{"id":10770,"date":"2017-12-08T08:30:03","date_gmt":"2017-12-08T16:30:03","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/12\/08\/news-4542\/"},"modified":"2017-12-08T08:30:03","modified_gmt":"2017-12-08T16:30:03","slug":"news-4542","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2017\/12\/08\/news-4542\/","title":{"rendered":"Apple\u2019s HomeKit security blunder exposes the risk of smart homes"},"content":{"rendered":"

<\/p>\n

Credit to Author: Jonny Evans| Date: Fri, 08 Dec 2017 06:42:00 -0800<\/strong><\/p>\n

The expression \u201csafe as houses\u201d will become a thing of the past if tech firms don\u2019t get connected home security right<\/a>, and the need to be incredibly watchful was visible in Apple\u2019s latest security blunder<\/a> this week.<\/p>\n

The latest iOS 11.2 update held a zero-day vulnerability attackers could exploit to control smart home devices, including connected locks, 9to5Mac<\/a><\/em> explains. While the vulnerability was difficult to exploit, and Apple has acted very swiftly to close this security gap, its existence exposes the risk of smart homes.<\/p>\n

Apple\u2019s swift response is two-fold:<\/p>\n

To address a problem like this fast is exactly what must be demanded from any smart home solution manufacturer \u2013 nothing less is acceptable. Smart locks must really be lock<\/a>s, and not subject to being undone by opportunistic hackers with time on their hands.<\/p>\n

There is a real risk: the industry remains fragmented, not every smart device is truly smart, and some of those early to market solutions have been shown to use poor internal password protection, including the capacity to use these as entry points into home networks.<\/p>\n

While others rushed to market with smart home systems, Apple realised the need to ensure security protection in its smart home technologies early on. Its response was to develop HomeKit as a platform for smart home devices on iOS, but to ensure those solutions compatible with HomeKit meet certain criteria, including use of approved technologies<\/a>.<\/p>\n

The strength of that approach is \u2013 oddly enough \u2013 proven by Apple\u2019s response to this latest vulnerability. You see, Apple was able to address a platform-wide problem by making a temporary fix to its own HomeKit servers.<\/p>\n

That\u2019s important in two ways \u2013 it means the company can respond swiftly to smart home security problems as they transpire. Another reason that matters is because it means those wanting to break these protections will need to figure out how to exploit those very same HomeKit servers, which I think will be much harder to achieve than undermining an individual iOS user\u2019s security.<\/p>\n