One hacked switch app.

One blind camera.

A shared away variable did the rest.

The first end-to-end lateral privilege escalation in the smart home.

LOW-INTEGRITY

Kasa switch app

SSL flaw, token stolen

HACKED

ROUTINE TRIGGER

away = "home"

written with Away read/write

HIGH-INTEGRITY

Nest Cam

stops recording

● RECOFF

Then came the harder questions

Did the fixes work?

Could anyone check again?

Reported in mid-2018 · status, re-tested

What the vendors did.

Fixed

TP-Link · Kasa

SSL flaw

The bad TrustManager is still in the code, but unused. The MiTM attack no longer works.

Partly fixed

Philips · Hue

App control

Apps can no longer remove other apps. Adding them without consent still works.

Still exploitable

Google · Nest

Routines

Acknowledged as a design-level flaw, hard to fix without disabling sensitive routines.

Mostly unaddressed

Google · Nest

Misleading apps

The onus was put on third-party developers, even for apps Nest’s review had passed.

Cloud app

Hue remote API

approved instantly

linkbutton

BRIDGE WHITELIST

Hue app

Alexa

+ local app 1

+ local app 2

+ local app 3

Hue, retested.

A cloud app can press the “button” remotely, again and again. Its local apps stay even after it is removed.

✓Removing other apps: blocked

✕Adding apps without a press: still possible

Platforms are closing.

Six more platforms, the same five analyses. Could the study be run again?

Nest v1

Nest v2

SmartThings
Classic

SmartThings
v2

HomeKit

Home
Assistant

OpenHAB

Permission enforcement

Permission descriptions

Permission prompts

Impact of routines

SSL misuse in apps

✓feasible◐partially✕not feasible

Only Nest v1 allowed every analysis, at least in part.

Google closed Works with Nest on Aug 31, 2019.

0

findings, and what they ask of platforms

LESSON 1Seamless automation needs strong integrity guarantees.

LESSON 2Product reviews need at least lightweight static analysis.

LESSON 5Closing platforms call for new ways to analyze them.

Security in Centralized Data Store-based Home Automation Platforms: A Systematic Analysis of Nest and Hue

Kaushal Kafle · Kevin Moran · Sunil Manandhar · Adwait Nadkarni · Denys Poshyvanyk

TCPS 2021 · ACM Transactions on Cyber-Physical Systems