Popular Wi-Fi Thermostat Full of Security Holes

Threatpost reports: Heatmiser, a U.K.-based manufacturer of digital thermostats, is contacting its customers today about a series of security issues that could expose a Wi-Fi-connected version of its product to takeover. Andrew Tierney, a "reverse-engineer by night," whose specialty is digging up bugs in embedded systems wrote on his blog, that he initially read about vulnerabilities in another one of the company's products, NetMonitor, and decided to poke around its product line further. This led him to discover a slew of issues in the company's Wi-Fi-enabled thermostats running firmware version 1.2. The issues range from simple security missteps to critical oversights.For example, when users go to connect the thermostat via a Windows utility, it uses default web credentials and PINs. ...Elsewhere, the thermostat leaks Wi-Fi credentials, like its password, username, Service Set Identifier (SSID) and so on, when its logged in. Related: O'Reilly Radar has an interesting conversation about what companies will vie for control of the internet-of-things ecosystem.

Comments

Will this internet of things die already?

[Spy Handler]

Nobody needs a home thermometer and refrigerator connected to the internet. Gadget makers and tech press have been trying to foist this shit on us for years and nobody wants it. Let it die already.

Re:Will this internet of things die already?

[AmiMoJo]

Hopefully people will exercise their legal rights to correct this kind of thing. For example, goods must be "fit for purpose" and of "reasonable quality". In other words, security must be reasonably effective.

Could be even more interesting if you paid to have it installed.

Re:Will this internet of things die already?

[DarkTempes]

I'd mostly be interested in using a smart thermostat for logging.
If I can detect HVAC performance problems just once before they lead to a dead system on a deadly hot summer day and an emergency call to a repair guy then it would easily have paid for itself in comfort.

Re:Will this internet of things die already?

[GNious]

Seriously! How long would one have to be away and kicking himself that he forgot to change the thermostat setting before having one of these new fangled ones would pay for itself?

Looking at the spiel from Nest, these products pay for themselves through regular use, not through exceptions:

Auto-Schedule makes it easy to create an energy efficient schedule that can help you save up to 20% on your heating and cooling bills. All the Nest Thermostat's features combined can get you even bigger savings

More: https://nest.com/thermostat/sa...

Some dude, who may very well be paid by Nest, tweeted this:

After a year using my @Nest thermostat, I've saved $326.74 / 2,651 kWh over the previous year.

Linky: https://twitter.com/MattClippe...

Not saying that all of the above is true, but at least it seems that they'd consider your premise incorrect.

Re:Will this internet of things die already?

[TrollstonButterbeans]

I don't want one (now), but I disagree.

Some day they will probably make something of this sort that I do want.

Wouldn't be nice to automatically know what you did and didn't have in the refrigerator or make sure you turned the air conditioning off while on vacation.

Perhaps. Perhaps not, but I imagine at some point something very useful and relevant could be made.

Re:Will this internet of things die already?

[WaffleMonster]

Looking at the spiel from Nest, these products pay for themselves through regular use, not through exceptions:

A cheap programmable thermostat pays for itself quicker.

Auto-Schedule makes it easy to create an energy efficient schedule that can help you save up to 20% on your heating and cooling bills. All the Nest Thermostat's features combined can get you even bigger savings

I give a shit about results only seen by a few outliers... honest..

After a year using my @Nest thermostat, I've saved $326.74 / 2,651 kWh over the previous year.

If I were selling a product that really did all the wonderful things claimed I would want the world to know about it by providing credible evidence supporting my assertions. Instead we are treated to a bunch of people saying they saved x, y and z over last year... which is to say the least.. completely worthless.

Patiently awaiting credible evidence...

Re:Will this internet of things die already?

[DarkOx]

Which is completely meaningless. My energy bills can easily vary that much over a year depending weather conditions; without me doing anything around my own behavior. $300 in the typical ~2500 ft suburban home over a the course of an entire year is indistinguishable from noise.

Customers for Wi-Fi enabled thermostats

[Marginal Coward]

Finally! Wi-Fi enabled thermostats have found a set of customers who have a genuine need for them: security researchers. But if the thermostats were truly secure, even that small market would dry up. After all, who wants to play a game that can never be won?

Personally, rather than buy a Wi-Fi thermostat, I've been training my cat to adjust the thermostat just before I come back after three-day weekends. In all honesty, I haven't had much luck with that so far, but I'll get the cat trained eventually, I know I will. Just gotta keep trying.

Now that you mention it, though, I've really thought through the security implications of owning such a highly trained cat...

Fire Hazard Warning

[Scarletdown]

Is it wise to buy a thermostat from a company calling itself Heatmiser? After all, the name is taken from a bloke who proudly declared that anything he touches, starts to melt in his clutch.

You know what's great?

[93 Escort Wagon]

The way these companies pushing "the internet of things" devices are designing security into their products from the ground up. Sure, you might think, but it's so obvious to anyone that's been paying attention during the past decade that security had better be baked into these always-connected products - but you'd be wrong. So we are fortunate these companies aren't rushing their products to market while they contain trivially exploitable security holes.

Well done, guys! Well done!