Abusing the Internet of Things

SmartThings and the WeMo Switch

The WeMo Switch (see “Some Things Never Change: The WeMo Switch” on page 77) can also
be controlled using the SmartThings app. Similar to setting up the hue bridge, the user has to
select the + button on the bottom of the Dashboard screen of the app, followed by selecting
Switches & Dimmers → Belkin WeMo Switch → Connect Now. This causes the SmartThings
Hub to search for the switch using SSDP:

M-SEARCH * HTTP/1.1

MX: 1

MAN: "ssdp:discover"

HOST:239.255.255.250:1900

ST: urn:Belkin:device:controllee:1

The WeMo Switch responds to identify itself:

HTTP/1.1 200 OK

CACHE-CONTROL: max-age=86400

DATE: Mon, 20 Oct 2014 14:32:17 GMT

EXT:

LOCATION: http://192.168.2.10:49153/setup.xml

OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01

SERVER: Unspecified, UPnP/1.0, Unspecified

X-User-Agent: redsonic

ST: urn:Belkin:device:controllee:1

The app alerts the user that a WeMo Switch has been located, as shown in Figure 4-18.

As expected, the SmartThings Hub sends the following GET request to the WeMo Switch:

GET /setup.xml HTTP/1.1

HOST: C0A8020A:C001

INTEROPERABILITY WITH INSECURITY LEADS TO...INSECURITY 113