Fear not, owners of Belkin WeMo devices: you no longer have to lose sleep over the possibility that your smart plug will be hacked. Belkin has rolled out an update that patches the five vulnerabilities listed by FEMA’s Computer Emergency Readiness Team. This security hole affects up to 500,000 WeMo devices, and as CERT states, the vulnerability could result in anything from a fire to the waste of electricity.
These holes were recently discovered and announced by IOActive, Inc. As the press release states, the security company made several attempts to contact Belkin about the issues, but Belkin was unresponsive. So IOActive turned to CERT who also issued a statement. However, per a statement Belkin sent to TechCrunch (embedded below), Belkin was in fact in contact with the security research firm prior to their public statement.
Specifically, Mike Davis, IOActive’s principal research scientist, identified that through several different means, hackers could remotely access Internet-connected WeMo products, upload custom firmware, remotely monitor devices and access local networks.
The update Belkin recently issued patches these holes.
This speaks to a larger issue. As the Internet of things takes off, hackers and malicious coders have an increasing number of targets. It’s not inconsivable that in the near future, KitchenAid will have to issue a security patch for a toaster or blender.
Belkin’s Statement
Belkin has corrected the list of five potential vulnerabilities affecting the WeMo line of home automation solutions that was published in a CERT advisory on February 18. Belkin was in contact with the security researchers prior to the publication of the advisory, and, as of February 18, had already issued fixes for each of the noted potential vulnerabilities via in-app notifications and updates. Users with the most recent firmware release (version 3949) are not at risk for malicious firmware attacks or remote control or monitoring of WeMo devices from unauthorized devices. Belkin urges such users to download the latest app from the App Store (version 1.4.1) or Google Play Store (version 1.2.1) and then upgrade the firmware version through the app.
Specific fixes Belkin has issued include:
1) An update to the WeMo API server on November 5, 2013 that prevents an XML injection attack from gaining access to other WeMo devices.
2) An update to the WeMo firmware, published on January 24, 2014, that adds SSL encryption and validation to the WeMo firmware distribution feed, eliminates storage of the signing key on the device, and password protects the serial port interface to prevent a malicious firmware attack
3) An update to the WeMo app for both iOS (published on January 24, 2014) and Android (published on February 10, 2014) that contains the most recent firmware update
The LED-based WeMo connected bulbs come in either a starter set with three for $129, or individually in single bulb packs for $39.99. They have 800 lumens, and are 60 watt equivalent with a warm white tone. They can be controlled each on their own, or in pre-assigned groups, and they are connected to a WeMo link, which is included in the starter pack and can manage up to 50 bulbs. You can turn them on and off over the web, run vacation programs, dim them and control from both iOS and Android via the WeMo app.
The new WeMo crock-pot lets you turn the slow cooker on or off from anywhere, get reminders about the state of your meal, change the temperature remotely and either control things manually or use built-in calculators for time and temp. It retails for $99.99, which actually isn’t that far off from some nicer slow cookers on the market, and can be controlled from the WeMo app for iOS or Android too.
Finally, and most interesting of all, Belkin is making it possible to take legacy hardware and then turn that into a WeMo-enabled accessory. You can add Internet control to anything with a DC switch, the company says, and allows you to schedule those device or turn them on or off manually from anywhere you have a connection. It’s like a more sophisticated and integrated version of their smart outlet WeMo products, with additional features that let you watch and control a huge range of 5V DC-powered sensors. So if a moisture sensor connected to the maker notices that it’s rained, it’ll prevent your connected sprinkler system from going on as previously scheduled. The Maker can also be combined with IFTTT recipes for advanced intelligent programming.
![Further Automate Your Home And Clean It, $5 Off $35 On Amazon [Deals]](https://i0.wp.com/img.gawkerassets.com/img/198h8szd7fq0ijpg/ku-xlarge.jpg?resize=640%2C360)
![Automate Your Home With WeMo And Nest, Get Into Photography [Deals]](https://i0.wp.com/img.gawkerassets.com/img/198dhn1bfnggijpg/ku-xlarge.jpg?resize=640%2C360)
