Google’s Nest thermostat can be hacked in under a minute, according to a blog post and video posted by GTV Hacker. The hack, to be demonstrated in public at this year’s Def Con conference in August, would allow attackers complete control over the device and access to the user’s home network.
Nest, purchased by Google for $3.2 billion, is a "smart" thermostat which can be controlled via smartphone app, and which can connect to other devices including smoke alarms around the home.
GTV Hacker writes that Nest, “features a Device Firmware Update (DFU) mode that can be accessed by holding down the Nest’s screen while off. This mode is intended for the manufacturer to easily diagnose and repair the device. Unfortunately, in the case of the Nest, this mode also allows us to modify the device without restriction.”
Any attacker would need physical access to the device, but once installed, the proof of concept code would allow an attacker to “make changes without ANY restrictions”, the researchers write.
BetaNews comments that the attack, which would allow an attacker remote control over the system, and bypass most firewalls, is particularly unwelcome coming after concerns over the safety of the company’s smoke and carbon monoxide detectors.
ESET’s 2014 Mid-Year Threat Report is to discuss the increasing security concerns over internet-connected appliances in a segment entitled, “The Internet of (Infected) Things”. The full talk is available to stream live on June 25 (10-11am Pacific), or to download via https://www.brighttalk.com/webcast/1718/110971.
The attack will be shown off at Def Con as part of a presentation entitled, “Hack All The Things,” in which the researchers promise to gain control over 20 internet-connected appliances in 45 minutes.
“This presentation will feature exploits for over 20 devices including but not limited to TVs, baby monitors, media streamers, network cameras, home automation devices, and VoIP gateways. Gain root on your devices, run unsigned kernels; it’s your hardware, it’s internet connected, and it’s horribly insecure,” the researchers write.
