The Vunerability of Old Internet Devices

Today almost everything connects to the Internet, from garage door openers to coffee makers. As these devices age and are not updated they become a possible vulnerability that can be exploited by an attacker.

Most devices are only supported for a couple of years after they are sold. Any vulnerabilities discovered after that are not fixed. This means that an attacker could easily compromise the devices as they are no longer patched when vulnerabilities are found. Once a hacker is inside your network many devices consider them a trusted source. They could issue commands to a connected teapot or coffee pot telling it to brew. Many times these devices will follow issued commands even though there is no longer any water leading to a fire hazard.

One option would be to replace all of your Internet connected devices when they are no longer supported. This would mean throwing out a device that is working perfectly fine, because the company is no longer updating the software that runs on it. Another option would be to disconnect the device from the Internet after it is no longer supported. Change the WIFI password so it no longer is able to connect to the network or black it at the router level via the MAC address.

If you block the no longer updated device from the network, it reduces the attack surface for an adversary. The device will no longer connect to the Internet, but a bed or garage door opener connecting to the Internet is not important.

I never thought I would use a garage door opener connected to the Internet, but I have found several instances where being able to control the garage door opener remotely was helpful. I discovered that it would allow me to feed my dog remotely. If I left the food out he would eat it immediately, but if it was in the garage I could open the door at the appropriate time and he would not notice an appreciable difference. When my pet sitters could not find the key it was another way to let them into the house. 

When the Internet connected devices are no longer supported, they become a liability. If the site that they check for updates is no longer used, it could be taken by an attacker to install any software on your devices. Most router/firewalls only check incoming traffic, so if the Internet device originates the software update, there will be no check.

If the device is a television streaming device, it will not work disconnected from the Internet, so once it is no longer supported with updates it is probably a good idea to buy a newer model. However, if the device is a garage door opener, it does not really need to be connected to the Internet, so changing its WIFI password so it no longer can connect to the Internet is probably a good idea.

The safest option is to replace everything once it is no longer supported, but that means throwing away working hardware. If the device can meet your needs without being connected to the Internet changing the WIFI password or blocking the MAC address are reasonable options.