes facing up to 12,000 hacking attempts per week (one succeeded, for an ieGeek camera).
This is an important reason to protect your account with updated passwords, but it doesn't mean anyone is purposefully targeting your smart home or that device security is weak. Bots are only fishing for whatever basic login vulnerabilities they can find on any available online system or account.
It's not as common as other types of phishing, but some phishing emails or texts may pretend to come from your smart home security company. Giving them personal information like account logins or clicking their fake links (to malware designed to take over) may give cybercriminals access to devices they wouldn't otherwise be able to reach. And even generalized phishing attempts may lead criminals to your Wi-Fi network, through which they may be able to find and control connected home security devices.
In this case, cybercriminals use brute force and similar attacks to target servers and networks where IoT companies keep information about smart home users in databases, including account login details, personal info about location and addresses, and camera footage stored in the cloud. It's a frequent target because data thieves could seize so much data at once, which is why you see headlines about major data breaches on a painfully frequent basis.
It's unlikely that the stolen data will lead to smart home device hacking, but it can put your accounts at risk and some cybercriminals may try to use that data however they can, which we'll get into more below.
As recently as the early 2020s, Internet of Things/smart home devices were found vulnerable to man-in-the-middle type attacks where criminals could spy on the data packets that smart devices were sending back to the internet. Smart devices send all kinds of data about their current settings and receive data back in return. With the right malware, a cybercriminal could potentially monitor this data and try to change or block it.
In practice, this simply doesn't happen. Criminals aren't in a position to do this to a smart home. Even if they were, today's smart home tech uses encryption practices and advanced protocols like Thread that make it useless. It's an example of how scary-sounding vulnerabilities don't actually make it into the real world.
This type of malware, like the BlueBorne attacks, enters through a poorly secured internet connection and use Bluetooth capabilities to hack other devices, including phones and smart speakers. When these vulnerabilities became infamous in the late 2010s, companies quickly updated their security and Bluetooth encryption practices. We don't currently see many Bluetooth-based vulnerabilities (although some briefly crop up), and like man-in-the-middle attacks, they don't lead to smart home problems.
If burglars use the physical kind of brute force and black hat hackers are usually busy elsewhere, who exactly is trying to hack smart homes these days? Let's narrow it down to common culprits.
Originally Posted by CNET.
Written by Tyler Lacoma
Stay up to date on the latest real estate trends.
You’ve got questions and we can’t wait to answer them.