6

According to Cognosec, there is a critical vulnerability with ZigBee (one of the protocols supported by the SmartThings hub) which allows attackers to gain access to a ZigBee network by abusing a feature called "Insecure Rejoin". This forum post has an accessible yet detailed explanation of the issue for futher context.

I found a section in the SmartThings FAQ about the issue, which seems concerning:

The current ZigBee Home Automation 1.2 standard uses encryption to allow only authorised devices to join a home network. In order to allow some devices (like motion sensors) to drop off of, and then easily re-join the network (to preserve battery power), there is a feature known as “insecure rejoin” built into the standard. It has been shown, however, that in very specific cases this feature could potentially be used to gain unauthorised access to a ZigBee network.

According to that FAQ, Insecure Rejoin is enabled by default. Is this true, and does it mean that virtually all SmartThings hubs are vulnerable to attack?

2

I just recently discovered this issue while upgrading my SmartThings Hub to a newer model.

It appears that newly added Hubs to your account do not have Insecure Rejoin enabled, but my older model did have this feature enabled. So, perhaps Samsung has updated their systems to protect the users.

Below are screenshots showing how to review/change your configuration for this security feature. Starting from your location 'context menu':

Click the gear iconScroll to your hubClick on Zigbee UtilitiesChange setting

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.