Tripwire Uncovers Significant Security Flaws in Popular Smart Home Automation Hubs

New research finds zero-day vulnerabilities in Amazon’s top-selling smart home systems

PORTLAND, Ore.--Tripwire, Inc., a leading global provider of advanced threat, security and compliance management solutions, today announced results of an extensive security assessment of three top-selling smart home automation hub products available on Amazon. The research uncovered zero-day flaws in each hub that could allow hackers to take control of smart home functionalities.


Smart home hubs are used to control lighting, heating, locks and cameras in people's homes. In order to understand the risks associated with smart home hubs, Tripwire's Vulnerability and Exposure Research Team (VERT) analyzed three of the top-selling smart home systems on Amazon. Tripwire security researchers found zero-day flaws in each of the devices that, if successfully exploited, would enable hackers to:

* Identify when people are out of their home.
* Change alarm settings.
* Open locks without authorization.
* Access local area networks.
* Use smart hubs for DDoS purposes.

"Smart home hubs are steadily growing in popularity; however, as with many consumer technology products, functionality has trumped security," said Craig Young, security researcher for Tripwire. "Smart home hubs enable users to have control over the connected devices in their house, but they also open new doors for criminals. The threat is relatively low for now, but it will increase as malicious actors recognize how much information can be gained by attacking these devices."

"These devices can also be used as a gateway to inflict physical damage to a home, and, in many cases, they actually make homes less secure," said Lamar Bailey, director of research and development at Tripwire. "For example, many of these devices interface with heating, ventilating and air conditioning controls. An attacker could turn off the heat on a freezing cold night while a family sleeps or worse, when the family is away for the weekend, causing pipes to freeze and burst."

Currently, two out of the three vendors have patched these reported flaws; however, one vendor's smart home system remains at risk. If left unpatched, some of the vulnerabilities revealed in VERT's analysis could be exploited through malicious web pages or smartphone applications and execute commands with system level access.

"Smart home hubs that are vulnerable to remote code execution could allow attackers to migrate from a breached computer to the hub, effectively hiding themselves on the network," said Tyler Reguly, manager of security research at Tripwire. "In addition, a cross-site request forgery could allow malicious actors to manipulate device settings every time the consumer surfs the web or opens an email. The risks are real, and the points of entry are numerous. Vendors need to acknowledge vulnerabilities and issue updates on a regular basis, and consumers need to realize the risks and apply vendor issued updates."

Additional resources:
Video: Smart Home Invasion

About Tripwire
Tripwire is a leading provider of advanced threat, security and compliance solutions that enable enterprises, service providers and government agencies to confidently detect, prevent and respond to cybersecurity threats. Tripwire solutions are based on high-fidelity asset visibility and deep endpoint intelligence combined with business-context and enable security automation through enterprise integration. Tripwire's portfolio of enterprise-class security solutions includes configuration and policy management, file integrity monitoring, vulnerability management and log intelligence. Learn more at www.tripwire.com, get security news, trends and insights at http://www.tripwire.com/state-of-security/ or follow us on Twitter @TripwireInc.

Featured Product

Video Mount Products ERWEN-12E750

Video Mount Products ERWEN-12E750

The ERWEN-12E750 is a deeper version of our popular ERWEN-12E wall cabinet. With 24 inches of USABLE DEPTH, this is a workhorse of a wall mounted rack enclosure with the added depth you need for installing today's deeper components. With adjustable 4-post rails, a removable hinged wall plate, reversible tempered glass front door and optional fans for enhanced thermal management, the ERWEN-12E750 has all the features today's professional installers are looking for. Additional features and specs include welded steel construction, ships fully assembled, overall Dimensions - 25.3" H x 24.3" W x 29.625" D, works with all standard 19" rack equipment and accessories, rails have numbered spaces with standard 10-32 threading, adjustable front and rear rails, vented top and bottom, top and bottom cable routing knockouts, removable locking side panels, stabilizing hasp, load capacity - 120 lbs, black powder coat finish. MSRP: $479.00