You leave. The camera turns on.

You’re home. It’s off.

Routines run through one shared data store.

Apps and devices read and write its state. Routines react.

So who gets to say you’re home?

Any app with Away read/write. And the camera follows it.

Kasa switchSSL ✕
Wemo switch
Hue bulb
Nest Cam● RECOFF
Thermostat
MyQ garage
NEST DATA STORE
structures.home
away: "away"
devices.cameras.cam1
is_streaming: true
devices.thermostats.t1
target_temperature_c: 21
DENIED
write is_streaming
write away = "home"
TrustManager accepts all certs
A systematic security analysis of

Nest & Hue

Permissions. Routines. Product reviews. Third-party apps.

01Permissions
02Routines
03Apps

Permissions hold.

Fifteen test apps, one per permission, tried every variable. Nest enforced each one as documented.

15 permissions

Each probed by its own app, against the whole data store.

Fine-grained

A switch app can’t write the camera’s is_streaming.

Routines don’t.

The switch can’t touch the camera. But it can set away, and the camera’s routine does the rest.

what actually happens
kasa_app write away = "home"
routine away == "home" → camera off
nest_cam is_streaming = false

Apps leak.

MalloDroid flagged SSL flaws across smart home apps, including ones that hold Away read/write.

0%

of 650 smart home apps have at least one SSL flaw

0%

of 111 Works with Nest apps have at least one SSL flaw

Putting it together · an end-to-end attack

Lateral privilege escalation.

01

Public Wi-Fi

The attacker joins the victim’s coffee-shop network.

02

Kasa app

A broken TrustManager accepts the attacker’s certificate.

03

Token stolen

The app hands its account token to the proxy.

04

away = "home"

Set through TP-Link’s Away read/write access.

05

Nest Cam

Its routine fires. The camera stops recording.

Compromise a smart switch. Switch off the camera.

0
findings with serious security implications
13 of 39Nest apps give incorrect or misleading permission descriptions
HueAny connected app can add or remove other apps, no button press
Product reviewRequires a prompt before changing away, not what it says
Reported to

Google. Philips. TP-Link.

Every vendor confirmed. TP-Link has since fixed the SSL flaw.

CODASPY’19 Best Paper Award

A Study of Data Store-Based Home Automation

Kaushal Kafle · Kevin Moran · Sunil Manandhar · Adwait Nadkarni · Denys Poshyvanyk
CODASPY 2019 · ACM Conference on Data and Application Security and Privacy