4 ms·
For a thermostat, it would likely not be immediately visible to the attacker unless they cross-reference their smart energy meter readings. It might possibly es
by WiseWeasel 8y ago
For a thermostat, it would likely not be immediately visible to the attacker unless they cross-reference their smart energy meter readings. It might possibly escape detection for lights, doorbells and music depending on the degree of video/audio surveillance.
- jpindar 8y agoSure it would be. If they turn up the desired temperature and the measured temperature doesn't go up, they know the thermostat is disconnected.
- LeifCarrotson 8y agoThe key part of the original post is to SILENTLY disable the remote interface. This only leaks if there are two devices (a thermostat and temperature sensor) that don't know about each other or the other's secret offline status. With a doorbell, the assumption is that the app would be made to show 'ringing doorbell' when the doorbell is actually offline and silent - not as presently implemented where the Internet of Shit app doesn't have any fault handling and simply HTTP GETs {"doorbell":"ring"} and discards the response. Same for the thermostat, as for the Android privacy APKs that show bogus location data, white noise from the mic, bogus contacts, or the inside of a lens cover from the camera to apps that request those permissions needlessly.