IoT AND PRIVACY BYDESIGN IN THE SMART
HOME
Author:Tony AnscombeResearchers:
Juraj Bartko, Ivan Bešina, Miloš Čermák,
Milan Fránik, Štefan Svorenčík, Kacper Szurek

The Internet of Things-2-

CONTENTS
1. ABOUT THE INTERNET OF THINGS  .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   . 22. THE SMART HOME  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 33. THE PRIVACY POLICY AND DATA CAPTURE  .   .   .   .   .   .   .   .   .   .   .   .   . 54. VULNERABLE DEVICES   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   . 55. PRIVACY – THE BIG CONCERN  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .

6

6. THE IOT DEVICES IN OUR BASIC SMART HOME  .   .   .   .   .   .   .   .   .   .   .   . 7a. Amazon Echo (2nd Generation)  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 7b. D-Link   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   . 8DCH-G020 Connected Home Hub  .   .   .   .   .   .   .   .   .   .   .   .   .   . 8DCH-S150 Motion Sensor  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 8DCS-935L Camera  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 9DCS-2132L Camera  .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .  9c. NETAMTO Weather Station  .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .  10
d. Nokia Health  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 11
Nokia Health Body+ Scale   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   . 11
Nokia Health Body Cardio Scale  .   .   .   .   .   .   .   .   .   .   .   .   .   . 11
e. Sonos PLAY:1 Speaker  .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .  14
f. Wörlein –Soundmaster Internet Radio IR4000SW  .   .   .   .   .   .   .   .   .  15
g. TP Link Smart Plug HS110  .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .  16
7. CONCLUSION – IS IT SAFE?  .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .  18

1. ABOUT THE INTERNET OF
THINGS
The Internet of Things (IoT) has become a globally recognized term inworkplaces and homes, and in a literal sense could be used to describe
anything that is connected to the internet. However, if you ask what sort ofdevices are included in the IoT, then you are likely to get differing answers
with respondents describing the devices they have come into contact with,or know about. This can include everything from cell phones, smart bulbs,
fitness trackers, smart speakers and dishwashers, all the way to water
quality sensors in pumping stations.
When predictions on the proliferation of IoT devices started to emerge,
we heard huge numbers from analysts. 50 billion by 2020 was the number
quoted in a presentation by Ericsson’s former CEO Hans Vestberg in 2010.
Eight years later the initial hype around the industry sector has subsided
and the numbers cited are more conservative. Today, Ericsson offers amore nuanced view, estimating that around 29 billion connected devices are
forecast by 2022, of which around 18 billion will be related to IoT.
While the numbers game will remain ongoing, what is certain is that manyof these devices will be consumer gadgets which may bring numerous
benefits to households, but may also threaten consumers’ privacy andsecurity. The sensors packed into Smart Home products – with theirmicrophones, cameras, interface with GPS, not to mention interoperability– are juicy targets for malware attacks. By gaining control over thesedevices, cybercriminals can not only attack other devices on a user’s
network but also spy and gather sensitive and personal data.
A team of enthusiastic researchers at ESET has investigated somethese popular IoT devices such as cameras, scales, sensors and homemanagement systems. This white paper details the research they carriedout and looks specifically at privacy concerns relating to the creation of a

The Internet of Things

basic smart home. Where obvious issues relating to a specific device havebeen found we do, of course, mention them.
As there is no widely agreed definition of what constitutes a ‘smart home’,
we decided to focus our attention, for this white paper, only on IoT devices
apparently aimed primarily at the consumer market.
Arguably, a truly smart home would require a major remodel andsignificant initial financial commitment to create an intuitive andautomatic environment that anticipates and adapts to the changing
lifestyle of the occupants in real time. The attraction for consumers is tosave energy and long-term expenditure while increasing comfort andconvenience.
Alas, this is probably a commitment out of reach for many, or at least fortoday. The smart home for most of us will be a small foray into the worldof IoT, with a limited number of well-placed devices that add convenience,
comfort or novelty. One of the challenges facing even the most basic
implementation of a smart home is interoperability between devices fromdifferent manufacturers to provide a harmonious, unified experience.
Each device provides a feature set designed to inform us about ouractivities or enables us to perform an activity. There are, or shouldbe, concerns about the risks to individuals that arise from possibly
inadvertently or inappropriately sharing data about personal movement
or lifestyle. The sheer volume of such data shared nowadays fully justifies
these concerns.
A single device risk was highlighted recently by Nathan Ruser, a 20 year
old Australian university student who is studying international security
at the Australian National University. In a tweet on January 27, 2018, Ruser
highlighted an operational security issue for military personnel using afitness app from Strava. The app uses GPS location in cell phones to trackroutes for jogging, cycling or other fitness activities. By default, users-3-

allow anonymized sharing of their data so that Strava can produce aheatmap showing popular routes. The example highlighted by Ruser was
the Bagram Air Base in Afghanistan, showing the regular jogging routes
used by US military personnel stationed there. This is a good example of a
popular app collecting data and aggregating it to produce some useful andvery cool output, but in this case raising obvious security issues. Attempting
to find a route to jog when away from home is now simple, but theconsequences to security and privacy are not immediately apparent.

2. THE SMART HOME
Each ‘thing’ in the term ‘Internet of Things’ refers to a device, and there
are many types of connectable device, from cameras, scales, sensors, andhome management systems, all the way to heart monitoring implants tocars or sensors monitoring livestock. The opportunities for interconnection
are endless. For example, San Jose, California, has committed to creating asmart city that they claim will deliver the safest and most inclusive, userfriendly environment for its residents. The project promises to use an IoT
platform employing transit vehicles and an infrastructure of smart sensor
technologies to improve safety, mobility and optimization of the transit
system.
Science fiction writers once envisioned a world regulated via theinterconnected devices used in everyday life. Today such a world is fast
becoming reality. Take, for example, a security camera that starts recording
when a motion sensor is activated and alerts your phone. Already we havea number of devices involved in maintaining a cloud-based service. In
simple terms there is the device, the network to which it is connected, thedevice that controls or interacts with it – most probably a smartphone –and then there is the cloud service that either stores the data from it or isacting as a conduit to deliver the data to the phone. Potentially, one more

The Internet of Things

component, a home management system comprising a master device or
hub might be deployed, providing a single interface to manage connected
devices that provide services around the home.
There are several main scenarios for controlling and communicating with
devices. As consumers, we are familiar with at least two of them: Bluetoothand Wi-Fi. If for example there is a device that only needs to be controlled
locally by a smartphone, then a short-range wireless technology such as-4-Bluetooth or Wi-Fi could be used. In home automation systems where a
hub is used, it is common to find one or more of the Z-Wave, BidCoS and
ZigBee, communication protocols that provides low-latency data transfer
and power consumption lower than Wi-Fi. The hub is then connected
through Wi-Fi or wired Ethernet, allowing connection from remote devices
or cloud services.

The Internet of Things

3. THE PRIVACY POLICY ANDDATA CAPTURE
Each manufacturer should have a privacy policy or similar document
explaining how the data captured by a device, or through its associatedservices, that you use is collected and used. Some of the policies arevague and hard to read and in some cases difficult to locate, while others
demonstrate exceptional efforts by companies to make them readable andunderstandable.
Companies also have a tendency to make privacy policies cover a wider
range of eventualities than may arise in reality, so they may not becollecting all the things stated in the policy. The policies are complex
documents that require considerable legal resources to write, modify andmaintain, so listing everything you might collect is seen as a method of
future-proofing the policy. It does, of course, mean that if you accepted
the policy today, then the company could be collecting the listed data
tomorrow.
We are not questioning the reasons for, or other aspects of, data collection
for this paper; we’re taking a holistic view of the data being collected
overall in order to provide services in a basic smart home. Looking at thequantity and depth of data collected raises concerns that an individual isoversharing unwittingly.
It is understood that most devices and services will collect basic personal
details that may include given name, address, date of birth, email andphone number. The data included for each device are taken from theapplicable privacy policy published by the company concerned. Often
companies use the term ‘but not limited to’, meaning that if they want,they can collect more than what is described on the list.

-5-

When devices are controlled by a service other than the one offered by
the vendors that created the devices, then data could be collected by thethird party service provider as well. For example, the D Link products that
use the cloud service can also be controlled by Amazon’s Alexa. A simple
command such as ‘Alexa, tell mydlink to switch on the garage camera’ maymean that both mydlink and Amazon are aware not only of the instruction,but of what device it operates and how it is used. The consequences of allcommands sent to various devices from different vendors flowing througha single party could add up to greater convenience for the end user, butsome may see this as one entity able to build up a full lifestyle profile on thehousehold and its occupants.

4. VULNERABLE DEVICES
Did we find vulnerabilities? Yes.
We initially chose and tested twelve products from eight vendors: thedetails of eleven products from seven vendors are included later in thiswhite paper. The product that is missing from this paper had significant
vulnerabilities. As a security company we value the commitment to
responsible disclosure and the collaborative nature of the IT security
industry — therefore, we notified the company in question with specificdetails of this device’s vulnerabilities. That device is a home automation
control panel that can manage motion sensors, heating controls, shutter
motors, environment sensors and smart plugs. The device has a number ofvulnerabilities, including:• The login process from the local network is not fully authenticated. The
default option is to allow auto-login, which bypasses the need for standard
credentials such as userID and Password. The manufacturer does mention thisissue in a security alert, and recommends disabling this default option.

The Internet of Things• As with nearly all smart home systems, a cloud service provides thefunctionality to manage the connected devices from one place. The
communications to the cloud service are not encrypted.
• The vendor’s cloud service has the ability to establish a virtual private
network (VPN) connection to the remote devices. Once this tunnel isestablished, it could be possible for the remote network configuration to bechanged. This could result in the users’ local network being accessed without
consent.
• Accessing the cloud service requires registration, but if the user details
become compromised the VPN access to the remote network could present a
considerable risk.
The remaining devices that we tested and detail in this paper demonstrate
the need for research and investigation before making a decision topurchase. For example, the D-Link cameras and the TP-link Smart Plug
have well documented security issues. The main concern with cameras is
the lack of encryption of the video stream coupled, in this case, with weakauthentication.

-6-

5. PRIVACY, THE BIG CONCERN
Are there privacy concerns? Yes.
Each device in the test collected different data to facilitate its functionality
and in most cases the data collected seemed in context with the service
being provided. The Soundmaster Internet Radio, without an obvious
privacy policy and with a lack of any meaningful terms, raised a red flag forour researchers. If there is no stated policy, then no informed decision canbe made.
The most significant concerns are raised by voice-activated intelligent
assistants — in this instance Alexa. A service that acts as a conduit toall other devices and then stores the interactions with them, potentiallycreates a single treasure chest for a cybercriminal. Neither the reputationof the device nor Amazon’s services are in question, but a smart hacker
trying to harvest personal data for identity theft could create a spearphishing attack on individuals to gain access to their Amazon accounts.

There are cameras available that are secure and encrypt the video stream,
both in real-time and when stored. The devices we tested were from arecognized brand, which suggests that ‘name brand’ does not necessarilymean secure, at least where cameras are involved.

he screen images above are examples of the Alexa app’s Smart Home functionality.

The Internet of Things-7-

Alexa – can you be secured? Possibly.

Alexa Terms of Use

If you decide to utilize this polite and obedient intelligent assistant, thenconfigure it with some parameters.

https://www.amazon.com/gp/help/customer/display.html?nodeId=201809740• Require a PIN when purchasing through voice, or better yet don’t purchasethrough voice.
• Train Alexa to know your voice and then limit functionality to only yourrecognized instructions.
• When you don’t need an assistant, switch it off, or at least mute the mic.

6. ESET TEST: THE IOT DEVICES INOUR ‘BASIC’ SMART HOME
a. Amazon
Amazon Echo (2nd Generation)
The Amazon Echo is a hands-free, voice-activated, virtual assistant thatuses the Amazon Alexa service to answer questions or to allow you to givecommands such as to play music, set alarms or to control smart homedevices that are Alexa-compatible.
Seven microphones and noise cancellation ensure that Alexa can hear yourcommands from across a room even when music is playing.
With 360 degree omnidirectional audio it can fill the room with music that
benefits from Dolby processing and dynamic base response.
A growing number of vendors are adding support for Alexa through ‘skills’
which gives the device control of other devices and services to bring
together the smart home into one verbally controlled device.

Alexa enabled products collect and send to Amazon:Your Alexa interactions
Voice inputs
Music playlists
Your Alexa to-do and shopping lists.
Device type
Name
Features
StatusNetwork connectivity
Location
Amazon may automatically update the firmware for certain auxiliary
products on behalf of the applicable manufacturer.
Note: This does not included details of Amazon’s general privacy policy,
only the details of the Alexa service.
Security & Privacy
If you own an Amazon Echo then your best friend may well be Alexa, adevice to which you can pose an unlimited number of questions, as wellas give it instructions and receive polite and prompt responses. Whensetting up a smart home, it is probably a must-have device. The device
can perform a wide range of services both directly or through connections
you approve to third parties, including playing music, reading the news,
checking your calendar and putting together your to-do list, and of course
purchasing things through your Amazon account.

The Internet of Things

The Echo is constantly listening for your commands and is voice-controlled,
sitting dormant until it recognizes the ‘wake word’. This word brings Alexa
to life and allows you to give a direct command or a command tied to askill (see next paragraph). The instruction is transmitted to Amazon foranalysis and a response is generated. These interactions are associatedwith your Amazon account and can be reviewed.
If the interaction is related to a third party – for instance, you are asking
Nokia’s Health Mate app how much you weigh – then Nokia does not
get the audio request, just the request for your weight. To make thisinteraction possible, there is a requirement to connect the third-party
account to Alexa in order to make the information available. This is referred
to as an ‘Alexa skill’.
The audio interactions are stored in, and associated with, your Amazon
account. You can delete them either one at a time in the Alexa app, or inblocks through Amazon’s website. Are users engaged enough to review
what is being stored and to delete anything that may be deemed personal?
Probably not.
The data could be enlightening to a marketer. Your interactions will haveinformed Amazon what products you like to purchase and from whom,
what you listen to, what other connected products you have, and soon. This collection of data enables a profile to be built that potentiallycontains very specific details about your lifestyle – a marketer’s dream, andpotentially a cybercriminal’s too. It is important once again to emphasizethat you are in control and there is nothing hidden here since you can
see the interactions and delete them. Also, if you become too concerned
then you can always switch Alexa off, either fully or by just muting the
microphone.
With data breaches frequently in the news, any voice-activated digitalassistant could be a reason for concern. If, for example, someone gains-8-

access to your Amazon account name and password, they have the ability
to listen to your interactions with Alexa. The depth of information stored in
the interactions could cause embarrassment as well as be a privacy issue.
There are precautions you can take:• Set up voice recognition so only you can use Alexa, which will stop visitors toyour house having fun with it• Delete the recordings of past interactions• Consider not connecting other devices when the data is deemed to be too
personal• Switch off Alexa when you don’t need it• Protect your Amazon account with two-factor-authentication. This prevents
access should your login details inadvertently fall into the wrong hands

b. D-Link
D-Link DCH-G020 Connected HomeThe DCH-G020 is a Connected Home Hub that is a central conduit tolink all of your existing mydlink Wi Fi and Z Wave devices. When used in
combination with home sensors it can alert you when doors or windows
are opened or when motion is detected. With the cloud service mydlink
Home it can simplify setting up a smart home without the need for
additional subscriptions or charges.
D-Link DCH-S150 Motion Sensor
The DCH-S150 Motion Sensor detects motion and can be paired withother devices to take predefined actions, for example, when paired witha camera, video can be captured, or paired with a Smart Plug it could
switch on lighting. Notifications and alerts can be sent to mobile devices or
through email.

The Internet of Things

D-Link DCS-935L Camera
The DCS-935L Camera is a connected camera that can capture clear crisp
images. It boasts 720p HD video quality, night vision up to 16 feet and has
both sound and motion sensing technology. Notifications and alerts can besent to mobile devices or through email. Remote viewing is free throughweb browsers and mobile devices when viewed through D Link’s cloudservice mydlink.
D-Link DCS-2132L Camera
The DCS-2132L provides the ability to directly transmit high quality video
images for security and surveillance or other purposes. It hosts its own web
server and has a built in CPU which means it can be accessed from any
web browser over the internet. The integrated device has infrared for nightvideo, motion detection, a microphone and a speaker.
‘mydlink‘ is a cloud service providing configuration, control and monitoringof all of your compatible D Link devices. Accessed through mobile device
apps or a web browser, it provides a single, central location to view
cameras or to see the status of the smart home network.
Privacy Policy
https://www.mydlink.com/privacyPolicy
Each mydlink product will collect some or all of the following:
Voice
Sound
Face
Temperature
Ambient Light
Humidity
CO2 Levels
Precipitation-9-

Moisture
Noise decibels
Motion from sensors
Utilities usage data
App Settings
Scheduling
Alerts
Notifications
Product location in premises
SSID (Wi-Fi Name)
Wi-Fi password
Audio and Video signals
Amazon Echo Enabled
Yes
Security & Privacy
Communication from a mobile device to the mydlink cloud service isencrypted and the connection between the device and the D Link servers is
also encrypted.
However, firmware updates are delivered by http rather than by https,
which means an attacker could inject malware into the update since thedata stream is not encrypted. Our attempt to take control or change
the operation of the device by creating a modified update resulted in its
failing to be installed. This is evidence that checks on the update package
are taking place despite the fact that the data delivered is not encrypted.
Interestingly, changing just a few unimportant bytes did not stop the
update from taking place.
The cameras included in the ESET smart home test do have weaknesses,
some of which have been documented in other tests. For example, AV

The Internet of Things

Test in Germany tested the D Link DCS-2132L and awarded it only one starout of five, noting a number of significant security issues. One year later
there are still issues, such as basic http authentication and video stream
encryption remains insufficient and reversible, as well as accessible over a
public IP address. However, the camera is controlled from the mydlink app,which is encrypted. But if the video stream itself is poorly protected, thenthe security and privacy concerns centre on the content being captured.
If a camera is used to monitor surfing activity at a beach then it could beargued that reversing the encryption to see how big the wave is would be
a waste of time and effort. However, a camera placed in the home would
have very different security and privacy implications.
It is disappointing that after a thorough examination by AV Test in January
2017, the issues remain largely the same 12 months later.

- 10 -

However, when purchasing a NETAMTO Weather Station, one of the
key buying propositions is the Weathermap (see the link and description
below).
When you use the services, there is automated collection of:
Personal data and measurement
Usage
Your activity with services
IP address
NETAMTO share aggregated anonymized personal data with third parties
Amazon Echo EnabledYesc. NETAMTO

Security & Privacy

NETAMTO Weather Station

NETAMTO provide a Weathermap so you can see the weather in any
location where a device is installed and shares its findings. If you choose tocontribute to the Weathermap then the data from the external sensor will
be shared. Your internal data remains private. If you choose not to sharethen only you will see your device on the map.

The NETAMTO Weather Station has two modules: an outdoor module
provides real time access to weather conditions while an indoor module
monitors conditions indoors such as air quality. Knowing the exact
conditions before heading off to the cabin for the weekend could provevery useful. Through a crowd sourced network of NETAMTO devices, you
can see local condition variances and conditions in other locations.
Privacy Policy
https://www.netatmo.com/en-US/site/terms
The NETAMTO privacy policy is not as detailed as some of the others.
The wording is generalized and is about categories of data rather thanspecific examples of what actual data is collected. This means users may
be unaware of the reality of what is being collected, stored or shared.

If you do decide to share the data from your device, then the location is
specific. Take a look using the Weathermap link above and select one ofthe devices. The street address is shown in the details on the right. The
only thing missing is the house number. Opening a Google map in anotherbrowser window and comparing could potentially enable you to ascertain
the actual address.
Is sharing the address a cause for concern? Yes. Ever received a call sayingthat an issue has been identified with your laptop or Windows? If you have,then it came from one of the many tech support scams designed to charge

The Internet of Things

you for a service that you did not need. Imagine the call being a little
more specific and no longer guessing whether you have a laptop runningwindows and instead the caller asking specific questions about yourweather station. This validated knowledge about what devices are installedat your location may make it significantly harder to detect a fraudulent call.
NETAMTO did have issues with plaintext Wi-Fi credentials being
communicated, back in 2015. They resolved these issues with a firmware
update. Once connected, the device automatically downloads the latest
firmware version from the cloud. While not delivered over SSL, it is encodedusing a proprietary method.

d. Nokia HealthDevicesNokia Health Body+ Scale
The Nokia Health Body+ Scale is far more than a bathroom scale. It canaccurately provide additional information such as body mass index, bodyfat, water percentage, muscle and bone mass. With the Health Mateapp you can track progress and get coaching advice to help reach yourobjectives.
Nokia Health Body Cardio Scale
The Nokia Health Body Cardio Scale adds additional functionality over the
Nokia Health Body+ Scale and can track your cardiovascular health via aheart rate monitor.
Privacy Policy
https://health.nokia.com/us/en/legal/privacy-policy
When you are using Nokia digital health Products and Services, the privacy
policy states that Nokia may need to collect:- 11 -

Identity Data
IP address
Videos and pictures of you
Activity DataYour number of steps
Distance travelled
Number of swimming strokes
Number of calories burned
Type of activity
Level of activity
Sport session time
Body Metrics DataYour weight
MuscleFat
Health rate
Breathing rate
Blood pressure
Environmental Data
Noise level
Light level
Temperature level
CO2 concentration
Positioning and location Data
Amazon Echo Enabled
Yes

The Internet of Things- 12 -

Security & Privacy

Modifying the firmware to downgrade the communications with the scalefrom https to http was successful. The data being transmitted was thenreadable. Even then, though, the data and parameters being transmitted
are not easily ascertained.

Privacy with health-related data should be paramount. Nokia’s privacy
policy states:
Some services may allow you to share your personal data with other users of theservice or with other services and their users. Please consider carefully before
disclosing any personal data or other information that might be accessible to otherusers.
When you look at the personal nature of the data collected, then sharing
may seem inappropriate: however, someone on a drive to lose weight may,of course, be motivated by sharing information on steps walked or weight
lost. In general, once data is shared, even with other family members orfriends, it should be considered to be public, as you have passed control tosomeone else.
The ESET research team took a deeper look at the device because of thetype of data collected, and the team’s actual comment was “the security ofthis device was relatively good”. We set out to attempt to access the data
flowing between either the scale or the Health Mate app and the cloudservice they communicate with and the affiliated cloud service.
It was possible to launch a man-in-the-middle (MitM) attack between the
Android app and the cloud, but to achieve this the Android device needed
to be rooted and a MitM root certificate needed to be installed. As thescale communicates with the Android device and firmware updates aredelivered through the app, the MitM attack allowed us to intercept the
firmware updates. The download is encrypted using SSL, then ultimately
flowing through the Android device to the scales. Modifications to thefirmware could be made and then written to the scales over the Bluetoothconnection, but to do this a setup mode button needed to be pressed on
the scales, meaning you needed to be physically next to them so a remoteattack was not a factor.

In summary, it is highly unlikely to find a scenario where a hacker canaccess the phone, root the device, intercept the firmware download,
rewrite it, then press a magic setup button on the actual weighing scale
and install the new firmware. And if they did, the data they could see ismeaningless without extensive further reverse engineering.
One other curious feature of the scale is a weather forecast. Yes, you arereading this correctly. If the scale knows your location, which is establishedfrom your phone, then a local forecast is available on the scales display
while you weigh yourself. Whether this is a security or privacy risk remains
to be seen, but sharing your location with your scale’s seems out ofcontext.
The biggest risk with the scales is that users might overshare their own
data through social media networks, or that a third party might get accessto sensitive personal information. The third party focused on in this paper
is the Amazon Echo. When linking the Nokia Scale to the Amazon Echo
you can ask Alexa questions about the data stored in your Health Mateaccount. On the Amazon web page that details the Nokia skill and offers
enablement, there is the following statement:
https://www.amazon.com/Nokia-Apps-Distribution-LLC-Health/dp/
B0786NLDBF
Note: Alexa and Amazon, Inc. do not store or retain your Nokia Health data, butvoice interactions associated with your Amazon account may contain your Nokia
Health Mate data.

The Internet of Things

When you link Alexa and grant Amazon permission to access yourNokia Health Mate account, the screen above is displayed. Note that itis specifically mentioned that you are granting Amazon Alexa access topersonal data including weight, distance, sleep and objectives.
When asking Alexa your weight, the privacy policy statement should giveyou confidence that Amazon is not storing the data from your Nokia
Health Mate account. However, they are storing it in the form of voiceinteractions associated with your Amazon account. Remember, if youaccess your voice interactions in the Alexa app then you can see all theinteractions in written form, and you can play the original audio back. You
do have control and can delete these interactions and can optionally review
the accuracy of the Alexa interaction.

- 13 -The issue with placing control back in the hands of the user to delete theseinteractions is that many will not know they are stored and even if they do,then deleting them is a task likely to be both arduous and infrequent.

The Internet of Thingse. Sonos
Sonos PLAY:1 Speaker
The Sonos PLAY:1 is a Wi-Fi-connected speaker that can stream music
regardless of the status of your mobile device. No more interruptions due
to an interruption in Bluetooth connectivity. Combined with an Amazon
Echo or Dot you can verbally control the tune, playlist or radio station thatis playing. Multiple speakers in different rooms can be synchronized to play
the same song or everyone can be enjoying a different tune at the sametime.
Privacy Policy
https://www.sonos.com/en-us/legal/privacy
The policy states that Sonos may collect:
Product type
Controller device typeOperating system of controller
Software version information
Content source (audio line in)
Signal input (example – Dolby)
Information about Wi-Fi antennas
Audio settings
Product orientation
Room names you assign
Tuned using Sonos Trueplay
Temperature of your product
Wi-Fi information (signal strength)
Music services you connect to (for some services login username – but not
password)
How often you use the Sonos app vs another control mechanism- 14 -

Flow of interactions within Sonos app
How often you use physical controls on the unit
Location data when app is in use
Duration of use
Duration of music service use
Product and room grouping information
Command information, play, pause, change volume, skip tracks,
information about tracks, playlist, station container, Sonos playlist, Sonos
favorites
Amazon Echo Enabled
Yes
Security & Privacy
It is important to note that this device is a Wi-Fi-enabled speaker as
opposed to Bluetooth-enabled. This removes the necessity for a paired
device, for example a cell phone, to be in a certain proximity and allows thephone’s audio functions to work independently.
The Sonos or other app that is aware of the device’s existence, broadcasts a
network wide desire to play audio. As the speaker is in permanent listening
mode, it will see this request being broadcast and play the requested audio.
A Sonos account is required to work with the app. The speaker frequently
connects to Sonos servers. There are two connections: one is a permanentconnection while the other is an hourly connection. Both are protectedwith encryption. The permanent connection is not surprising as the speakerworks with Amazon’s Alexa. Asking Alexa to play a track on your Sonos
speaker would require a connection between Sono’s servers and the
speaker so the track can be streamed.

The Internet of Things- 15 -

Sonos’s privacy policy states that interactions with the app and music
services to which you connect are captured. This is to be expected, asnearly all music services offer recommendations on music you may like.

f. Wörlein

The policy also states that room names you assign to the device are stored.
This is understandable as you need to be able to specify what device youwant to play a track on, “Alexa please play ‘Beautiful’ by James Blunt on
the kitchen speaker”. If someone gained access to this data, that could
possibly be an overshare, depending on what you have called the rooms. If
for example you have speakers in your children’s bedrooms, then naming
the speakers using your children’s names may be inadvertently sharing datawith Sonos about the people in your family.

This modern designed internet radio in appealing black lacquer look withpractical carrying handle is the perfect companion for those who arelooking for a radio that leaves nothing to be desired. The internet radio
IR4000SW in white also supports the reception of DAB + and FM PLL radio,
whereby your favorite stations can be stored by preset memory and arethus easily accessible. The device is connected via Wi-Fi to the internet.
In addition, a USB port is add this available. [Description translated fromamazon.de.]There is a new version of the speaker available, the Sonos One. This
combines the functionality of the speaker and the Amazon Echo. The Sonos
speaker in effect takes the role of being an Amazon Echo. In this scenario,
Sonos’s privacy policy is clear that interactions with Alexa are not retainedby Sonos.

Soundmaster Internet Radio IR4000SW

Privacy Policy
We could not find a privacy policy related to the products of the company.
There is a German language privacy policy for visitors to the company
website, here. However, for an English- speaking visitor to the website, thepolicy is still displayed in German. You can buy products in English but notread the policy. There is, of course, Google Translate, but nuances may belost in translation – particularly important for legal documents.
Amazon Echo Enabled
No
Security & Privacy
With no privacy policy, we need to rely on our investigation to understandwhat communication is happening between the device and the internet.
Firstly, when configuring the device to connect to the Wi-Fi network
the password is not obscured once typed so anyone who can visuallyobserve it being configured, can see the password in clear text. If theThe Internet of Things

device is accessible, for example in a public place such as an office or retailestablishment then the Wi-Fi credentials would be accessible by clicking
through the settings. If a company creates products with security by design
as a prerequisite, then a password being displayed in clear text or accessible
without authentication is unlikely to occur.
When selecting a radio station, an instruction is sent in clear text tomediayou.net, which appears to be a portal for accessing online radio
content. mediayou.net will know the IP address of the radio connecting toit, the requested radio station, and the time and duration of listening.
There is no privacy policy listed on the mediayou.net website. Even whencreating an account on the site there was no offer of any privacy policy orterms of use. Researching the mediayou.net domain to establish who owns
it is futile, as the domain details are hidden behind a privacy shield, which isa little ironic.
Without any understanding of what, if any, data may be collected andretained, then you have to assume the worst case: that is, that a company
will collect everything they can and sell it to whomever and however theychoose. At a time when personal data has value and identity theft is a
growing issue, this is an unacceptable situation.

- 16 -

g. TP-Link
TP Link Smart Plug HS110
The TP Link Smart Plug allows you to connect a standard non-smart device
and control the power to it directly from your smartphone. Remotely
switching on a fan, the lights or boiling a kettle without having to replace
the devices with new, smart, connected devices is a cost-effective way tostart a smart home.
Privacy Policy
http://www.tp-link.com/us/privacy
The policy states that TP‑Link may collect:Firmware version
IP address
MAC address
Other identifying information, such as names and images that associate
you with account users
Your location
Devices
ScenesDevice configuration details
Demographic information
Third party account details
Schedules
Audio/Video recordings
Third party device usage, such as when a motion sensor senses motion
Type of device or service information is received from
User configurable device name, group name, location name
IP Address
Location

The Internet of Things

Mobile device information
Amazon Echo Enabled
Yes
Security & Privacy
When we set out to create our basic smart home, we selected devices
by price, availability and a perception of popularity. Taking a device that
may not itself be connected or ‘smart’ and controlling it through its powersource is both cost effective and convenient. For example, you may want toboil a kettle of water without the need to actually visit the kettle. Imagine
that before heading to bed you flip the switch on the kettle to ‘on’ andwhen you wake up you switch on the power to the socket remotely or
through a voice activation service such as Amazon Alexa.
This device has well-documented vulnerabilities that include easilyreversible encryption between the device and the TP Link Kasa app used
to control it, certificate validation issues and potential man-in-the-middle
attacks.
On January 5, 2018, TP Link published a vulnerability statement detailingissues with WPA2 Security due to KRACK. However, KRACK is an industrywide issue and the details were widely disclosed in October 2017 by thetwo researchers who found the flaw. The HS110 is shown in the TP Link
statement as having been fixed if you are running the correct firmware,
which is delivered through the Kasa app.
Searching online for ‘tp link hs110 vulnerabilities’ over 2600 results. The
content of the results page should raise a red flag to a potential purchaser.
In the first few results, ignoring the KRACK items mentioned above, you- 17 -

see terms such as ‘Reverse Engineering the TP Link HS110…’, ‘TP LINK HS110
weak authentication…’ and ‘Hacking TP Link devices…’.
Purchasing an inexpensive device in an attempt to use an otherwise nonconnectable device as part of a smart home may seem like a cost-effective
solution but, as you can see in this case, it is not always without issues.

The Internet of Things

7. CONCLUSION – IS IT SAFE?
Is it safe to create a smart home? Possibly.
At its inception, the goal of this project was to create a basic smart homethat mimics something that could end up in typical household. The concern
from our research team was “what if we don’t find any issues?” What agreat leap forward it would be for IoT if we actually had found no concerns,
and our recommendation to all who feel the need to start building thatsmart home was to ‘go right ahead!’. Alas, this is not the case, and infact the conclusion that I am writing now is different from what I had
envisioned at the start.
No device or software is guaranteed secure or without potential
vulnerabilities. However, companies can be judged based on how they react
to disclosure of vulnerabilities in their products. Some of the devices tested
had vulnerabilities that have been dealt with quickly with new softwareand firmware. Unless such disclosures are promptly acknowledged and thevulnerabilities fixed, choosing an alternate device would be an appropriate
response. By using sound judgement and caution it is possible to startbuilding a basic smart home. Below are the main considerations we would
suggest that you follow before purchasing components or starting out on
this journey.
• Researching potential vulnerabilities before purchasing should be a mandatory
requirement before making a decision. A simple search as per the examples
below will give you an indication if there are known issues.
Device name security vulnerability
Device brand name security vulnerability
Device brand name privacy breach
Device brand name data leak- 18 -• Does the manufacturer update the firmware and can it be auto-updated, orat a minimum, notify you through an app or email? Check the vendor website
or perhaps search online to find the information.
• Read the privacy policy. Understanding what data is collected, stored or
shared will help you make the decision on whether the device should be partof the overall network or kept isolated. And if neither of these is deemed
secure, then of course don’t purchase.
• Use caution when sharing data on social networks or with a vendor’s
own systems. Sharing your location, device and pattern of usage may givecybercriminals enough data to scam you or start a targeted attack.
• Voice-controlled intelligent personal assistants are convenient. They are also
all-knowing. Think carefully how much you tell your assistant, or how muchyou ask it to gather on your behalf.
Each person reading this paper will have a differing view on what personal
information they are willing to disclose, either to a single vendor or to acompany that has an aggregated view. The potential for home, lifestyle,health and even browsing data collected by internet service providers to beavailable to a single entity should only be permitted after due consideration
for the consequences. As companies discover new ways to monetize datacollected by IoT devices, then either the industry needs to self-regulate, orgovernments will need to strengthen privacy legislation in a similar way tothat in which the EU has implemented GDPR.

February 2018

ESET, spol. s r.o.
Aupark Tower, 16th Floor
Einsteinova 24, 851 01 Bratislava
Slovak Republic