Thermostats. Doorbells. Ovens. Everything is connected to the internet these days—and vulnerable to cyberattacks.
6 min
The incidents have been unsettling: a homeowner’s thermostat raised to 90 degrees by hackers with no way to turn it down, baby monitors used by online stalkers to spy on families, webcams and other home devices hijacked to help take down corporate computer networks.
Thanks to the boom in “smart home” devices, we now live with vastly more connected gadgets: internet-linked TVs; camera-equipped doorbells; online thermostats, door locks and lightbulbs; web security cameras; and even refrigerators, dishwashers and ovens with Wi-Fi. Each online link provides a tempting target for a hacker.
The problem isn’t simply that somebody can hack a refrigerator or dishwasher, of course. It’s that once a bad actor breaches one of these devices, he or she potentially could control every other device on your home network. What’s more, these gadgets pose privacy concerns since their cameras, microphones and motion sensors could be used to monitor you.
As sales of smart-home devices continue to grow, consumers need to be cautious. Here are some questions and answers about how to thwart digital vandals.
Every new digital device introduced into your home comes with security risks. Most are connected to your Wi-Fi network and many come with an app that links them to your phone via Wi-Fi or your cellphone network. All of these are potential pathways for a hack—and the device with the weakest security could provide a way for hackers to reach the others.
In other words, you are only as safe as your weakest device.
“A lot of these devices don’t even have basic security features or protections,” says Wendy Frank , U.S. cyber internet-of-things leader for consulting firm Deloitte. Most lack virus protection and other security software that is common in personal computers and phones. Many don’t offer automatic updates of software or firmware (the coding that controls devices’ basic functions) from the manufacturer to fix security flaws, also standard with phones and PCs.
Smart-home devices can be exploited to hack into the owners’ private information or attack a website.
In 2016, hackers controlling hundreds of thousands of internet-connected devices, believed to include webcams, smart TVs, printers and even baby monitors, unleashed  several massive attacks  that knocked out dozens of popular websites, including those of Twitter, Netflix , Amazon and Visa. Such “distributed denial-of-service” attacks instruct the devices to send millions of requests in unison to overwhelm a computer system, causing it to shut down.
Considering the enormous number of U.S. homes with smart devices—more than 60 million—and their low levels of security precautions, they are likely to continue to be tempting targets for all kinds of attacks, says Yuvraj Agarwal , an associate professor of computer science at Carnegie Mellon University. It’s “a disaster waiting to happen,” he says.
Among the potential risks experts cite: People could be locked out of their house by hackers who tapped the security system seeking a ransom. Burglars could listen in over smart speakers to figure out when you aren’t home. Smart lightbulbs could be used as a way to break into personal information on a phone.
First, make sure your Wi-Fi router is secure—the router is the key to your digital home. Use the website or app that controls your router to check that it isn’t using the default password—that same password could have been given to many other customers. Give the router a unique password you use only for that device.
Next, ensure that the router’s security feature called a firewall is turned on, and that it is using encryption called WPA2 or the newer WPA3. And turn on the control to allow automatic software updates, if provided.
As with routers, don’t use the default password they came with. Instead, use a different password for each device, so that if someone were able to figure out, say, the password for your smart doorbell, he or she wouldn’t have access to everything else.
And if a device allows two-factor authentication, be sure to use it. This means that to log in to the device you will need to type in a code sent by text or email, or generated by a device called an authenticator, in addition to the password. That extra step, while annoying, could keep out a hacker.
Yes. Someone could hack into one of your smart devices as a way to break into your Wi-Fi router, and from there could attack your computer, phone and everything else on the same network.
Instead, set up a guest network on your router that has its own unique password and use that network to connect your smart devices. Many routers include such a second network, but you may need to take a few steps to turn it on. Guest networks generally are sealed off from the main Wi-Fi network, so a hacker couldn’t leap from it to the main network.
Check the makers’ security policies online before buying. Look for manufacturers’ statements that they periodically send security updates to the devices and encrypt the communications between the devices and their cloud service. Seek out products that offer two-factor authentication.
Hundreds of types of internet-connected gadgets are sold online by innumerable companies, often at very low prices. “If it costs $5 for a smart plug, most of it is not going toward thinking about security and privacy first,” says Carnegie Mellon’s Agarwal, who does research on smart-device security.
Stick to devices from mainstream makers, since they are more likely to take security considerations seriously and spend the time and money to periodically update these features, he says. These companies don’t want to risk tarnishing their brands with products of questionable security.
Limit how many smart devices you own—the more you have means more pathways for hackers to try to break in. Get fewer, more-secure devices rather than having insecure, cheaper devices in the whole home, says Deloitte’s Frank.
While you might find an Alexa or Google digital assistant useful on the kitchen counter, avoid putting one in a home office where you might talk about confidential financial or work-related topics that could be a juicy reward for a hacker, she adds.
Moreover, disable functions you don’t use or need on the devices, such as the camera on a digital assistant or the ability of the device to save recordings of your voice commands. “Having those turned on creates a larger attack surface” for a hacker, Frank says.
While networks such as Google Home, Apple HomeKit and Amazon Alexa likely have enhanced security, in most cases they also use your home Wi-Fi to connect to their cloud services that run the networks. That raises the same security concerns as relying solely on Wi-Fi, Agarwal says.
A big factor is cost, says Deloitte’s Frank. Adding the level of security found in a laptop computer to a $15 internet-controlled lightbulb could make its price uncompetitive.
Moreover, she says, device makers want their products to appeal to ordinary consumers, so “they need to prioritize convenience, prioritize ease of use. Security often takes somewhat of a back seat.”
One effort is an industry standard called Matter from a consortium that includes Apple, Amazon, Google, Samsung and others, which works to make networked home products interoperate with each other. The Matter standard has security and privacy safeguards built in, says the group behind the standard. Products that meet the standard are being rolled out gradually and can carry its logo .
A project by the Biden administration aims to have makers of digital home devices label their products to indicate their security and privacy protections. Called the Cyber Trust Mark , it’s akin in some ways to the government’s Energy Star certification for the efficiency of home appliances.
The voluntary program, overseen by the Federal Communications Commission, is still under formation; the White House said last year it expected it to be in place in 2024. Under the proposal, device makers seeking to use the label would need to certify that their products meet certain standards by having them tested by an accredited lab. Agarwal says he has provided input to the government effort based on a Carnegie Mellon program to devise a similar label for smart products.
Copyright 2020, Dow Jones & Company, Inc. All Rights Reserved Worldwide. LEARN MORE
The Australian leather house has opened an immersive four-day pop-up in Manhattan, unveiling its Bloom Collection and redefining what a product launch can look like.
Following the successful launch of its Palais Collection, MAISON de SABRÉ has unveiled a new modular handbag system offering more than 720 styling combinations.
Georgetown agent Jamie Peva blends history and real estate on Instagram, turning local stories into a powerful sales strategy.
5 min
On a recent morning in Georgetown—Washington, D.C.’s oldest neighborhood—real-estate agent Jamie Peva strode down leafy N Street, brimming with historical tidbits.
Jackie Kennedy once lived on the street, he said. So did Ben Bradlee, former executive editor of the Washington Post, along with a former Miss America and a powerful U.S. Senator. Bradlee’s widow, author Sally Quinn, and Eric Schmidt, former CEO of Google, own stately homes there.
“I’ve seen a picture of Lyndon Johnson coming out of this house,” said Peva, passing a Federal-style brick mansion. “Also, the Beatles went to a lawn party here.”
Peva, a 60-year-old agent with Washington Fine Properties, has sold Georgetown real estate for over three decades, often traversing the neighborhood by bicycle. Of the roughly 2,500 houses in the historic neighborhood, he has been involved in the sale of 460, he estimated. A self-styled historian of the neighborhood, he knows stories behind its houses and their owners going back generations.
With a knack for lively storytelling, he shares his knowledge with some 37,500 Instagram followers, who have made Peva—sporting the bow ties he has worn since boarding school—an unlikely social-media influencer. Many of his followers are locals, and most have no plans to buy or sell real estate—until they do. It is then, according to Peva, that his spirited reels bring him to mind.
“It’s the digital version of a refrigerator magnet,” he said.
After Peva’s first video in November 2023, his eponymous Instagram account sparked a 10% increase in sales volume in the first year, and another 20% the next, he estimated. “It’s been very good for business, there is no question about it,” he said.
But Peva’s posts have also made him a local celebrity. As he walked down N street, the driver of a Mercedes station wagon slowed down to honk and wave. A lady walking a large dark gray dog stopped to ask what he was filming that day (a reel about a Colonial-era bottling plant.) Peva knew the dog from walking his two springers, Jumpy and Peggy-O, in the neighborhood.
“I need to make a video about the pooches of Georgetown,” he mused.
A growing number of real-estate agents now use social media to sell, and some have millions of followers with reels featuring ultraluxury pads, selling tips or reality TV-style reports on their daily lives. While Peva posts about his listings—and sometimes those of other agents—he mostly focuses on Georgetown history, local businesses and community events, saying his goal is to benefit both his business and the neighborhood.
“If we don’t find something genuinely interesting and worth sharing, we won’t do it,” said Peva’s daughter, Violet Peva, a New York social-media strategist who films, edits and posts his reels. “We cover many topics, not just real-estate information.”
Peva is originally from Connecticut, but has lived in Georgetown for over 30 years, currently in a cottage-style house with a white picket fence. Over the years, Georgetown has changed. The Georgetown Set, a powerful group of Cold War-era residents whose Sunday-night potluck dinners are said to have swayed U.S. policy, has long faded away. The community is still home to high-profile Washingtonians, including a Republican senator and several cabinet members. But it increasingly also attracts technology and finance executives, according to Peva. He now routinely signs nondisclosure agreements, ensuring privacy for wealthy clients. The shift has made him rethink his marketing approach.
“For years, a big part of our Georgetown business was made up of people who maintained a low profile,” he said. Real-estate agents were similarly low-key. Today, curb appeal is more important, he said, and agents are promoting themselves more. “As this change was underfoot, I was thinking that I needed to evolve myself too,” he said.
Though his own social-media use is mostly limited to following sailing accounts, he asked his daughter to help him post his listings online. Violet, now 26, started coming to D.C. once a month to film his reels. After an early video, on a condominium building called the Elliott, her sister Fern called her to report: “Daddy’s blowing up on Instagram,” Violet recalled. The reel got over 50,000 views. The next two each drew over 300,000. Peva’s most popular post ever, with over 838,000 views, was about the Grateful Dead playing in Georgetown. Sometimes, Peva interviews Georgetowners such as Quinn, the author, or Jamie Stachowski, the owner of a local butcher shop.
Peva, who majored in history in college, now spends up to two hours a day on research, usually in the morning while on his stationery bike. Online, he pores over old newspapers or the Library of Congress website, and he has a collection of articles and books—in and out of print—about Georgetown.
Companies often approach Peva for promotional posts, he said, but he turns them down, feeling that followers would lose interest in constant commercials. One exception is a recent paid post on Mount Vernon, the former home of George Washington. Peva wanted to share its history, he said, and didn’t want to lose the opportunity to another Instagrammer.
Anthony Arend, a professor at Georgetown University, has lived in his current home for 19 years without any plans to sell or buy real estate. But he follows Peva and often likes his posts.
“He is very charismatic, he is energetic, and he obviously knows a lot about the community,” said Arend, who has referred house-hunting friends to Peva.
One of Peva’s biggest deals—the $10.5 million sale of a 19th-century Italianate mansion—came after he made two 2024 reels featuring the property. In March, he sold the longtime O Street home of Tim and Jane Matz for $5.8 million after featuring it on his Instagram. Peva had showed them the home 25 years earlier, with Violet in a baby carrier on his back.
Last year, Kate Watts, 49, a digital consultant, called Peva to sell her late father’s three-bedroom house on Q Street; her husband had seen Peva on Instagram. In an October reel, Peva praised the architecture of the house, designed by modernist Hugh Newell Jacobsen. Halfway through, he mentioned an open house the next day, ending with an upbeat: “Did I also mention this house is for sale? $3.75 million!” The reel got 27,000 views, the open house was packed, and the buyers made an offer at the list price on the same day.
