What considerations would need to be taken into account when purchasing a house with multiple smart home appliances?

Question

TL;DR - Sister in law buying a house full of smart junk, she wants to keep it, but is afraid of the previous owner spying on her or gaining access to her home. Can this be mitigated while keeping said smart junk?

---

My sister in law is in the process of purchasing a home that I would love to have -- it's completely decked out with smart devices. Nest Thermostat, Rain Maker irrigation system, it looked like the HVAC registers were electronic, Hue lightbulbs everywhere, security cameras, ip locks, ip garage door openers, honestly just the works. I'm totes jelly.

Unfortunately, since we don't know anything about the installer other than his previous address, we have no reason to believe that any of it is secure. My first instinct would be to ditch all of it in favor of the traditional dumb devices or new smart hardware; but it's not my house, I'm just being consulted because I'm the "tech guy" for my in-laws. Sadly, I know next to nothing about these types of amenities myself other than the fact that the news keeps on bubbling up about hacked cameras and vulnerabilities in them. Is there anything I can do to attempt to ensure the network security while keeping these devices?

I know if I had full control and were dead set on keeping them, I would want them on a different network than my devices, but beyond that I also don't want anyone to be able to access the house or video feed. I'm mainly asking for home automation specific steps. How is this stuff typically controlled, or accessed remotely?

---

_{Note: Of course, the real answer here is "The previous owner had physical access to these devices for who knows how long, there should be no reason to believe they will ever be secure", but my Sister in law, despite the fact that she would never invest in smart equipment on her own (and would make fun of people who do it), just loves the idea of having it.}

Answer 1

That is an interesting question.

You have already given the theorical answer: it is not only your sister-in-law's system but it is the one of the previous owner too. So you can only trust it if you trust him. At one level, security is always a matter of threat, risk, and trust.

I would agree with your sister-in-law in one point: if she trust the previous owner enough to buy him a house, why not trust him to honestly give her full control on the smart devices? On a legal point of view, he must, and could be in trouble is you could prove he has not.

There is a second point though: how secure is the system on its own? I mean, what are the currently implemented security measures to avoid that anybody passing in front of the house can take control of it? I the previous owner was a tech-lover, it may be correctly secured, but it is very important IMHO that you syster-in-law (eventually with your help) understand enough of it to know what she can, must and cannot do to keep it secure. Typically, if you can control everything with a smartphone, how is the smartphone or smartphone owner identified?

It is currently said that the major threat for a computer lies between the keyboard and the chair, and it is often true in security too: most risks can be mitigated except the user if not educated enough to security.

The following is no more than my advice, and I admit I'm not directly concerned here, so please read it only that way. I think that as she trust the previous owner enough to buy him a house, she can trust him to give her full control and not try to spy her. But she must:

• get enough understanding on the full thing to be able to keep it secure
• get enough understanding to be able to control if someone or something has come into the system - this is just a special case of the first requirement, and perhaps the most important, but you can help her on that part

Answer 2

The first thing to ask your self is: If I bought a normal house, would I change the locks?

If so then change the locks. Then put everything else on its own network, behind a good firewall. Add secure proxies to anything that needs remote access, treat it as un-trusted.

Another, security, concert is to ensure that you don't get locked out.