Kaspersky Lab researchers have discovered vulnerabilities in a smart hub used to manage all the connected modules and sensors installed in the home. Analysis reveals that it is possible for a remote attacker to access the product’s server and download an archive containing the personal data of arbitrary users, which is needed to access their account and take control over their home systems as a result.
While the popularity of connected devices continues to increase, smart home hubs are in high demand. They make house management much easier, combining all device settings in one place and allowing users to set them up and control them through web-interfaces or mobile applications. Some of them even serve as a security system. At the same time, being a “unifier” also makes this device an appealing target for cybercriminals that could serve as an entry-point for remote attacks. Earlier last year, Kaspersky Lab examined a smart home device that turned out to provide a vast attack surface for intruders, based on weak password generation algorithms and open ports. During the new investigation, researchers discovered that an insecure design and several vulnerabilities in the architecture of the smart device could provide criminals with access to someone’s home.
First, researchers discovered that the hub sends user’s data when it communicates with a server, including the login credentials needed to sign in into the web interface of the smart hub – the user ID and password. Moreover, other personal information such as the user’s phone number used for alerts, can be also listed there. Remote attackers can download the archive with this information by sending a legitimate request to the server that includes the device’s serial number. And analysis shows that the serial number can be also discovered by intruders as a result of simplistic methods of its generation.
According to experts, serial numbers can be brute-forced using logic analysis and then confirmed through a request to the server. If a device with that serial number is registered in a cloud system, criminals will receive affirmative information. As a result, they can log in to the user’s web account and manage the settings of sensors and controllers connected to the hub.
All information about the discovered vulnerabilities has been reported to the vendor and is now being fixed.
“The research we’ve conducted on smart home hubs confirms that these connected devices are at risk of an attack – resulting in vulnerabilities across millions of homes. Though it’s no surprise that IoT devices are still proving to be insecure, gadgets that are commonplace in homes, containing personal data, should be afforded the utmost security protection. The fact that smart home hub meters are open to attack from cybercriminals is very concerning due to the wealth of people using these devices on a day-to-day basis. ”, said David Emm, Principal Security Researcher at Kaspersky Lab.
Christopher Littlejohns, EMEA manager at Synopsys, said “Vulnerabilities in smart hubs are predictable symptoms of an organisation without a clear focus on security. Common avoidable mistakes have been made that put users data at risk including:
- User and company sponsored publication of credentials on publicly accessible sites
- Poor credential mechanisms that include guessable device ids
- Using legacy encryption techniques that are readily crackable using brute force techniques
- Passing data over htttp rather than https
All of these issues demonstrate a lack of threat awareness or analysis; they are fundamental design issues that creates readily exploitable vulnerabilities. This is a recurring theme for small and larger companies for whom speed to market is the primary goal. Companies that do not “build security in” as part of their development processes will suffer the consequences of brand damaging reports like this, or worse – they will likely go out of business.”
