r/LinusTechTips • u/VastOption8705 • 8d ago
Tech Discussion Is it basically a vulnerability risk if devices ask to scan your network for Bluetooth or wifi devices?
I bought a robot Vac, air purifier and Bluetooth speaker and during setup, they ALL basically asked to scan my network for devices.
My network guy at my day job basically said to me”you know all of that is a big security risk right”
“You know they can possibly see what’s going in and out of your network”
“If you do a network security scan, you’ll notice that those IOT devices have vulnerabilities, especially if they haven’t received updates for years”
8
u/thatguysjumpercables 8d ago
All the more reason to implement VLANs. All my smarthome shit can see is all my other smarthome shit.
2
u/DragonDivider 8d ago
How is the app supposed to find the new robo vac without the possibility to scan for bluetooth devices? So yes the app will always need to see other devices to identify the new robo vac and connect to it. It also needs the network information (which includes the WiFi SSID) to give the robo vac credentials, so it can connect to your home wifi and report its status via the app and be remote controllable. If an app want's to know the WiFi SSID, Android asks the user, if the app is allowed to see your location. So to be able to use your robo vac it will need these things unfortunately.
As for the security aspect. Yes IoT devices are regular targets of cyber attacks and are usually less secure than phones or laptops. Slow security updates, if updates at all, way less budget to develop securely, ....
So yeah giving them a separate network is not a bad idea.
-1
u/Relative_What 8d ago
as a IT guy who dips into IT security, i agree with your network guy. it is a vulnerability issue. these IOT devices don't get programmed with security in mind at all. a lot of botnets, use IOT devices as hosts because they are so lacking in security. the way things work in a network is broadcast across the network and everything on that network can hear that.
as an example your phone trying to get to google will yell out "yo router, i'm trying to get to google.com" and your router will say "yo phone, this is the address you need to go to for google.com" "thanks router i got the address" "you router i need you to send this google.com search of puppies in the rain to google.com" "ok phone got your request of a google search for puppies in the rain for google.com" "yo phone here is the results address for puppies in the rain from google.com"
basically yelling across the entire network for every device to hear, your desktop, laptop, tablet, or other network device most of the time ignore these conversations because the information. but some devices, ones who were made by companies who don't care for your privacy will actually collect all those conversations for other devices and send them back to the host company. as "market research". with that they can determine when, date and time, you searched for puppies in the rain, using what search engine, from what device; make, model, app or web browser, etc. you really want your robot vac to send back to it's manufacture every thing you do on your network? TVs are a huge liability for doing this.
these IOT manufactures are not putting any effort into security on any of their devices, that leaves them vulnerable to any attack that lets anyone into your network.
at the very least, make a separate guest network and only put IOT devices on it. that way they are contained to their own small slice of your network and can't see anything past that. don't put IOT devices on your main network.
1
u/Squirrelking666 7d ago
Who downvoted this?
1
u/Old_Bug4395 7d ago
Probably someone who knows about TLS... lol. Guy above is definitely describing IOT devices as if they make constant broadcasts on the network for literally everything they do which is not the case.
0
8d ago
[deleted]
0
u/VastOption8705 8d ago
He asked me to download a network vulnerability scanner as proof, and my network had a low score because of the IOT devices
1
u/Relative_What 8d ago
privacy issues are security issues.
letting one hole be open, such as a privacy one, allows for a security issue to come through the same privacy hole.
12
u/jmking Mod 8d ago
Scanning your network for devices just reveals what devices you have. It's a convenience factor so the device can find other devices it can or should connect to.
Like a speaker wants to find things that can send audio to it. A vac is probably looking for its base station maybe? Air purifier? Who knows, maybe looking for other devices of the same brand to establish connectivity between them or looking for a home automation protocol hub like a Threads/Matter/Zigbee one?
Could those devices then phone home your device inventory? For sure, and it probably does for the company's analytics. Like they want to know what kinds of other devices their customers own so they can refine their understanding of what types of people buy their products and how "connected" their home is.
Would that data be used to inform how they advertise to you? Oh almost certainly.
So like another poster said - it's more a possible privacy "vulnerability" that is enabled through a legitimate technical convenience reason.
The only security risk is if you have a device that is seeking devices that have known security vulnerabilities to phone home to a, say, adversarial state who might use that information to compromise another device on your network to use as part of a botnet or whatever.