Security flaws in a popular smart home hub let hackers unlock front doors

[Eugene]

Source: TechCrunch

Security flaws in a popular smart home hub let hackers unlock front doors

Zack Whittaker@zackwhittaker / 1 day ago

When is a smart home not so smart? When it can be hacked.

That’s exactly what security researchers Chase Dardaman and Jason Wheeler did with one of the Zipato smart hubs. In new research published Tuesday and shared with TechCrunch, Dardaman and Wheeler found three security flaws which, when chained together, could be abused to open a front door with a smart lock.

Smart home technology has come under increasing scrutiny in the past year. Although convenient to some, security experts have long warned that adding an internet connection to a device increases the attack surface, making the devices less secure than their traditional counterparts. The smart home hubs that control a home’s smart devices, like water meters and even the front door lock, can be abused to allow landlords entry to a tenant’s home whenever they like.

In January, security expert Lesley Carhart wrote about her landlord’s decision to install smart locks — forcing her to look for a new home. Other renters and tenants have faced similar pressure from their landlords and even sued to retain the right to use a physical key.

Dardaman and Wheeler began looking into the ZipaMicro, a popular smart home hub developed by Croatian firm Zipato, some months ago, but only released their findings once the flaws had been fixed.

-snip-

Read more: https://techcrunch.com/2019/07/02/smart-home-hub-flaws-unlock-doors/

[qazplm135]

1. install a deadbolt?

Landlord gets their smart locks, and you get actual security.

[silverweb]

2. Not necessarily an option.

Many, if not most, leases specifically prohibit a tenant from changing or adding any locks without permission or giving keys to management. Managers/landlords must be able to enter in event of emergency

I've managed apartments for 12+ years and have had a handful of such emergencies that required immediate entry: a broken pipe leaking into downstairs unit, welfare check discovering deceased tenant, welfare check discovering tenant with a stroke needing EMTs, smoke detector going off when no one was home, etc.

[eppur_se_muova]

3. "When it can be hacked" ... when will we learn that anything that relies on software can be hacked ?

And anything that is connected to the Internet is inviting attack.