Thermostat Security: Trane Was Slow to Fix Issues, Cisco Reports

Cisco announced Feb. 8 that they had found three vulnerabilities in the Comfortlink II IoT thermostats manufactured by Trane. The thermostat security flaws could have allowed hackers to take over the device and network it was connected to.

Trane has since fixed the issue, but Cisco was quick to point out they’d been notified of the issue two years ago and had just now gotten around to fully patching it. They issued a partial fix in April of 2015 and a full patch on Jan 27, which can be downloaded as firmware update here.

“The unfortunate truth is that securing internet-enabled devices is not always a high priority among vendors and manufacturers,” said Cisco threat researcher Alex Chiu, a Cisco threat in a blog post Monday. “While IoT devices such as smart thermostats, home lighting, and security systems bring an added level of convenience into our lives, these vulnerabilities highlight the dangers of insecure development practices.”

 Related: Why IoT security remains abysmal

The flawed firmware provided two sets of user credentials with hardcoded passwords. A hacker could have used SSH to undermine thermostat security by logging into the device and gain access to a fully functional Linux OS toolkit called BusyBox. It also allowed buffer overflows to be used to gain unauthorized access to the device.

Aside from issuing the patched firmware, Trane hasn’t publically commented on the matter.

Trane is not the only company to have issues with thermostat security or IoT-device security in general. Princeton university researchers announced Jan. 20 that they found security flaws in Nest smart thermostats, as well as home IoT devices such as smart speakers and video cameras.

Want more? Check out our most-read content:

White Paper: How to ‘Future-Proof’ a Streaming Analytics Platform
Research from Gartner: Real-Time Analytics with the Internet of Things
E-Book: How to Move to a Fast Data Architecture
The Value of Bringing Analytics to the Edge
What’s Your Business Intelligence System? How About Your Culture
Video: Rocana Rolls Out 1TB of Free IT Monitoring

Liked this article? Share it with your colleagues!