A Simple Google Search Allowed This Reporter To Hack 8 Smart Homes
"Smart homes" are houses that are fully wired and internet-enabled, so that owners can control devices — like door locks and thermostats — remotely from their desktops or phones.
A "smart homes" Google search led writer Kashmir Hill to a list of homes with an automation system from Insteon, she writes on Forbes.
Insteon allows home owners to remotely control lights, televisions, fans, garage doors, and other devices from their smartphones or computers.
Since Insteon's systems are web crawlable, they showed up in search results. Insteon also didn't require user names and passwords in a since-discontinued product.
So from San Francisco, Hill was able to control the lights and other things in people's houses in Oregon and Connecticut.
Here's what she was able to see from the eight homes she accessed:
- All the appliances and devices people had
- Time zone
- Closest major city to home
- IP address
- In one case, the actual street address
Earlier this year, Insteon fixed the problem and recalled the device. But it didn't tell customers that the security vulnerability was one of the reasons for it. Insteon blamed user error for why it appeared in search results.
Still, it's pretty crazy that this happened. Head on over to Forbes to read the full account.