David Becker/Getty Images
A Samsung smart fridge.
Pen Test Partners, a firm that specialises in finding exploits, discovered a man-in-the-middle vulnerability in Samsung smart fridges. A man in the middle attack is where a hacker intercepts a piece of data as it passes between a server and the device, in this instance a fridge.
The hack was discovered in Samsung's RF28HMELBSR fridge which has a Wi-Fi capability that allows a user to show their Gmail calendar on the display. While Samsung has implemented a Secure Sockets Layer (SSL), the fridge fails to validate the certificates that come as part of the SSL protocol, leaving the device vulnerable to attack. For an SSL certificate to be valid, the browser must recieve a valid code back from the website host, something Samsung failed to do.
Ken Munro, a partner at Pen Test, clarifies: "While SSL is in place, the fridge fails to validate the certificate. Hence, hackers who manage to access the network that the fridge is on...can Man-In-The-Middle the fridge calendar client and steal Google login credentials from their neighbours."
The team at Pen Test Partners has discovered various other exploits against Internet of Things (IoT) devices, such as Samsung's fridges. Earlier this year the firm discovered that Samsung had failed to encrypt voice recordings that its Smart TVs sent over the Internet.
Internet-connected fridges were first conceived in the early 2000s, with LG bringing the first product to market-at a cost of $20,000 (£12,725). Internet-connected fridges now cost as little as $1,000 (£1,575). The functionality has been further extended by smartphones which can be used to control the fridge, such as setting temperature.
Visa executive Jonathan Vaux told Business Insider in March that he expects internet-connected fridges to become more common. "Your fridge will have a payment capability," he said. "People are immediately associating [Samsung Pay] with the phone, but they're the biggest provider of white goods and so I will have a fridge, I'm sure, that will have connected payments in it."
We have reached out to Samsung for comment and will update the article when we hear back.