News - 2016050501 - Samsung SmartThings Security Flaw: What You Need to Know
Security researchers at the University of Michigan have uncovered a number of design flaws in Samsung’s SmartThings platform. The flaws potentially undermine the security of any smart home setups using the SmartThings ecosystem, allowing malicious applications to unlock doors, falsely set off alarms, set home access codes, wake devices from vacation mode, and a host of other attack vectors.
In a slight saving grace, one of the attacks is dependent on the user downloading a malicious app from the SmartThings store, or by following a malicious link. Once the malicious app is downloaded, an attacker could effectively conduct a remote assault from anywhere in the world.
Understandably, Samsung have been defensive about the critical security issues, claiming that it is operating in full knowledge of the problems and that they are being actively removed.
Is that good enough? Or should Samsung, a multinational technology company be actively investigating why their products are seemingly shipping with security bugs? Let’s take a look.
Multiple Vulnerabilities
Security researchers at the University of Michigan devised several proof-of-concept exploits focused on exposing any potential failings in the Samsung SmartThings ecosystem. As one of the largest manufacturers of IoT Ready (Internet of Things) devices, including fridges, thermostats, ovens, security doors, locks, panels, sensors, and so much more, it will come as no surprise that their security credentials are under scrutiny.
The researchers confirmed the faults were caused by two intrinsic design flaws in the SmartThings ecosystem. What’s more is that the two intrinsic design flaws aren’t necessarily easy to fix.
The issues relate to how third-party smart home control applications implement the authorization protocol OAuth. The researchers discovered one non-compliant application, and were able to build an entire attack based around the flaw, sending a single link to the actual SmartThings login page, but stealing the user’s login token at the same time. With the tokens in hand, an attacker could feasibly create their own PIN for a smart lock while the user would remain unawares.
Another exploit included exploitation of a vulnerability to turn “vacation mode” off, demonstrating access to high-level permissions. Once access to “vacation mode” is granted to an attacker, they can mitigate any pre-programmed vacation defence modes, such as randomly cycling lights throughout the house, or opening and closing blinds to simulate an occupied residency.
This leads to the second facet of the SmartThings security issue. Most of the apps exploited by the researchers shouldn’t have this level of operating privilege to begin with. The security researchers established the SmartThings store contains over 500 individual apps offering some degree of control or automation of your home. They then found over 40% of these apps grant too many privileges for the sometimes simple job they were designed to do.
These “over-privilege” apps create a significant security issue, though it is often not entirely the fault of the designer. Atul Prakash, University of Michigan professor of computer science and engineering explained it like so:
“The access SmartThings grants by default is at a full device level, rather than any narrower. As an analogy, say you give someone permission to change the light bulb in your office, but the person also ends up getting access to your entire office, including the contents of your filing cabinets.”
The Samsung Response
As you would expect, Samsung have been protective over their Internet of Things interests. The SmartThings statement is as follows:
“Protecting our customers’ privacy and data security is fundamental to everything we do at SmartThings. We are fully aware of the University of Michigan/Microsoft Research report and have been working with the authors of the report for the past several weeks on ways that we can continue to make the smart home more secure as the industry grows.
The potential vulnerabilities disclosed in the report are primarily dependent on two scenarios – the installation of a malicious SmartApp or the failure of third party developers to follow SmartThings guidelines on how to keep their code secure.
Regarding the malicious SmartApps described, these have not and would not ever impact our customers because of the certification and code review processes SmartThings has in place to ensure malicious SmartApps are not approved for publication. To further improve our SmartApp approval processes and ensure that the potential vulnerabilities described continue not to affect our customers, we have added additional security review requirements for the publication of any SmartApp.
As an open platform with a growing and active developer community, SmartThings provides detailed guidelines on how to keep all code secure and determine what is a trusted source. If code is downloaded from an untrusted source, this can present a potential risk just like when a PC user installs software from an unknown third party website, there’s a risk that software may contain malicious code. Following this report, we have updated our documented best practices to provide even better security guidance to developers.”
It isn’t the first time Samsung have ran into IoT security issues, nor is it a problem isolated to any single technology company. IoT devices have consistently been the source of security problems, and a majority of users exploring new, Internet-ready, networked devices do not fully comprehend the severity of what they are doing.
