How hackers could use smart home devices to spy on you (Marketplace)

How hackers could use smart home devices to spy on you (Marketplace)


[ ♪♪♪ ] -[ Makda ] Let’s talk about
who’s watching you. High-tech break and enter. -Attention, Johanna and Peter,
your home is being attacked. -[ Makda ] What you need to
know to beat the bad guys. This is your Marketplace. [ ♪♪♪ ] -[ Makda ] we are travelling to
a small town in southern Ontario to deliver
some disturbing news. -[ Makda ] A family who lives
here is being watched by the whole world, and
they don’t know it. Here they are
renovating their front porch. And here again, sharing more
intimate moments on the back deck, captured by their
own security cameras, and broadcast over the
Internet for all to see. Anyone can keep an eye on
their comings and goings. That’s how we’ve
tracked them down, through their license plate. You can even watch
on their cameras, as we arrive to alert
them to what we’ve found. -Hi.
-Hello. -How are you?
-Good, thanks. Good, are
you the homeowner? -I am. -My name is Makda. I’m with the CBC.
-Mmm-hmm. We’re kind of here
for a strange reason. It has to do with
your security cameras. -Okay. -[ Makda ] I don’t know
if you realize this, but those cameras are actually
broadcasting on the Internet. -Really? -[ Makda ] Yeah.
So– How would you know? That’s what brought
us here, actually. We wanna show you what we found. Really? Yeah, we can show
you what’s happening right now. -Wow. Okay. -[ Makda ] You see
that right there? -And you can just get that? -[ Makda ] That’s right, yeah. This is what’s
going on right now. What do you think about that? I don’t like that at all. -[ Makda ] You had no idea
that this was possible? -No. -[ Makda ] How long have
you had those cameras up? -Six months, maybe.
–Six months. -Yeah.
-Where did you get them? Through Amazon. I ordered them, just online. They were just a
plug-and-play system, so it was easy, no wires. Everything was wireless
through your Internet. I didn’t realize that anyone
could have access to that. -[ Makda ] In truth, everyone
can have access to that. On this website, that searches
out and shows security cameras, that are using
default password settings. Toronto, Chatham, Medicine
Hat, we’ve got a house here in Mississauga. Over here we have
one in Vancouver. There are tens of
thousands of them, streaming from across
Canada and around the world. And people don’t know that
these cameras can be accessed by anybody. The website says its just trying
to expose security issues. But these homeowners are
the ones being exposed. Look at this. They’re putting
together a puzzle. I can almost see– [ Gasps ] Wow. Clothes on the chair. Wait a second. Oh, my gosh, I can see her. [ ♪♪♪ ] -[ Makda ] Over the next several
weeks we try to figure out where exactly these people live,
so we can warn them. And as we search for clues, we
find more private moments… By the pool, in the kitchen,
even upstairs near their bedrooms–moments not
meant for public viewing. And then one day… So, we’ve been looking for
clues and today we got a hit. See this right here? This is the first time that
we’ve been able to make out a license plate. By searching the license
plate and various websites, we narrow it down to an address. But is it the right one? There’s a pole here. You can see a light pole. Let’s go back to the video. You can see this here. Which seems to match the
Google Maps Street view of this address. We’re going to their house and
we’re going to tell them what we’ve been seeing and
what other people can see. We’re heading down the
highway, days later, when we think someone’s home. And once again, our arrival
is being broadcast over the Internet. Hi. -I’m Makda with the CBC.
-Yes. And the reason why
I’m here, it has to do with your
security cameras. I don’t know if
you realize this, but those security cameras
are actually broadcasting on the Internet. -Oh, I didn’t know that. -[ Makda ] The homeowner
wants his identity protected, even though his life has already
been watched around the world. We’re about to show him how. You can see here
it’s a bit of a delay, but then… I’m just going to… -Well, that’s no good. See,
that’s us right there. Mmm-hmm. -[ Makda ] And these
are your cameras. Did you ever think that
something like this was possible? -No, no. And how long
have you had these cameras? February. Okay, can I ask, why
did you think of getting them, and setting them
up around the home? I have teenage kids and I
wanna see what’s going on in my home, especially when
I am away travelling. So, you got them
for the safety of your family? Yeah. And you never
thought something like this, that anybody could just
look into your house? No. -[ Makda ] He struggles to
process the information. Steps he’s taken for security
may actually be causing harm. And what exactly
have people seen? -I mean I have a pool, I come
in and out and this and that. If my kids aren’t around I don’t
need to change or whatever, you know? It’s just–
privacy’s blown already. I don’t know how
you make that right. How are you gonna
have the conversation with your family about this? I’m not sure. Not sure. It’s quite
upsetting and disturbing. I’m not gonna lie. That’s the privacy of my
home being invaded, right? -[ Makda ] Knowing that these
cameras are playing for anyone to watch, if we figured it out
it doesn’t take much for anyone else to figure it out. Well, I’ll be disconnecting
them as soon as I go back in. -[ Makda ] So, how did the
privacy of these homeowners get so violated? We do more digging. -We have a delivery. Professional Video Security. -[ Makda ] This camera system
is the same type used by both families. It’s sold by a
company called OOSSXX. -Let’s get these positioned
so we can spy on you while you work. -[ Makda ] Oh, that
just sounds great. -So, what’s this one? This one’s the bottom right. -[ Makda ] Set up
is relatively easy. But when it comes to
connecting it to the Internet, the problem becomes clear–the
system does not require you to set a password. The default factory
setting password is empty. This means you do not
need to fill out a password. -[ Makda ] Username, admin. That means once it goes online,
other people could access your cameras too, and
there are no warnings. Okay, that’s the problem. We ask OOSSXX why it doesn’t
insist on a password like some other companies do. But they wouldn’t
answer our questions. [ ♪♪♪ ] -[ Makda ] More
smart home secrets. -What was that? -[ Makda ] And testing
some of the top brands. -I kind of like having the
different security cameras so you know what’s going on. -[ Makda ] Will this family pass
a home hack attack? Get more Marketplace. Sign up for our
weekly newsletter at cbc.com/marketplace. [ ♪♪♪ ] -[ Makda ] This is
your Marketplace. [ ♪♪♪ ] -[ Makda ] Across Canada,
homes are being transformed, by so-called smart devices
that promise to make things more convenient, and more secure. It’s automated control of
everything from our lights and locks, to our TVs
and temperature. -Alexa, set the
thermostat to 23. -Okay. -Alexa, kitchen light on. -Okay. -[ Makda ] In Canada alone,
more than 100 million of these devices are now
connected to the Internet. But there is a downside. Many people don’t know how to
secure their smart devices, allowing hackers and pranksters
to invade their homes, and their privacy. [ Screaming ] -What was that?! [ Screaming ] -[ Makda ] This woman is
terrified by the 21st century version of a crank call. -I can see you. -[ Makda ] Whoever’s controlling
her camera can also communicate with her. [ Screaming ] -[ Makda ] Even little
babies fall victim. Traumatized at night by someone,
who’s taken control of the baby monitor. The dark side of all this
new technology might not occur to most. -Yeah, that’s the indoor. -[ Makda ] Johanna Kenwood and
Peter Yarema think smart devices are both cool and convenient. -I love it. I think it just makes life so
much easier. -[ Makda ] But they’re
looking for security, too. -And that’s why I kind of
like having the different security cameras, so you know
what’s going on. -[ Makda ] So they’re careful
to pick top brands that promise security as a priority. Cameras by Nest. And a new lock by
Schlage for the front door. It’s connected to a
central hub made by Wink. All of the devices are
controlled by apps on their phones, or by their Amazon
personal assistant. Thermostat is off. Yeah, I wanna
get more of them, just spread them out a little
bit more so I can actually walk through the house and have
all the different ones going. -[ Makda ] But could
devices like these actually make us
more vulnerable? We’re about to find out.
-Park right here. -[ Makda ] This van is carrying
three white-hat hackers. Arsenii, Chris, and Michael work
for a company called Scalar. Make sure the
wireless packets– -[ Makda ] Businesses hire
them to test their security, to find weaknesses
before the bad guys do. Here we go. -[ Makda ] Johanna and Peter
have agreed to let these guys do whatever it takes
to hack their home. Okay. -[ Makda ] It isn’t long before
they figure out a key component. -Here we go.
There it is, guys. Nice. -[ Makda ] They crack the
password to the home’s Wi-Fi network. -Free Wi-Fi, everyone, now–
-[ Makda ] And then discover it’s the same password used by
Peter to control the thermostat. All right, connected! -[ Makda ] But to
get full control, they decide they need
Johanna’s password, too. Back at headquarters, they
create a phishing e-mail. It’s a fake, designed to
trick Johanna into revealing her password.
Oh, she has opened it. Message has been opened. -[ Makda ] If she clicks
on the link they sent, they’ll be able to control just
about every smart device in her house. The waiting game
doesn’t last long. Here we go. We’ve got credentials, awesome! -[ Makda ] And just like that,
they’re ready to hack the home. [ ♪♪♪ ] You can only see us
when we want you to. -[ Makda ] Don’t let
this happen to you. That’s pretty terrifying that
they’re able to get into so many devices. -[ Makda ] How to fight
back against a home hack. Do you have a story you
want us to investigate? Write to us, at
Marketplace at cbc.ca. -[ Makda ] This is
your Marketplace. [ ♪♪♪ ] -[ Makda ] We’re inside
a home in Oakville, Ontario, filled
with smart devices. What is it that you
guys like about having these smart devices?
-Convenience. Just some of the simpler
things, your hands are full, you need a light on. I like the security. I like being at work and having
the notifications going off and knowing what’s going on at my
house while I’m away from it. -[ Makda ] But outside,
three guys in a van, who have a point to
prove about that security. They’re going to try to hack it. Good to go. Let’s take a look. Let’s see what we have. -[ Makda ] Do you guys
have a favourite device? That’s a good question. I’m gonna say it’s probably
the inside camera, just so I can see the doggies
and see what’s going on. -[ Makda ] Okay,
what’s going on? Did you guys see that just now? Attention, Johanna, Peter,
your home is being hacked! Well, that’s surprising. -[ Makda ] Did you expect that? No, not the Nest camera,
’cause they usually– they’re supposed to be
the top-of-the-line, most secure out there. -[ Makda ] He just talked
to you through that. I know. -[ Makda ] And did you see
what was going on behind us? Yeah. It’s time to turn
up the heat in here. Check your thermostat! Well, our AC’s just been
put up to 32 degrees. [ Laughter ] So, it’s gonna
get hot in here. -[ Makda ] What do
you think about that? That’s pretty terrifying,
that they’re able to get into so many devices, especially–
I’d say more so the living room camera, I think. ‘Cause that’s, you
know, it’s our home, it’s the inside, we
have a child in here, and to know that
someone can get into it… -[ Makda ] Outside in the
van, they’re not done yet. Things are about to get
even more disturbing, as our hackers show some real
damage they can do when they target this personal assistant. Alexa, order a 4K TV. I’ve added a Samsung 4K
TV to your shopping list. -[ Makda ] Now what if
someone could actually do that? I wonder if they have access
to my full Amazon account, which has my credit
cards, my bankcard. Everything’s on there. -[ Makda ] And what if they do? I guess I’m gonna
be really broke soon, owe a lot of money. -[ Makda ] Did you guys– Wanna see what
we’re up to outside? Have a look at
your security camera. -[ Makda ] What’s going on? Doesn’t wanna load up. Oh, there it goes, offline. -[ Makda ] Your
camera’s off-line. Yup, so if I was at work
and someone was coming on the property,
I’d have no idea. You can only see us
when we want you to, and that time is now! -[ Makda ] So, he said you
can only see us when we want you to see us. That’s so creepy. -[ Makda ] You said it’s creepy. Why? What’s that?
-That’s our front door lock. That’s our front
door lock, yeah. I’d say that one’s the more
troubling of any of them. And unlocking. I feel unsecure now. [ Laughter ] Hi, guys. I just let myself in. My name is Arsenni and we’ve
just compromised your house. -[ Makda ] He just
unlocked your lock. He walked in here. How are you guys
feeling right now? To be honest, a
little terrified. -[ Makda ] Why? I’m gonna say especially
if I’m not around, we do have animals and
we do care about their well-being and, you know, we
don’t have the fanciest things, but, you know, you
just feel invaded. It’s your stuff. It’s your home. -[ Makda ] Arsenni says his team
could have done a lot of damage if they really wanted. Like, you saw us, we could knock off the camera,
come over and opened the door, grab a package or
whatever, and leave. -[ Makda ] What advice
do you have for them? How can they make sure
to secure their devices? Well, for one, change
your passwords. You want to have different
passwords for each one of your online accounts. Make sure you have extra secure
passwords for critical stuff like your e-mail or, say,
Nest camera, because the Nest camera is a real
window into your life, right? It really is. -[ Makda ] Strong
passwords are a must. The longer, the better–
at least 16 characters. In fact, try using
a password phrase, three or four words that
don’t mean anything together, but you’ll remember. Or use a password
manager that generates and remembers passwords for you. As for the makers
of smart devices… Did someone log in? Is it a suspicious login? Is it not your home IP address? -[ Makda ] Arsenni would
like to see some changes. What can the manufacturers do
to make things more secure? The main things that they
could implement would be use of two-factor
authentication, because, you know, having just a password
as the only thing that protects your smart home is not enough. -[ Makda ] Two-factor, or two-
step authentication is already offered by some companies,
like Apple and Google. When you log into your
account on a new device, they ask for a special code
that they send to your phone, confirmation it’s really
you and not someone who stole your password. We ask the makers of Peter
and Johanna’s devices about two-step authentication
and why it’s not required. Amazon and Nest both say
they have that option and encourage people to use it. Schlage says its locks just
took orders from the Wink hub. And as for Wink, after we
share the results of our investigation, it
announces a big change. Wink is now, “Taking
immediate steps to implement two-factor
authentication.” Meantime, our homeowners
are taking steps, too. Those unsecured cameras
were quickly unplugged, and are no longer open
for the world to see. Peter and Johanna say
they’ve learned a thing or two. How are you guys
feeling about this? You’ve got these devices because
they were cool and convenient. And they were
supposed to be secure. -[ Makda ] Do you
feel that way still? Not really. -I’d probably take the door
lock off the Wi-Fi and just keep it as a keypad. -[ Makda ] Any other
changes you would make? Definitely passwords. I think that will be the first
thing after you guys leave. Everything’s gonna get changed. [ ♪♪♪ ] -[ Charlsie ] Undercover
safety spot check. Oh, my gosh.
Oh, my gosh. That baby’s like
nine months old! Kids just don’t know
that it’s not safe. We are seeing injuries that
are occurring at speed and force that we would
not normally see. I asked her to stand up
and that’s when we realized that she couldn’t stand up. -[ Charlsie ] We visit
trampoline parks across the country, in Ontario,
Alberta, Nova Scotia, and BC. It’s an unregulated
industry no one is watching, until now.

100 thoughts on “How hackers could use smart home devices to spy on you (Marketplace)

  1. Such naive sheeple! the government wants you to have these things in your house so they can watch you. CIA and DARPA started Google and Facebook how naive people are that's what's scary they want us-2 think the government is our friend! Scariest part of all is most people actually do.

  2. my body can watch anybody from there front door ,if they have a "ring door bell" with a camera! if u can watch it from your cell phone ,every one can watch it from there phone!

  3. Electronics have always been this way…….don’t be lazy, lock your own door, sleep with a gun under your pillow.

  4. NOTHING that a piece of masking tape can't handle , and then cut off a old headphone ear connection piece and place that into the (your) extension headphone of your cellphones to redirect and stop remote use of the built-in phone speakers…and that's all you really need to know other than Not putting all your personal information about yourself and family on the internet, as they want you to to keep and store 'ALL' . Just don't let them, screw them; And let them go straight to Hell !

  5. UPnP. Right now I am in a rental with internet included. I have control over my router when I have the net set up and it does bother me that I am unable to atm. I once had my wifi named Neighborhood Webcam Viewer and it was purely a joke for the people living nearby lol but I think the ones across the street took it seriously as they had a visit with a company that had defence against HACKER across the side of the van, the guy was laughing when he walked out of their house too. I couldn't hack my way out of a wet paper bag

  6. That's what the movie Enemy Of State with Will Smith was getting us ready for and The Truman Show and many other movies Hollyweird gave

  7. I've been hacked before this way…it was horrible…These bastards I knew pulled that shit..I know comments should be kept respectable..Ah NO..IF I SEE ANY OF THEM IM GOING TO PRISON. Wtf…This is why I TRUST NO ONE

  8. grow up kids get rid of your toys i don:t even have a cellphone grown men playing video games shame on you grow up kids start being men not boys and little girls

  9. I don't get why they're laughing at everything. What about not using Wifi? It's bad for you anyway. Use cables and change your passwords.

  10. So basically people that are using cameras and other automation are too lazy to secure their login smart devices with a new user name and password

  11. jeez she made mistake to say everything is on Amazon ..really? you just told you house is hacked and you give info like that 1 min later out 😂

  12. This is why I stay wired for most devices and will NEVER purchase a home (or motor vehicle for that matter) with such hackable/privacy invading features. I find it insane that people are forking over soo much money for devices, services and other products that are inherently designed (or as a byproduct) to invade one's privacy. It's nutty.

  13. Bruh we should all know that the FBI and government look throw are cameras 🤷‍♂️

    That’s why I have tape on the camera

  14. I was hacked once then i contracted a prof hacker twice — i was lucky the second time he was so much better bcs we managed 2 turn the table 😁weVe got ALL this information abt this sick person
    Since that day he couldnt hv anything NOTHING unless hes being declared DEAD & have his new identity😂so do i — im using
    someone elses identity bcs i TRUST no ONE !!! Too many sick ppl around to take a chance!!😂😂

  15. Get one important camera that watches the outer perimiter for your web viewing and leave the other camera system off the grid of course while having a police contacted burglar system

  16. Your home has been hacked…😂😂😂😂what a crazy answer..,🤦‍♀️🤦‍♀️🤦‍♀️🙅‍♀️🙅‍♀️

  17. WOW ‼️. All of these gadgets with cameras etc……are nothing , but tracking devices! GPS’s!! Imagine the government being able to watch you as well. 😳

  18. Thats why its important to make accounts with good passwords aswell as secure cameras from beeing active inside house when phone connects to home.

  19. They have have too security but also had the top hackers to hack into to! But people shouldn’t worry about because the average American isn’t this smart or Capable of doing this!

  20. This is truly scary but the reality into the Downside of what should be
    Technological breakthroughs instead
    it's seemingly ways to Break in.
    It's Why I Question Everything.
    A.I. Will someday override, malfunction
    and Turn on man… And the very People
    who created and programmed the
    Artificial Intelligence software &
    hardware will be at their Mercy and
    It just may be too late.
    My thought is if Hackers can do this
    Who's to say they may not one day
    Gain full access to some very dagerous
    Machinery, Robots, Nuclear Facilities,
    Power Grids, Etc and decide you know
    what, let's have some "not so Fun"
    Dear God Please Bless Us and
    keep us.
    Amen

  21. Wasn't that a huge webcam scandal from 2005 to 2010? Famous magazines had promoted that leak and had provided detailed search strings. There were thousands of cameras accessible, from home webcams, business webcams, university webcams to very critical locations (which ought not to be disclosed) – worldwide, mainly concerning the USA, Canada and European countries. It was different webcam companies.

  22. There’s probably have to do with the government they’re trying to watch people that’s my Pinyan I’m glad I found you I have cameras to thank you and thank you thank you thank you for let me know there is no password on mine either I just the camera you hook up to the TV I’m up at the same way or not I have no idea but thank you because I don’t trust our government or anybody else

  23. In college I wanted to study this type of education but I changed when I realized that cheating and stealing people's property is not good for me. But now I'm engineer.

  24. urg… the reporter/girl is so dramatic and talks in such annoying way..no wonder why alot of them wont answwer back lol

  25. Smart people :- we want security and privacy
    Also
    Smart people :-
    1) let's install smart home speaker that listens to us all the time.
    2) let's install smart cameras that anyone can hack or even worse broadcast it live online without our consent.
    3) let's install smart door lock that's connected to WiFi so anyone can hack it easily.

  26. My wireless backup camera on my car picks up video from security cameras I pass by .They have only been outdoor cameras so far !

  27. Okay so I'm watching this documentary and at exactly 10 minutes and 27 seconds my Google home activates on its own I did not activate it. I rewinded video to try it again and it happened 10 minutes 27 seconds. Freaky.

  28. 2 Factor is useless against someone who has SS7….Someone with enough knowledge can reroute your text messages so they receive the 2FA code on their device and you never get notified.

  29. I have teenage kids so I buy cameras to spy on them. Wtf? What about raising your children right so you don't have to spy on them you nitwit!

  30. Put them outside your house, not inside. Now your giving a hacker your schedule, your children's schedule, perhaps what time your alone, and when you normally take a shower..

    What good is a camera when someone's wearing a mask??

  31. My best friend link me up!!! I never thought this was real until i first made my $35,000 hack transfer from forbesfamilyweb ,net just to start up a new business

  32. What website she uses to see the cams? If everyone decide to help their closest neighbor, we could stop this asap!

  33. The alleged United States corporation companies invade your privacy everyday since the patriot act that is not law you are all in a human zoo.

  34. People have become very lazy and have given strangers the accountable for their lives. Even when given the option to choose high level passwords consumers opt for what is easy. Becoming desensitized to the simplest things for example like the light that turned on and off . Concluding the their are weak spots in the company devices and consumers putting so much trust in a “thing” they can’t even function.

Leave a Reply

Your email address will not be published. Required fields are marked *