9

Today I—likely—stumbled upon a major security leak in my home automation setup.

Scenario

I installed the ha bridge github project on my Raspberry Pi, mainly to see what it can do. I literally just followed the first few steps, downloading and starting the habridge. To my great surprise my Logitech Harmony Hub seems to freely share all his information with the new bridge. I have not entered any credentials whatsoever. The only thing I provided was the Harmony's IP address and a bogus device name (i.e. my hub has actually another display name for all Logitech and Alexa purposes).

SharingHarmonyHub

Not only does the Hub share information about all configured devices, it also allows those activities to be triggered freely. I tested it, they work splendid.

EveryonePushButtons

I have looked in both the desktop program as well as the mobile app. Neither seems to offer any way to activate any security options.

When I look into the log of the habridge it even shows that the Harmony apparently broadcasts everything that happens. The activities that can be seen there (minus cropped ID) were triggered by the Harmony App. There's also a heartbeat that tells my habridge immediately when the Hub is offline.

HarmonyBroadcasts

Question

Is there any way to secure that Hub besides packaging it back up and sending it back to wherever insecure devices come from?

Improve this question
5
  • 2
    This isn't the place for bug reports :) Or actually, should we include gaping security holes and how to exploit them as on-topic?
    – Sean Houlihane
    Jan 4, 2017 at 15:27
  • 3
    @SeanHoulihane I don't want to exploit it, I want to secure it if possible.
    – Helmar ♦
    Jan 4, 2017 at 15:28
  • Although this is definitely IoT and on-topic, don't forget that security quesitons might sometimes get a better reply at security.stackexchange.com - it's a tough call to decide where to post
    – Mawg says reinstate Monica
    Jan 5, 2017 at 13:45
  • 1
    @Helmar: Did you ever get a reply from Logitech about this?
    – Aurora0001
    Feb 3, 2017 at 16:45
  • 2
    @Aurora0001 As of yet, it's an ongoing battle.
    – Helmar ♦
    Feb 3, 2017 at 16:58

1 Answer 1

Reset to default
3

You could setup a local firewall, but your best bet is to put it on a separate secure WiFi network dedicated for IoT devices (if you don't trust the other devices on your network).

It's secure to the outside world; it's only insecure locally.

Improve this answer
3
  • 2
    Can you elaborate on how this partitioning improves the situation? I suppose you could limit the vLAN to a single MAC address, which might block rogue devices from connecting.
    – Sean Houlihane
    Jul 3, 2017 at 11:42
  • 1
    @SeanHoulihane (Sorry for the late reply) lots of people (guests, family, etc) visit your WiFi. Its extremely easy for bots to hack into these devices, get your WiFi password, and then get into your WiFi. Passwords for WiFi networks are your best security, so separating the WiFi networks prevents people from getting your password.
    – Nate D
    Jul 17, 2017 at 15:18
  • 2
    I meant, you should edit your answer so it is clearer what you are protecting against, and how your proposed action improves the situation. Specifically, how is the vulnerability described in the question addressed.
    – Sean Houlihane
    Jul 17, 2017 at 15:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.