How Creeps Will Use the Internet to Break into Your Home
Your refrigerator is sending spam. Your front door is running buggy firmware that tells you the deadbolt is locked (when it's not). And the kid next door is pirating music over your wifi network, thanks to a backdoor in your thermostat app. All the internet-enabled things that make your home "smart" are also turning it into a security nightmare.
Smart homes are just one part of a larger movement in the tech industry to build an "internet of things" — an interconnected web of stuff that includes everything from phones and tablets, to washing machines and desk lamps. Megacorps like Google are trying to cash in on this new internet age with products like Nest, a system to control your smart home from the cloud. Other companies, like Samsung, have pledged that 90 percent of their products will be part of the internet of things by 2017.
The problem is that this new internet has all the security problems of the old one. Except they are worse, because software vulnerabilities won't just allow people to break into your network — they'll be breaking into your house. We spoke with chipmakers, product designers, white hat hackers, and security specialists, and they all made one thing is abundantly clear: the smart home is not acceptably secure, not even close.

A Bigger Attack Surface

We already know that smart homes are just unforgivably glitchy to the point where switching off the lights becomes a painful debugging process.
But these bugs aren't just annoyances. Many smart devices are rushed out the door, usually with manufacturers intending to secure them once they're in the wild (and successful) — or maybe just with no intent to do it at all. Because so little attention is given to security in the first place, every smart device you bring into your home network only increases the target on your back. In computer security, this is called your "attack surface."
Experts say that a smart refrigerator has the potential to be far more vulnerable than other internet-enabled devices. "Your computer that has a firewall [when it's awake] has a much smaller attack surface than your cell phone that's constantly on the internet," says Mike Ryan, a Bluetooth expert and embedded security researcher. "The internet of things represents a general broadening of the attack surface. Every single device is connected now, and every single device could be a potential point of weakness. Whereas before your refrigerator plugged into the wall, and that's it."
A nefarious smart refrigerator may seem like a stupid example, and it would be—if it hadn't already been hacked before. Smart refrigerators were among a network devices sending malicious emails in January last year. Here's how the hack went down, according to an NPR report:
Sometime between Dec. 23 and Jan. 6, hackers commandeered home routers and the like and used them to send out malicious emails to grow their botnet, or, army of infected devices. Botnets — and now, "ThingBots" — can be used by hackers to perform large-scale cyberattacks against websites by drowning them with traffic.
But "commandeering" routers, and smart washers, and thermostats, and door locks, and face-recognizing cameras is pretty hard to do, right? Yeah...no. Last April, a family from Cincinnati, Ohio, says they woke up during the night to a man screaming at their 10-month old daughter through a Foscam baby monitor. He had discovered their camera on the internet, took it over, and used it to scare their child. The three-year-old baby monitor didn't have the latest security updates, so the family was an easy target.
Even more terrifying is the prospect that a baby cam could just be the first step in a more general takeover. A smart home invader might begin by discovering a vulnerable device, but then use that to jump onto your wifi network — before long, the attacker could be reading your email and grabbing private information from your phones.
"It's remarkably easy to find out what kind of devices people have in their homes," Ryan tells us. "If [a device] has a vulnerability and you gain control it, then you have a foothold directly on someone's home wifi network, and you can do direct attacks against their laptops or their router. You can change the settings so all their web traffic goes through you."
And its not only the devices that are vulnerable, but the wireless Bluetooth tech we used to tie everything together. Ryan says every Bluetooth implementation he's ever tested has turned up at least one vulnerability. When he reported these security problems to vendors, only one ever responded.
Of course, some devices have better security than others. Companies like Microsoft and Google offer bug bounties, inviting hackers to attack their systems to find weak points, and rewarding successful hacks with cash. There is a similar program at Qualcomm, a chip manufacturer responsible for a lot of the computing brains in your smart wearables, cars, and even lightbulbs. But Asaf Ashkenazi, director of product management for Qualcomm, says bug bounties are not nearly enough.
Which is putting it lightly. A study last fall, conducted by HP, found that 70 percent of commonly used devices in our homes were security risks with almost 25 vulnerabilities per device.
"Although we're providing all the foundations, we cannot solve the problem alone. It's vendors. It's software providers," Ashkenazi tells us. "It needs to be an across industry effort."

A Vulnerable Network

Nothing is 100 percent secure. It would take a massive restructuring of the internet, built from the ground up, and applying all the security lessons we've learned over through the decades, to even come close. Although DARPA is investigating that idea, we're stuck with what we've got—a patched and bandaged framework vulnerable to criminals and trolls of all types.
The internet of things is just the next evolution in how we'll interact with the internet, and it will experience similar security growing pains. The sheer number of devices, whether smart TVs, coffee pots, bluetooth speakers, or baby cams, is what makes a smart home such a challenge to secure. These aren't smartphones or laptops that you replace every two to five years or so. If you're buying a smart washing machine, you may not buy another one for 10 or 15 years. That means the hardware needs to have security designed into it from the beginning and with room to grow, so it can be patched through its entire lifecycle.
"It's this massive lack of understanding of the technologies everyone is going to use and then selling them," product designer and white hat hacker Joe Grand tells us, currently in London teaching a hardware hacking course. "A lot of engineers aren't trained in security. You don't see a lot of cross-pollination in people making products and breaking products...there needs to be more mix. It's really, really frustrating."
In other words, the people who make things don't know how to break things and vice versa so it's like two groups just shouting at each other. Hardware makers need a bigger presence at the big hacker conferences like Black Hat and Def Con, and more hackers need to be involved in the gadget-making process.
And for the meantime, Grand's frustrations will most likely continue because the Federal Trade Commission, tasked with overseeing the internet of things, won't be stepping in to sort out the mess—at least not yet.
In late January, the commission published non-binding guidelines for companies to follow. Here are a few highlights:
-Build security into devices at the outset, rather than as an afterthought in the design process
-Train employees on the importance of security
-Monitor connected devices throughout their expected lifecycle
These are all great ideas, filled with some lets-all-work-together optimism, but they don't go far enough, according to Shankar Somasundaram, director of IoT security for Symantec. "It's good but it's not going to tip it over. You need a little bit more than that." Somasundaram says. "Put in a clause that says if you don't follow basic guidelines in this country, you'll be fined. That extra level creates an actual incentive."
Grand agrees that the most lasting changes won't come from companies, but from some form of government regulation. He says big, scary hacks won't make things safer, just more illegal—which can be a benefit to our smart home security but also a detriment to internet freedom, by trying to push terrible CISPA legislation in a time of "crisis."

Preparing for Smart Home Darwinism

The shame of all of this is there are some great smart products out there that pay attention to security and do make sense in your home. Nest's Smart Thermostat is a smart home champion, offering tangible and money-saving convenience. Belkin WeMo is working on Echo Technology devices that can monitor your entire home's water and energy intake, so you can get bill estimates and even detect leaks down the exact pipe or outlet. These are fantastic ideas.
But right now, the smart home is just that: a fantastic idea without much reality. The internet of things is a bunch of random gadgets, often trying to fix some invented problem that you don't have by connecting it to the cloud and controlling it from your smartphone. Why do we need smart refrigerators and creepy smart beds, anyway?
The answer is that we don't.
"Dependence is the wellspring of risk, the more you take on technology, the more risk you take on that technology will negatively impact your life," Ryan says. "You've got to evaluate everything as a risk/benefit tradeoff. It's easy to say I want the hottest, newest everything...that attitude is going to lead to a lot of the security issues."
A smart thermostat that can analyze energy trends can be a huge benefit. A bed that can tell you if your kids are sleeping, or a smart fridge that can tell you when your milk goes bad? Maybe not so much.
The internet of things is inevitable. The problem is that its architects aren't thinking ahead to the ways that people will use it in their homes and personal lives. Smart homes need to be less about the dream, and more grounded in reality. There are a lot of security risks we're willing to take on the internet because it seems disconnected from our real lives. But when the internet starts living inside every object in our homes, those risks become as real as a person breaking in through your windows.
Illustration by Tara Jacoby