Smart Home & IoT Device Security

Do it during setup, not later. Default credentials are published in searchable databases, and automated scanners find exposed devices within minutes. This single step removes the cause of most consumer IoT compromise.

The vendor account is what actually holds your camera feed. Give it a unique password from your password manager and turn on two-factor authentication — a passkey if offered. Nearly every "my camera was hacked" story is really a reused password plus a credential-stuffing attack on the vendor's app.

Most routers offer a guest network. Put every smart device on it and your phones and computers on the main one. If a device is compromised it then sits in a room with nothing worth stealing, rather than beside your laptop and network storage.

Then check occasionally that they are actually arriving. A device that has not received an update in two years is not stable — it is abandoned.

Do not forward ports to a camera, and turn off UPnP on your router so devices cannot open holes by themselves. Use the vendor's app or a VPN into your home network instead. Port-forwarded cameras are precisely what public device-search engines index.

Go: open a terminal in a folder you can write to — cd ~/Desktop on macOS or Linux, cd %USERPROFILE%\Desktop on Windows.

Do: save this as defaults.py and run python3 defaults.py.

"""The first thing anyone tries, and how often it still works."""

DEVICES = [
    ("front door camera",   "admin",  "admin"),
    ("baby monitor",        "admin",  "123456"),
    ("robot vacuum",        "root",   "Xk9$mQ2vLp"),
    ("network printer",     "admin",  ""),
    ("smart plug",          "user",   "user"),
    ("NAS",                 "admin",  "correct-horse-battery-staple"),
]

# The list every scanner ships with. It is a few hundred lines long in reality.
DEFAULTS = {("admin", "admin"), ("admin", "123456"), ("admin", "password"),
            ("admin", ""), ("root", "root"), ("root", ""), ("user", "user"),
            ("admin", "1234"), ("support", "support")}

print("%-22s %-10s %s" % ("DEVICE", "USERNAME", "STATUS"))
print("-" * 62)
open_devices = 0
for name, user, password in DEVICES:
    if (user, password) in DEFAULTS:
        status = "OPEN -- factory credentials unchanged"
        open_devices += 1
    else:
        status = "password changed"
    print("%-22s %-10s %s" % (name, user, status))

print()
print("devices on this network :", len(DEVICES))
print("openable with a list    :", open_devices)
print()
print("No exploit, no vulnerability, no skill. The scanner tries the list,")
print("and on four of these it is let in on the first or second attempt.")

You should see: four of six devices opening without anything you could call an attack:

DEVICE                 USERNAME   STATUS
--------------------------------------------------------------
front door camera      admin      OPEN -- factory credentials unchanged
baby monitor           admin      OPEN -- factory credentials unchanged
robot vacuum           root       password changed
network printer        admin      OPEN -- factory credentials unchanged
smart plug             user       OPEN -- factory credentials unchanged
NAS                    admin      password changed

devices on this network : 6
openable with a list    : 4

No exploit, no vulnerability, no skill. The scanner tries the list,
and on four of these it is let in on the first or second attempt.

The real list has several hundred entries and is published, because it is compiled from manufacturers' own manuals. Automated scanners work through it against every address they can reach, continuously, with no target in mind — which is why “nobody would bother with my house” is not a defence: nobody chose your house.

The awkward part is that some devices have no password to change, or one hidden behind a menu nobody opens, or a maintenance account the manual does not mention. Those are the ones step 2 exists for.

If not: if fewer devices show as open, one of the credential pairs no longer matches an entry in DEFAULTS — the comparison is on the exact tuple, including the empty string for the printer.

Go: the same folder.

Do: save this as reach.py and run python3 reach.py.

"""One flat network: everything can reach everything."""

DEVICES = ["front door camera", "baby monitor", "smart plug", "network printer",
           "your laptop", "your phone", "the NAS with the family photos"]

def flat_network(devices):
    return {d: [x for x in devices if x != d] for d in devices}

def segmented(devices, iot, trusted):
    reach = {}
    for d in devices:
        if d in iot:
            reach[d] = [x for x in iot if x != d]          # IoT talks only to IoT
        else:
            reach[d] = [x for x in devices if x != d]      # trusted talks to all
    return reach

IOT = ["front door camera", "baby monitor", "smart plug", "network printer"]
TRUSTED = [d for d in DEVICES if d not in IOT]

flat = flat_network(DEVICES)
seg = segmented(DEVICES, IOT, TRUSTED)

print("if the baby monitor is taken over, it can reach:")
print("   flat network    :", len(flat["baby monitor"]), "devices")
for d in flat["baby monitor"]:
    print("      -", d)
print()
print("   segmented       :", len(seg["baby monitor"]), "devices")
for d in seg["baby monitor"]:
    print("      -", d)
print()
print("The NAS with the family photos moves from 'reachable' to 'not on the")
print("same network'. Nothing about the camera's security changed -- only")
print("what it is standing next to.")

You should see: the same compromised device reaching six things, then three:

if the baby monitor is taken over, it can reach:
   flat network    : 6 devices
      - front door camera
      - smart plug
      - network printer
      - your laptop
      - your phone
      - the NAS with the family photos

   segmented       : 3 devices
      - front door camera
      - smart plug
      - network printer

The NAS with the family photos moves from 'reachable' to 'not on the
same network'. Nothing about the camera's security changed -- only
what it is standing next to.

Home networks are flat by default: everything plugged into the router can talk to everything else, because that is what makes printers and media players work without configuration. The consequence is that the security of your laptop is bounded by the security of the cheapest thing you own.

The fix is one setting on almost every router made in the last decade: the guest network. It exists to keep visitors' devices away from your own machines, which is exactly the job. Put every gadget on it — cameras, plugs, TV, speaker — and keep the laptop, the phone and the file storage on the main one. The gadgets keep working, because they talk to the internet rather than to your laptop.

If not: if both counts are the same, the device names in IOT do not match the strings in DEVICES exactly — they are compared as text, so a single character difference puts a device in the trusted group.

Go: the same folder.

Do: save this as cloud.py and run python3 cloud.py.

"""Which functions survive the vendor switching off the servers?"""

FUNCTIONS = [
    ("turn the light on with the wall switch",      False),
    ("turn the light on with the app, at home",     True),
    ("turn the light on from the office",           True),
    ("the camera records to its own SD card",       False),
    ("the camera records to the cloud",             True),
    ("view the camera on the local network",        True),
    ("the door lock opens with the physical key",   False),
    ("the door lock opens with the app",            True),
    ("the thermostat follows its schedule",         False),
]

print("%-46s %s" % ("FUNCTION", "NEEDS THE VENDOR'S SERVERS?"))
print("-" * 78)
for what, needs_cloud in FUNCTIONS:
    print("%-46s %s" % (what, "yes" if needs_cloud else "no"))

lost = sum(1 for _, c in FUNCTIONS if c)
print()
print("functions lost the day the vendor shuts down:", lost, "of", len(FUNCTIONS))
print("functions that keep working                 :", len(FUNCTIONS) - lost)
print()
print("Note which ones survive: the wall switch, the physical key, the SD")
print("card, the on-device schedule. Every survivor is a function that never")
print("left the building.")
print()
print("The question to ask before buying: what does this still do with no")
print("internet at all? Whatever the answer is, that is what you are buying.")

You should see: five of nine functions depending on somebody else's servers:

FUNCTION                                       NEEDS THE VENDOR'S SERVERS?
------------------------------------------------------------------------------
turn the light on with the wall switch         no
turn the light on with the app, at home        yes
turn the light on from the office              yes
the camera records to its own SD card          no
the camera records to the cloud                yes
view the camera on the local network           yes
the door lock opens with the physical key      no
the door lock opens with the app               yes
the thermostat follows its schedule            no

functions lost the day the vendor shuts down: 5 of 9
functions that keep working                 : 4

Note which ones survive: the wall switch, the physical key, the SD
card, the on-device schedule. Every survivor is a function that never
left the building.

The question to ask before buying: what does this still do with no
internet at all? Whatever the answer is, that is what you are buying.

The row that surprises people is view the camera on the local network. Many cameras route even a same-room connection through the manufacturer's servers, because it is far easier to build than local discovery — so a camera two metres away goes dark when a company in another country has an outage, and the video was travelling to that company all along.

This is a buying decision more than a security setting. Before you buy, ask what the device still does with no internet at all, and whether it works with an open standard — Matter, Zigbee, Z-Wave, ONVIF, or plain local access — rather than only the maker's own app. A device that keeps its core function locally is one you own; a device that does not is one you are renting for as long as the company feels like it.

If not: the two counts are computed from the table, so editing a row changes them correctly; if functions lost reads 0, every boolean was set to False.

Go: the same folder.

Do: save this as lifetime.py and run python3 lifetime.py.

"""How long the device works, versus how long it is patched."""

DEVICES = [
    ("smart doorbell",   10, 3),
    ("IP camera",        10, 2),
    ("smart TV",         12, 4),
    ("smart plug",        8, 2),
    ("wi-fi router",      7, 5),
    ("laptop",            7, 8),
]

print("%-18s %10s %12s %14s" % ("DEVICE", "LASTS (y)", "PATCHED (y)", "UNPATCHED (y)"))
print("-" * 60)
total_gap = 0
for name, lifespan, support in DEVICES:
    gap = max(0, lifespan - support)
    total_gap += gap
    print("%-18s %10d %12d %14d" % (name, lifespan, support, gap))

print()
print("combined years running without security updates:", total_gap)
print("devices that outlive their support window       :",
      sum(1 for _, l, s in DEVICES if l > s), "of", len(DEVICES))
print()
print("The laptop is the odd one out, and it is the only device on the list")
print("people expect to update. The others keep working perfectly, which is")
print("exactly why nobody replaces them.")

You should see: five of six devices outliving their support:

DEVICE              LASTS (y)  PATCHED (y)  UNPATCHED (y)
------------------------------------------------------------
smart doorbell             10            3              7
IP camera                  10            2              8
smart TV                   12            4              8
smart plug                  8            2              6
wi-fi router                7            5              2
laptop                      7            8              0

combined years running without security updates: 31
devices that outlive their support window       : 5 of 6

The laptop is the odd one out, and it is the only device on the list
people expect to update. The others keep working perfectly, which is
exactly why nobody replaces them.

The figures are illustrative rather than measured — support windows vary enormously between manufacturers, and some are excellent. What is not illustrative is the shape of the problem, and it is the opposite of how people think about physical goods: a doorbell that lasts ten years is normally a good doorbell, and here it is ten years of exposure with three years of defence.

So the question to ask before buying is one manufacturers increasingly answer in writing: until what date will this receive security updates? Regulations in the UK and EU now require that period to be declared for consumer connected devices, so it is usually findable on the product page or in the manual. A device with no stated date should be assumed to have none.

If not: the last column is max(0, lifespan - support), so the laptop correctly shows 0 rather than a negative number; if you see one, the max was removed.

Go: the same folder.

Do: save this as checklist.py and run python3 checklist.py.

"""What to do this weekend, ordered by what it costs you."""

ACTIONS = [
    ("change the password on every device that has one",   20, "high"),
    ("move the gadgets to the router's guest network",      15, "high"),
    ("turn off remote access on anything that works local", 10, "high"),
    ("check each device for firmware updates, then yearly", 20, "medium"),
    ("turn off UPnP on the router",                          2, "medium"),
    ("unplug anything you stopped using",                    5, "medium"),
    ("replace a device that is out of support",           None, "low"),
]

print("%-54s %8s %8s" % ("ACTION", "MINUTES", "VALUE"))
print("-" * 72)
for what, minutes, value in ACTIONS:
    print("%-54s %8s %8s" % (what, minutes if minutes else "money", value))

free = [m for _, m, _ in ACTIONS if m]
print()
print("actions costing nothing but time:", len(free), "of", len(ACTIONS))
print("total minutes for all of them   :", sum(free))
print()
print("The guest network is the single best one. Almost every router made in")
print("the last decade has it, it exists to keep visitors away from your own")
print("machines, and that is exactly the job that needs doing here.")

You should see: six actions that cost only time:

ACTION                                                  MINUTES    VALUE
------------------------------------------------------------------------
change the password on every device that has one             20     high
move the gadgets to the router's guest network               15     high
turn off remote access on anything that works local          10     high
check each device for firmware updates, then yearly          20   medium
turn off UPnP on the router                                   2   medium
unplug anything you stopped using                             5   medium
replace a device that is out of support                   money      low

actions costing nothing but time: 6 of 7
total minutes for all of them   : 72

The guest network is the single best one. Almost every router made in
the last decade has it, it exists to keep visitors away from your own
machines, and that is exactly the job that needs doing here.

Two of these need a word of explanation. UPnP lets a device on your network ask the router to open a path from the internet straight to it, without asking you — convenient for games consoles, and precisely how a compromised gadget makes itself reachable from outside. Turning it off occasionally breaks a console feature, which you will notice and can undo; leaving it on is silent.

And unplugging what you stopped using is the most underrated row in the table. The abandoned tablet running an operating system from six years ago, the old camera in a drawer still on the wi-fi, the printer nobody has printed to since 2021 — each is a small computer with no updates, and none of them is doing anything for you.

If you do exactly one thing from this page, do the guest network. It takes fifteen minutes and it converts every other weakness here from “a route to your laptop” into “a compromised plug that can only talk to other plugs”.

If not: the total is summed from the table rather than written in, so adding a row updates it; if the total prints 0, the None entry is being included — the filter keeps only truthy values.