Research: home automation systems are very sensitive to privacy violations

Wireless home automation systems are rarely provided with adequate security and based on intercepted data it is easy to create a profile of the behavior and habits of residents, say researchers at a German university.

The researchers at the German University of Saarland used a mini PC to eavesdrop on the home automation systems of two volunteers to see how much such systems reveal about their users. They found that systems that do not use encryption expose large amounts of data and that an attacker does not need prior knowledge of the system or the user to intercept that data.

“The attacker can analyze the data to obtain system commands and status messages. These are items that tell a lot about the behavior and habits of the resident,” says university security expert Christoph Sorge. “We were able to derive the times residents were not at home and identify patterns for ventilation and heating.” Details about their study have not yet been published by the researchers.

However, systems that do use encryption also give up data. “Based on the message traffic, it is then still possible to deduce when residents are absent.” The researchers point out the risk of attacks on the systems, the privacy risks and the value of the information for burglars. According to him, a lot still needs to be done to make wireless home automation systems more secure.