Pinterest Stumbleupon Whatsapp
Ads by Google

Security researchers at the University of Michigan have uncovered a number of design flaws in Samsung’s SmartThings platform. The flaws potentially undermine the security of any smart home setups using the SmartThings ecosystem 3 Ways to Protect Your Family and Home With SmartThings Presence 3 Ways to Protect Your Family and Home With SmartThings Presence Want to use tech to keep your nearest and dearest safe? Check out what a SmartThings Presence can do to keep a watchful eye over your home. Read More , allowing malicious applications to unlock doors, falsely set off alarms, set home access codes, wake devices from vacation mode, and a host of other attack vectors.

In a slight saving grace, one of the attacks is dependent on the user downloading a malicious app from the SmartThings store, or by following a malicious link. Once the malicious app is downloaded, an attacker could effectively conduct a remote assault from anywhere in the world.

Understandably, Samsung have been defensive about the critical security issues, claiming that it is operating in full knowledge of the problems and that they are being actively removed.

Is that good enough? Or should Samsung, a multinational technology company be actively investigating why their products are seemingly shipping with security bugs? Let’s take a look.

Multiple Vulnerabilities

Security researchers at the University of Michigan devised several proof-of-concept exploits focused on exposing any potential failings in the Samsung SmartThings ecosystem. As one of the largest manufacturers of IoT Ready (Internet of Things) devices, including fridges, thermostats, ovens, security doors, locks, panels, sensors, and so much more, it will come as no surprise that their security credentials are under scrutiny.

The researchers confirmed the faults were caused by two intrinsic design flaws in the SmartThings ecosystem. What’s more is that the two intrinsic design flaws aren’t necessarily easy to fix.

Ads by Google

The issues relate to how third-party smart home control applications implement the authorization protocol OAuth. The researchers discovered one non-compliant application, and were able to build an entire attack based around the flaw, sending a single link to the actual SmartThings login page, but stealing the user’s login token at the same time. With the tokens in hand, an attacker could feasibly create their own PIN for a smart lock while the user would remain unawares 4 Really Cool Uses For SmartThings Open Closed Sensors 4 Really Cool Uses For SmartThings Open Closed Sensors The Open/Closed sensor is intended to monitor doors and gates, but with some creativity it can do much more. Here are ideas to use the device to make your home a little smarter. Read More .

Another exploit included exploitation of a vulnerability to turn “vacation mode” off, demonstrating access to high-level permissions. Once access to “vacation mode” is granted to an attacker, they can mitigate any pre-programmed vacation defence modes, such as randomly cycling lights throughout the house, or opening and closing blinds to simulate an occupied residency.

This leads to the second facet of the SmartThings security issue. Most of the apps exploited by the researchers shouldn’t have this level of operating privilege to begin with. The security researchers established the SmartThings store contains over 500 individual apps Here's How the New SmartThings App Is a Major Step Backwards Here's How the New SmartThings App Is a Major Step Backwards A recent update to the SmartThings app demonstrates that the company might be changing course. This sort of tech is certainly changing, but it remains to be seen whether this is for better or worse. Read More offering some degree of control or automation of your home. They then found over 40% of these apps grant too many privileges for the sometimes simple job they were designed to do.

These “over-privilege” apps create a significant security issue, though it is often not entirely the fault of the designer. Atul Prakash, University of Michigan professor of computer science and engineering explained it like so:

“The access SmartThings grants by default is at a full device level, rather than any narrower. As an analogy, say you give someone permission to change the light bulb in your office, but the person also ends up getting access to your entire office, including the contents of your filing cabinets.”

The Samsung Response

As you would expect, Samsung have been protective over their Internet of Things interests. The SmartThings statement is as follows:

“Protecting our customers’ privacy and data security is fundamental to everything we do at SmartThings. We are fully aware of the University of Michigan/Microsoft Research report and have been working with the authors of the report for the past several weeks on ways that we can continue to make the smart home more secure as the industry grows.

The potential vulnerabilities disclosed in the report are primarily dependent on two scenarios – the installation of a malicious SmartApp or the failure of third party developers to follow SmartThings guidelines on how to keep their code secure.

Regarding the malicious SmartApps described, these have not and would not ever impact our customers because of the certification and code review processes SmartThings has in place to ensure malicious SmartApps are not approved for publication. To further improve our SmartApp approval processes and ensure that the potential vulnerabilities described continue not to affect our customers, we have added additional security review requirements for the publication of any SmartApp.

As an open platform with a growing and active developer community, SmartThings provides detailed guidelines on how to keep all code secure and determine what is a trusted source. If code is downloaded from an untrusted source, this can present a potential risk just like when a PC user installs software from an unknown third party website, there’s a risk that software may contain malicious code. Following this report, we have updated our documented best practices to provide even better security guidance to developers.”

It isn’t the first time Samsung have ran into IoT security issues, nor is it a problem isolated to any single technology company. IoT devices have consistently been the source of security problems, and a majority of users exploring new, Internet-ready, networked devices do not fully comprehend the severity of what they are doing Why The Internet of Things Is The Biggest Security Nightmare Why The Internet of Things Is The Biggest Security Nightmare One day, you arrive home from work to discover that your cloud-enabled home security system has been breached. How could this happen? With Internet of Things (IoT), you could find out the hard way. Read More .

Small SmartApp Study

The research team even completed an admittedly extremely small study of people using SmartApps, gauging their attention to the permissions they were granting.

Shockingly, 20 of the 22 people interviewed would let a battery monitoring app check the status of smart locks installed in their premises, on the premise the app would send door access codes to a remote server. It may be a case of users not committing their due diligence for personal security, more so when it involves the potential for serious loss, or at worst, personal danger.

But equally, and this is where I commiserate with the users, a major issue is that the companies installing and implementing smart systems throughout private residences and businesses are not offering enough educational support to users 7 Reasons Why The Internet of Things Should Scare You 7 Reasons Why The Internet of Things Should Scare You The potential benefits of the Internet of Things grow bright, while the dangers are cast into the quiet shadows. It's time to draw attention to these dangers with seven terrifying promises of the IoT. Read More .

Sure, the user might understand what the installer is talking about, but have they really digested the fact their entire house is networked? Do they understand that their fridge is now online 5 Devices You Do NOT Want to Connect to the Internet of Things 5 Devices You Do NOT Want to Connect to the Internet of Things The Internet of Things (IoT) may not be everything it’s cracked up to be. In fact, there are some smart devices you may not want to connect to the web at all. Read More , and that their fridge is now open to the same vulnerabilities as their tablet? Because you can bet your bottom dollar the user will be far more up-to-date with tablet vulnerabilities rather than a somewhat intangible threat to the contents of the chiller Samsung's Smart Fridge Just Got Pwned. How About The Rest Of Your Smart Home? Samsung's Smart Fridge Just Got Pwned. How About The Rest Of Your Smart Home? A vulnerability with Samsung's smart fridge was discovered by UK-based infosec firm Pen Test Parters. Samsung’s implementation of SSL encryption doesn’t check the validity of the certificates. Read More .

Or, as the University of Michigan researcher team wrote:

“Smart home devices and their associated programming platforms will continue to proliferate and will remain attractive to consumers because they provide powerful functionality. However, the findings in this paper suggest that caution is warranted as well — on the part of early adopters, and on the part of framework designers. The risks are significant, and they are unlikely to be easily addressed via simple security patches.”

There is no need to panic. Samsung have already begun addressing some of the main issues highlighted in the paper, though it will take some time to ensure the SmartThings framework is truly a truly secure smart home platform Which Smart Hub for Home Automation Is Best for You? Which Smart Hub for Home Automation Is Best for You? For a while, people thought of the idea as nothing more than a gimmick, but recent product releases have shown that smart home automation is starting to live up to its promises. Read More .

Do you use SmartThings? Will you consider switching to a different framework? Let us know below!

Image Credit: Alexander Kirch via Shutterstock

Leave a Reply

Your email address will not be published. Required fields are marked *