Also consider the hubs. To take a well known example, Phillips Hue lightbulbs don't connect to the net directly and don't have any significant computational res

Also consider the hubs. To take a well known example, Phillips Hue lightbulbs don't connect to the net directly and don't have any significant computational resources to speak of. They are just an 8-bit Atmel microprocessor with a Zigbee radio to talk to the hub ( https://blog.adafruit.com/2016/06/14/teardown-of-a-philips-hue-led-lightbulb-with-zigbee-and-atmega2564-avr-iot-iotuesday/ https://blog.adafruit.com/2016/06/14/teardown-of-a-philips-h... ). On the other hand, the Hue hub is running a full embedded Linux distro (which has even been rooted, though it requires physical access http://colinoflynn.com/2016/07/getting-root-on-philips-hue-bridge-2-0/ http://colinoflynn.com/2016/07/getting-root-on-philips-hue-b... ). A lot of the "real" smart home gadgets are using this model and they will gleefully punch a hole in you firewall, so it comes down to the security of the hub(s). From what I know, Mirai is mostly hitting stuff that isn't what I think of as IoT - stuff like routers, security cameras and DVRs. Seems like it's being misrepresented, though that's not to say that an attack on something more in line with what I think of as IoT/smart home isn't possible. I have no doubt that tons of refrigerators with Wifi and connected coffee makers are vulnerable. Part of me wonders if Mirai was meant as a grey hat warning since it's just showing what's possible only picking on low hanging fruit ("Mirai" means "future" in Japanese).