Smart Devices – Trustworthy or Not?

The term “smart device” is now used prolifically for all of the electronics enabled gadgets in your home. There is no doubt that the devices are “smarter” than they were 30 years ago as they have additional functionality to those of the past decades.

Devices are considered “smart” as soon as they have electronic circuitry in them that enables them to make decisions based on their input sensors, on their own, without your intervention. In most modern gadgets, this is done with a full microprocessor, not unlike like your desktop PC, or mobile phone.

Questions You Should Ask

This all sounds great until you start to ask a few questions. I am using my new bathroom scales as an example, but it really applies to so many gadgets:

• Why is my new bathroom scales telling me the weather?
• How do they know the weather where I live?
• Why can’t I use the scales without setting up a new online account?
• Why are my scales getting regular software updates? They are measuring my weight just fine, after all!

It turns out that the answers are linked and therein lies a bigger issue relating to your use of smart devices and the potential for hidden abuse others.

Answers Lead To More Questions

Online Account Required

Firstly, the fact the device does not work without an online account is just wrong. There is no engineering reason why a microprocessor device should not be able to function autonomously. Most people don’t know that this is a requirement for their new device when they buy it, until they open the box and try to use the device. The impact of this single dependency is far reaching.

Wireless Connection Required

Let’s continue. The scales have no option for a wired network connection. So you need to connect this to your WiFi network and you will therefore have an increase in your EMF level in your house as you connect to your 2.4/5 GHz router. There are no access ports on these devices, so you are locked into going wireless.

Your Personal Details Shared

You are connected to the network, but you now have to provide personal details to a company that you feel with look after them in a secure manner and not pass them on to third parties. Wrong again. All of the manufacturers of these devices are just businesses running standard computing environments and the larger ones have contractors looking after the IT infrastructure. This means that you do not know who has access to your personal details. Then you look at the “agreement” that you had to accept when you were signing up and see that it includes, “your data may be shared with third parties”. So now you have signed away any privacy you may have had. Your weight and body characteristic is no longer your business.

Aren’t We Good – Check Out The Weather

Now, they’ll throw you a carrot that you don’t need. The weather is so important to any person that they need to know it, when they weigh themselves in the morning. Really??

Software Updates Required – Again!

A week goes by and you go to step on the scales and get the message “Updating…. Please wait”. Great, we all love updates. MS Windows does it every morning so it must be good.

If you look into what is happening when that event occurs it raises a lot more questions.

• Why is it updating
• How is it updating
• How do I know that the scales are still just measuring your weight now

The answer to this is that the scales do, in fact, have volatile storage, just like a PC, that is updated. The scales will be running a new program when it’s finished updating. The update is usually referred to as “firmware update” but in essence is the same as what people see every morning on the MS Windows desktop.

Trust 19,700 People – What Could Go Wrong?

To the latter questions, it will depend entirely on your trust for the integrity of the manufacturer, all their employees and third party contractors. In fact for Garmin, for example, there are over 19,700 people involved in the process, that you have put your trust in, that this will never happen:

• Your data is copied and sent to an unauthorised destination, as it is transferred between your device and their servers.
• Your new program does not contain any extra functionality, which is simply put there by a disgruntled employee, that opens up your network to cybercriminals. The software programs for most modern consumer devices are so complex that hiding badly written, or malicious code, is extremely easy to do.
• The company is sold to another business which a different set of business ethics.

High Privacy Risks – In All Devices

As indicated above, you will notice that this device behaviour is common amongst so many of your “reputable” high profile manufacturers, including giants such as Apple, Samsung, Sony, Microsoft, etc. Privacy is simply non existent, once you have signed into their online systems.

Very High Security Risks – In Some Devices

Now suppose you were to choose to buy smart devices from other manufacturers, let’s say some unknown Chinese, Taiwanese, or similar, manufacturer that offer you the equipment so cheap that it barely costs more than what you have to pay for postage alone, domestically.

You are now in the high risk category for criminal activity. Many of these devices have been banned from use within government buildings due to their high security risk. It is easy to understand how this done when you consider that you might be buying a camera and on the first update, getting an unauthorised surveillance device on the first firmware update.

Buyer Beware

Now that you understand what the risks are, there is only one sure way to avoid putting your home network at risk.

Do not connect a device to your local network that requires access to an online account to operate.