359
After 16 years, Ecobee is shutting down support for the original smart thermostat
(www.theverge.com)
this post was submitted on 02 May 2024
359 points (97.6% liked)
Technology
60105 readers
2010 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I wouldn’t be surprised if someone reverse-engineers the protocol and codes up their own replacement backend as a one-file Python script in a weekend.
That truly depends on how secure Ecobee made it… I’ve seen some smart devices that use SSL (https) for all communication and do some sort of certificate authentication, making it virtually impossible to decrypt its communication protocol without a valid private key…
Having said that, it’d be nice if Ecobee took the initiative and opened up these older devices, if they could do so without comprising the security of all their others.
In the last 16 years there's been multiple SSL vulnerabilities, so if someone was motivated enough, they could probably hack it, especially considering they'd have physical access. You could probably even dump out the filesystem and overwrite certificates with your own.
16 years ago was 2008 (which is shocking in itself, I'm old), SSL was seen as very very optional until 2013, when Snowden dropped his CIA/NSA leaks.
I wouldn't be surprised, is the security is "trust me, bro".
Is the firmware enclosed in a SOC with no way of reading/extracting it? If not, if all else fails, someone will extract it and dissect it with Ghidra or something, extracting whatever encryption keys are needed. If so, and there aren’t any documented side-channel attacks for reading the firmware from this SOC, if firmware updates exist, they too constitute an attack surface. (They probably would be encrypted, but how strongly?)