The Portland, Oregon FBI field office recently issued a set of tips about smart home and Internet of Things devices. Most of these are tech-savvy common sense, but many people aren't aware of these tips or would rather ignore them.
Bad idea.
What's a smart home device? It's anything that connects to the internet and isn't a computer or smartphone. This means smart TVs and smartwatches, plus smart thermostats, bathroom scales, toothbrushes, ovens, refrigerators and so on, as well connected kids' toys. None of these devices really needs to be online to do its job.
Some smart-home devices do need to be online all the time, such as Wi-Fi-enabled home security cameras and wireless routers. Basically, if you can connect to it with a mobile app, it's a smart-home device.
And some smart home devices have terrible security. Many will leak your Wi-Fi password during the initial setup process. Some have hard-coded passwords that can't be changed -- if you find one, stop using it. Some devices can be accessed from the internet without a password -- stop using those too.
Generally, the less you pay for a smart-home device, the greater the risk. For example, if you're looking for a home security camera, go for more premium brands like Nest or Arlo and skip the no-name brands. They're not worth the privacy and security trade-off.
Check out our quick smart home security tips below and for more read our guide on how to secure your hackable smart home.
7 smart home security tips you should know
1. Change the default password while setting up the device.
This should be a normal part of the setup process. If you have trouble, Google "How to change default password on Device X". If you don't find answers right away, take the device back to the store and get another brand.
It's also not a bad idea to periodically change the password on the app that comes with your smart home device, as long as you don't forget it -- which brings us to our second tip.
2. Make sure the password to access the device is long, strong and unique.
We have tips on creating super-secure passwords, and we recommend using one of the best password managers to keep track of all your credentials.
Smart home devices are much easier to compromise if people use a weak password and/or use the same password across multiple sites and services. In one case, a Ring camera owner had an attacker gain access to their camera and speak racial slurs over it. Ring's security team determined that the user's email address and password had been exposed in a separate data breach.
3. Use two-factor authentication, if you can.
If you haven't heard of two-factor authentication (2FA), it's a vital tool to thwart potential hijacks of online accounts.
With 2FA enabled, a hacker will need more than just your username and password to access the web interface for your smart home device. They would also need your phone, as the most common form of 2FA will send a text message to your cellphone to verify your identity.
For instance, Nest device owners can use Google's 2FA system to prevent unauthorized users from accessing your online Nest account. Not all IoT or smart-home devices offer 2FA for their online accounts, but you should definitely use it when available.
4. Change the default access and administrative passwords on your router too.
Your home router is the gateway to all of your smart home and IoT devices. And lax password security on routers is the main reason for Wi-Fi network break-ins. If an attacker can't access your home Wi-Fi network, it's going to be hard for them to access your other smart home devices in 90 percent of possible attack scenarios.
5. Keep your devices' firmware updated.
The best smart-home devices will update themselves automatically. If they don't, check the instructions or Google for how to update the firmware. If you can't update it, get something else.
6. Keep the devices' companion apps updated.
Many security flaws are fixed on the app side as well as the device side. The Portland FBI field office recommends checking the apps for excessive permissions -- i.e., why would a kids' toy app need to see your contacts list? -- but that applies to all apps.
7. Segment your network, if you can.
Many newer home wireless routers let you create a guest network for visitors who want to get online. Put the smart-home devices on that network, not the primary network the computers are on.
