Hole in Mobile Apps Leave Home Automation Systems Vulnerable to Hacking

A Rapid7 researcher found that the Android apps for Wink Hub 2 and Insteon Hub store authentication credentials and OAuth tokens in plaintext (persisting until manual logout and sometimes not revoked), and that Insteon’s wireless protocol transmits unencrypted commands vulnerable to capture-and-replay attacks; the researcher demonstrated replaying a garage-door open/close signal with an SDR. Vendors have released or planned fixes for app storage issues, but the threats remain exploitable via compromised phones or physical proximity.