Global PR Manager, IOActive, Inc.
T: +1 206 784 4313
IOActive Lights Up
Vulnerabilities for Over Half a Million Belkin WeMo Users
home automation devices are wide open to attackers
Seattle, US ―
February 18, 2014 ― IOActive, Inc., the leading global
provider of specialist information security services, announced today
that it has uncovered multiple vulnerabilities in Belkin WeMo Home
Automation devices that could affect over half a million
users. Belkin’s WeMo uses Wi-Fi and the mobile Internet to control home
electronics anywhere in the world directly from the user's smartphone.
Mike Davis, IOActive’s principal research scientist, uncovered multiple
vulnerabilities in the WeMo product set that gives attackers the
Davis said, “As we connect our homes to the
Internet, it is increasingly important for Internet-of-Things device
vendors to ensure that reasonable security methodologies are adopted
early in product development cycles. This mitigates their customer’s
exposure and reduces risk. Another concern is that the WeMo
devices use motion sensors, which can be used by an attacker to
remotely monitor occupancy within the home.”
The vulnerabilities found within the Belkin WeMo devices expose users
to several potentially costly threats, from home fires with
possible tragic consequences down to the simple waste of electricity.
The reason for this is that, after attackers compromise the WeMo
devices, they can be used to remotely turn attached devices on and off
at any time. Given the number of WeMo devices in use, it is highly
likely that many of the attached appliances and devices will be
unattended, thus increasing the threat posed by these vulnerabilities.
Additionally, once an attacker has established a connection to a WeMo
device within a victims network; the device can be used as a foothold
to attack other devices such as laptops, mobile phones, and attached
network file storage.
The Belkin WeMo firmware images that are used to update the devices are
signed with public key encryption to protect against unauthorised
modifications. However, the signing key and password are leaked on the
firmware that is already installed on the devices. This allows
attackers to use the same signing key and password to sign their own
malicious firmware and bypass security checks during the firmware
Additionally, Belkin WeMo devices do not validate Secure Socket Layer
(SSL) certificates preventing them from validating communications with
Belkin’s cloud service including the firmware update RSS feed. This
allows attackers to use any SSL certificate to impersonate Belkin’s
cloud services and push malicious firmware updates and capture
credentials at the same time. Due to the cloud integration, the
firmware update is pushed to the victim’s home regardless of which
paired device receives the update notification or its physical location.
The Internet communication infrastructure used to communicate Belkin
WeMo devices is based on an abused protocol that was designed for use
by Voice over Internet Protocol (VoIP) services to bypass firewall or
NAT restrictions. It does this in a way that compromises all WeMo
devices security by creating a virtual WeMo darknet where all WeMo
devices can be connected to directly; and, with some limited guessing
of a ‘secret number’, controlled even without the firmware update
The Belkin WeMo server application programming interface (API) was also
found to be vulnerable to an XML inclusion vulnerability, which would
allow attackers to compromise all WeMo devices.
IOActive feels very strongly about responsible disclosure and as such
worked closely with CERT on the vulnerabilities that were discovered.
CERT, which will be publishing its own advisory today, made several
attempts to contact Belkin about the issues, however, Belkin was
Due to Belkin not producing any fixes for the issues discussed,
IOActive felt it important to release an advisory and recommends
unplugging all devices from the affected WeMo products.
IOActive Labs released its own advisory outlining the affected
products, the impact, and the solution.
At IOAsis, which is being held alongside the RSA Conference next week,
IOActive experts will be on hand to discuss best practices on how users
and manufacturers can better protect themselves against these types of
1. Belkin WeMo app download data collected from XYO
http://xyo.net/iphone-app/wemo-J1QNimE/ (iOS) and
2. Home Fires http://www.ready.gov/home-fires and
IOActive is a comprehensive, high-end information security services
firm with a long and established pedigree in delivering elite security
services to its customers. Our world-renowned consulting and research
teams deliver a portfolio of specialist security services ranging from
penetration testing and application code assessment through to
semiconductor reverse engineering. Global 500 companies across every
industry continue to trust IOActive with their most critical and
sensitive security issues. Founded in 1998, IOActive is headquartered
in Seattle, USA, with global operations through the Americas, EMEA and
Asia Pac regions. Visit www.ioactive.com for more
information. Read the IOActive Labs Research Blog: http://blog.ioactive.com/. Follow IOActive on Twitter: http://twitter.com/ioactive.