A smart device is a small computer
A connected device is a device with a sensor or a switch and a network connection. Its main security risks are default passwords, missing updates, traffic anyone can read, and a need for the internet. Knowing these four lets you check any smart camera, plug or lock in a few minutes.
Most of the attacks on such devices needed no clever trick. They used a password nobody changed.
By the end of this lesson
Note
I can name the main risks of a connected device.
Key words
| Word | What it means | Example |
|---|---|---|
| Default password | the password a device has when it leaves the factory | admin |
| Firmware | the program stored inside a device | |
| Authentication | proving who you are, such as with a name and a password | |
| Encryption | scrambling data so only the right reader can use it | |
| Offline | working with no connection to the internet |
The cells students fill in are left blank in this preview.
Only your own lab copy
Important
Look at risks only in the lab copy that is yours, or in devices you own. Never test a broker, camera or device that belongs to somebody else. The lab leaves out the sign-in and the encryption a real network needs, and that is its point here.
One default password fits thousands of devices
A factory sets one password, such as admin or 1234, and prints it in the manual. If the owner never changes it, anyone who knows the model knows the password.
Attackers keep lists of these passwords and try them on every device they can reach. The fix costs nothing: make the owner choose a new one, and refuse the old one.
Worked example: four risks, four fixes
| Risk | What goes wrong | A fix |
|---|---|---|
| Default password | Anyone who knows the model can sign in | Force a new password at set-up |
| No updates | A known fault stays in the firmware for years | Automatic updates, with a stated end date |
| No encryption | Anyone on the network can read or change messages | Encrypt every connection |
| Needs the cloud | If the service goes away, the device stops working | Keep the basic job working offline |
The cells students fill in are left blank in this preview.
Connect with a made-up name and password
docker exec broker mosquitto_sub -t home/door/state -v -C 1 -W 5 -u nobody -P wrongShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
The lab never checked the password
The command gives a name, nobody, and a password, wrong, that nobody ever set up. It still prints one line: home/door/state and then open or closed.
That is because this lab's broker has no authentication. It lets anyone read and write. A real broker would refuse the connection. This is safe here only because nothing outside your copy can reach it.
A device that never updates keeps its faults
The firmware is the program inside the device. Like any program it has faults, and some are found after the device is sold. If the maker has no way to send an update, or stops sending them, every owner is stuck with the fault.
Before you trust a device, ask two things: does it update itself, and until when will the maker keep sending updates?
Encryption keeps a message private on the way
The lab's messages are plain text. A real connection is wrapped in encryption, so anyone who copies the data on the way sees only scrambled bytes. It also lets the device check that it is talking to the real broker.
Plain MQTT sends the topic and payload as readable text, as you saw. Real devices use an encrypted connection and a sign-in.
A good device works offline too
Some devices need a maker's cloud service for everything. A smart lock that cannot open without the internet is a worse lock than a key.
Plan for the day the network, or the company, is gone. A thermostat should still hold its last schedule, and a door sensor should still sound its own alarm.
A common mistake
Warning
Many people think a device on a home network does not need a good password, because the network is private. One infected laptop or one forwarded port is enough to reach it. Treat every device as if it could be reached, and give it its own strong password.
Check one device's settings
device = {"password": "1234", "updates": "never", "encrypted": True}
problems = []
if device["password"] == "1234":
problems.append("default password")
if device["updates"] == "never":
problems.append("no updates")
# Add a check for encrypted being False, then press Run.
print(problems)