Your Smart Doorbell Could Be a Security Risk: The Evolution of Smart Homes
Explore the history of smart-home security, from X10 automation and Mirai attacks to Ring privacy issues, Matter standards and 2026 cybersecurity rules.
Latest Story
A doorbell that streams video to your phone is also a small computer on the internet, with a password, a cloud account and software that needs fixing. That is the core of smart home security. Since home automation began with X10 in 1975, connected homes have gained cameras, locks, speakers and hubs, and with them new ways in for attackers. The Mirai botnet turned hundreds of thousands of home cameras and routers into a weapon in 2016. Ring’s camera accounts were hijacked and its staff accessed customers’ videos, which led to a $5.8 million FTC settlement. India’s CERT-In has flagged smart hubs and locks sold here. This timeline traces how the risks grew and how smart home security rules, from NIST and Matter to UK and EU law, have tried to catch up.
💡 Short Answer
Smart home devices are risky mainly because of weak passwords, hijacked accounts and missing updates, not because of exotic hacks. The Mirai botnet of 2016 infected about 600,000 cameras, recorders and routers using factory passwords. The FTC said in 2023 that hackers reached about 55,000 Ring customers’ accounts and that employees had viewed private videos. Since then the UK has banned default passwords (April 2024), the EU’s Cyber Resilience Act reporting rules began on 11 September 2026, and the Matter standard added secure device identity and, from 2025, cameras.
Smart Home Security: Key Questions
Smart Home Security in Ten Points
- Old idea, new risk: home automation dates to 1975, but internet connection is what made it a security issue.
- Passwords first: Mirai built a botnet of ~600,000 devices in 2016 with nothing but default logins.
- Home devices, global impact: on 21 October 2016 those devices knocked major websites offline via Dyn.
- Insiders count: the FTC said Ring staff could view customers’ private videos.
- Accounts matter: reused passwords let hackers into ~55,000 Ring accounts, per the FTC.
- India is not immune: CERT-In flagged Tapo hubs and Tinxy locks storing passwords in plain text.
- Context matters: those Indian flaws needed physical access; not every vulnerability is a remote hack.
- Standards help: Matter adds device identity and encryption; it added cameras in November 2025.
- Law is catching up: UK rules from April 2024, EU CRA reporting from 11 September 2026.
- Updates are security: a device without updates becomes riskier every year it stays connected.
Why an Ordinary Device Becomes a Security Risk
Each connected product opens a different door.
The pattern across fifty years is simple. Every time a household object gained a network connection, it gained a password, a software stack and usually a cloud account. Attackers rarely need a clever exploit: Mirai tried factory logins, the Ring hijackers tried leaked passwords, and the Indian hub flaws exposed credentials sitting in plain text. What changes from device to device is the consequence. A hacked plug is a nuisance; a hacked camera is a privacy breach; a hacked lock or alarm touches physical safety.
Five Eras of the Connected Home
From power-line switches to regulated products.
Timeline: Smart Home Security, 1975–2026
Newest first. Colour shows the type of event.
EU Cyber Resilience Act reporting duties switch on Law & regulation
What happened: From 11 September 2026, manufacturers selling products with digital elements in the EU must report actively exploited vulnerabilities and severe security incidents through the CRA Single Reporting Platform.
The deadlines: An early warning within 24 hours of becoming aware, a full notification within 72 hours, and a final report within 14 days of a fix being available (for exploited vulnerabilities) or within a month of the 72-hour notice (for severe incidents).
What comes next: The rest of the CRA, including security-by-design requirements for products themselves, applies from 11 December 2027.
NIST revises its core guidance for IoT manufacturers Standards & guidance
What happened: NIST published IR 8259 Rev. 1, Foundational Cybersecurity Activities for IoT Product Manufacturers, replacing the original version of 29 May 2020.
The message: Manufacturers should plan security before a product is sold: decide what cybersecurity features customers need, what information to give them, and how vulnerabilities will be handled and updates delivered over the product’s life.
Why it matters: NIST guidance is voluntary, but it is the reference used by US labelling schemes and by many manufacturers worldwide.
Matter 1.5.1 refines camera and doorbell support Standards & guidance
What happened: The Alliance released Matter 1.5.1, building on the camera support added four months earlier.
What changed: Cameras can deliver several streams at once (for example a high-resolution stream for recording and a lighter one for phones), snapshots can use the HEIC format, and recorded video can be uploaded using HLS and DASH streaming.
Why it matters: The more ecosystems that can view one camera, the more important it is that access permissions and privacy zones behave the same everywhere.
Matter 1.5 brings cameras into the common standard Standards & guidance
What happened: Matter 1.5 added cameras and video doorbells, along with closures such as garage doors and gates, soil sensors and more energy-management features.
How it works: Matter cameras stream live video and audio using WebRTC, with local and remote access via standard STUN and TURN protocols. The specification also defines pan-tilt-zoom, detection and privacy zones, and continuous or event-based recording to local or cloud storage.
Why it matters: Cameras are the most privacy-sensitive device in a home. A common standard can reduce reliance on one vendor’s app and cloud, but it does not by itself secure a user’s account or home network.
Second round of Ring refunds goes out Privacy & enforcement
What happened: According to the FTC’s Ring refunds page, a second round of payments in August 2025 resulted in more than $5.4 million in refunds.
Why it matters: It closed the loop on the 2023 settlement: money was redistributed to customers who had not cashed or accepted earlier payments.
CERT-In flags a second Tapo smart hub Attacks & flaws
What happened: CERT-In reported an information-disclosure flaw in the TP-Link Tapo H200 V1 IoT Smart Hub running firmware 1.4.0 or earlier.
The flaw: Wi-Fi credentials were stored in plain text in the firmware. An attacker with physical access could extract the firmware and read the home network password.
The fix: Upgrade to firmware 1.5.0 or higher.
CERT-In warns about Tinxy smart locks and switches Attacks & flaws
What happened: CERT-In reported that several products from Indian maker Tinxy (Mogify Infotech) stored credentials in plain text in their firmware.
Products listed: The Tinxy Wi-Fi Lock Controller v1, the RF door lock with Wi-Fi controller, 1, 2, 4 and 6-node smart Wi-Fi switches, and two smart ceiling panel lights.
The advice: Apply the vendor’s mitigations where available, add physical security, or stop using the product if no mitigation exists.
Matter 1.4 brings routers into the standard Standards & guidance
What happened: Matter 1.4 introduced certification for Home Routers and Access Points (HRAP): routers, modems and set-top boxes that combine a Wi-Fi access point with a Thread Border Router.
The security angle: HRAP devices include a secure directory for storing and sharing Thread network credentials, so new devices join one network instead of each vendor creating its own.
Also added: Enhanced Multi-Admin across ecosystems, energy-management devices such as heat pumps and solar, and other device types.
CERT-In reports plaintext Wi-Fi passwords in the Tapo H100 hub Attacks & flaws
What happened: CERT-In flagged the TP-Link Tapo H100 IoT Smart Hub with Chime, hardware V1, firmware before 1.5.22.
The flaw: The hub stored Wi-Fi credentials in plain text in its firmware. Someone with physical access could extract the firmware and recover them.
The fix: Upgrade to firmware 1.5.22. CERT-In rated the risk medium.
UK bans default passwords on connected products Law & regulation
What happened: The UK became one of the first countries to make baseline IoT security a legal requirement for consumer connectable products.
The three rules: 1) No universal default or easily guessable passwords. 2) Manufacturers must publish how to report vulnerabilities. 3) They must state the minimum period of security updates.
Who it binds: Manufacturers, importers and distributors in the supply chain of products sold in the UK.
FTC sends $5.6 million in Ring refunds Privacy & enforcement
What happened: The FTC announced it was sending more than $5.6 million in refunds, as 117,044 PayPal payments, to eligible Ring customers.
Who qualified: People who had certain Ring devices, such as indoor cameras, during periods when the FTC said employees or hackers may have accessed their videos.
Why it matters: Privacy failures in a home camera turned into direct compensation for customers, not just bad headlines.
India sets security requirements for CCTV cameras Law & regulation
What happened: MeitY notified Essential Requirements for Security of CCTV through an amendment to the Electronics and IT Goods (Requirement of Compulsory Registration) Order, 2021.
The requirements: Tamper resistance, authentication and access control, encrypted data transmission, regular software updates, disabling unused features, strong password policies and penetration testing by approved labs.
Background: It followed a March 2024 government advisory on the risk of information leakage through CCTV and video recorders.
FTC charges Ring over employee spying and hijacked cameras Privacy & enforcement
The allegations: The FTC said Ring gave employees and contractors broad access to customers’ private videos; one employee viewed thousands of recordings of female users in spaces such as bathrooms and bedrooms. It also alleged Ring failed to stop credential-stuffing and brute-force attacks, letting hackers reach the accounts, recordings and live feeds of about 55,000 US customers.
Other charges: The complaint said Ring used customer videos to train algorithms without proper consent.
The settlement: Ring agreed to pay $5.8 million for refunds, delete data products built from unlawfully reviewed videos and run a privacy and security programme. It was a civil settlement, not a criminal conviction.
Matter 1.0 launches Standards & guidance
What happened: The Alliance (formerly Zigbee Alliance) released Matter 1.0 and opened certification. Apple, Google, Amazon and Samsung all backed it.
Security model: Every certified device carries a cryptographic identity checked during setup (device attestation), and devices communicate over encrypted, authenticated sessions.
The limit: Matter secures how devices talk to each other. It cannot fix a weak account password, an unpatched router or a vendor that stops issuing updates.
NIST adds the manufacturer side: NISTIR 8259B Standards & guidance
What happened: NIST set out the non-technical things a manufacturer should provide: documentation, a way to receive vulnerability reports, information on updates and support periods, and education for customers.
Why it matters: A secure device can become an insecure one simply because its maker stops supporting it.
NIST publishes its IoT security baseline Standards & guidance
What happened: NIST released two linked documents: NISTIR 8259, on foundational activities for IoT manufacturers, and NISTIR 8259A, the core baseline of device cybersecurity capabilities.
The baseline: Six capabilities: device identification, device configuration, data protection, logical access to interfaces, software update and cybersecurity state awareness.
Why it matters: It gave manufacturers and regulators a shared checklist for what “secure by default” means for a connected device.
Hijacked Ring cameras make headlines Privacy & enforcement
What happened: US media reported a run of cases in which strangers took over Ring cameras and spoke through them, in one widely reported case to a child in her bedroom.
How it happened: Attackers typically reused email and password combinations leaked in other breaches. Two-factor authentication was optional at the time.
The aftermath: Ring made two-factor verification mandatory in 2020. The FTC later cited such incidents in its 2023 complaint.
Mirai’s creators plead guilty Attacks & flaws
What happened: The Justice Department announced guilty pleas by three young men, Paras Jha, Josiah White and Dalton Norman, for creating and operating the Mirai botnet.
Why it matters: It showed that the most damaging IoT attack to date had been built by a small group, using nothing more advanced than lists of default passwords.
FBI warns consumers about insecure IoT devices Standards & guidance
What happened: The FBI issued a public service announcement, Common Internet of Things Devices May Expose Consumers to Cyber Exploitation.
The warning: It listed home automation, security systems, smart appliances and wearables as targets, and warned that compromised devices could be used to attack other systems, steal personal information or interfere with physical safety.
The advice: Change default passwords, update firmware, isolate IoT devices on their own network and disable unneeded remote access.
India’s Cyber Swachhta Kendra issues a Mirai alert Law & regulation
What happened: Four days after the Dyn attack, India’s botnet-cleaning centre warned that Mirai variants were spreading to printers, video cameras, routers and smart TVs.
What it said: Mirai targets devices protected by default or hardcoded credentials, builds botnets and launches DDoS attacks. A reboot wipes it from memory, but the device is quickly reinfected unless its password is changed.
Mirai knocks major websites offline via Dyn Attacks & flaws
What happened: Waves of traffic from Mirai-infected cameras, recorders and routers hit Dyn, a company that resolves domain names for many big websites. Sites including Twitter, Netflix, Reddit and GitHub became unreachable for many users, especially on the US East Coast.
Scale: A 2017 academic study of Mirai (Antonakakis et al., USENIX Security) found the botnet peaked at about 600,000 infected devices.
Why it matters: It proved that cheap home devices with factory passwords could take down parts of the internet.
Mirai appears Attacks & flaws
What happened: A new botnet built from IoT devices hit security journalist Brian Krebs’s website with one of the largest DDoS attacks recorded at the time, and also targeted French host OVH.
How it spread: Mirai scanned the internet for devices with open Telnet ports and tried a built-in list of about 60 factory usernames and passwords.
The leak: At the end of September its author posted the source code online, and copycat botnets followed.
A website streams tens of thousands of private cameras Attacks & flaws
What happened: A site called Insecam began listing live feeds from internet cameras whose owners had never changed the default password. Reports at the time put the number at more than 70,000 worldwide, including baby monitors and home cameras.
The response: Data-protection regulators, including the UK’s Information Commissioner’s Office, warned owners to change passwords.
Apple HomeKit and Amazon Echo arrive Technology
What happened: Apple announced HomeKit at its June 2014 developer conference, a framework for controlling accessories from an iPhone. In November, Amazon unveiled the Echo speaker and its Alexa assistant.
The new questions: Always-listening microphones, voice recordings stored in the cloud and third-party “skills” created a privacy debate that continues today.
The Nest Learning Thermostat makes the smart home mainstream Technology
What happened: Nest launched a thermostat that learned a household’s routine and could be controlled from a phone.
Why it matters: It shifted the smart home from simple remote switches to devices that collect data and live in the cloud, raising questions about who could see that data.
LG launches an internet refrigerator Technology
What happened: LG launched one of the first internet-connected fridges, with a built-in screen for browsing and managing food.
Why it failed: It cost thousands of dollars, and the home broadband, wireless networks and phone apps that would make it useful did not yet exist.
Kevin Ashton coins “Internet of Things” Technology
What happened: Ashton used the phrase in a presentation about using RFID tags so computers could track physical goods in supply chains without people typing in data.
Why it matters: The term later came to cover everything from industrial sensors to smart doorbells.
A toaster on the internet Technology
What happened: At the Interop networking show, John Romkey demonstrated a toaster that could be switched on over a network using standard internet management software.
Why it matters: It was a stunt, but it showed that ordinary appliances could be controlled through the internet.
X10 home automation is developed Technology
What happened: X10 sent on/off and dimming commands through a home’s existing electrical wiring, letting owners control lamps and appliances from a central console.
Security: None to speak of. Signals were unencrypted and could, in principle, be sent by any X10 device on the same wiring.
Mirai: How Home Devices Attacked the Internet
The 2016 botnet in five steps.
Mirai’s lesson was not that home devices are hard to secure but that they were shipped insecure. The malware did not exploit a software bug; it logged in. India’s Cyber Swachhta Kendra noted that rebooting an infected device wiped the malware from memory, but that it would soon be reinfected unless the password was changed. That is why every later rulebook, from the FBI’s 2017 advice to the UK’s 2024 law, starts with passwords.
Ring: When the Threat Was Inside and Outside
What the FTC alleged, and what followed.
The Ring case matters because it showed two different failures in one company. Outside attackers got in through customers’ reused passwords, which better account protection would have blocked. Inside the company, according to the FTC, employees and contractors had broader access to private video than their jobs required. Ring agreed to the settlement without a court finding against it. The practical takeaway for any camera owner is to treat the cloud account, not the camera, as the thing to protect.
India: What CERT-In Has Flagged
Three smart-home vulnerability notes, all found by Mumbai researchers.
| Date | CERT-In note | Product | Issue | Fix |
|---|---|---|---|---|
| 4 Nov 2024 | CIVN-2024-0331 | TP-Link Tapo H100 hub (V1) | Plaintext Wi-Fi credentials | Firmware 1.5.22 |
| 11 Mar 2025 | CIVN-2025-0043 | Tinxy locks, switches, lights | Plaintext credentials | Vendor fix or stop use |
| 9 Apr 2025 | CIVN-2025-0072 | TP-Link Tapo H200 hub (V1) | Plaintext Wi-Fi credentials | Firmware 1.5.0+ |
All three flaws needed someone to physically handle the device and extract its firmware. That lowers the risk for a hub sitting inside a locked flat. It raises it for devices mounted outdoors, installed in shared buildings or sold second-hand, where the old owner’s Wi-Fi password may still be inside. Separately, MeitY’s April 2024 CCTV security requirements brought camera testing under the Compulsory Registration Order, India’s first product-level security rule for a common home-security device.
The Rules That Now Apply
From voluntary guidance to legal duties.
| Rule or standard | Where | Status | What it requires |
|---|---|---|---|
| NISTIR 8259 / 8259A / 8259B | United States | Voluntary, 2020–2021; 8259 revised Apr 2026 | Baseline device capabilities and manufacturer support activities |
| Matter | Global industry | Certification since 4 Oct 2022 | Device attestation, encrypted sessions, interoperability |
| MeitY CCTV requirements | India | Notified 9 Apr 2024 | Security testing of CCTV cameras by approved labs |
| PSTI regime | United Kingdom | Law since 29 Apr 2024 | No default passwords, vulnerability reporting, stated update period |
| Cyber Resilience Act | European Union | Reporting from 11 Sep 2026; full from 11 Dec 2027 | 24h/72h reporting, secure design, updates over product life |
How Each Device Can Be Compromised
Not every vulnerability means remote control.
| Device | Typical weakness | Possible consequence |
|---|---|---|
| Security camera | Weak or reused password, broad cloud access | Live or recorded video exposed |
| Video doorbell | Account takeover | Comings and goings monitored |
| Smart lock | Weak authentication, unpatched firmware | Attempts to control physical access |
| Smart speaker | Account compromise, loose privacy settings | Recordings and linked data exposed |
| Wi-Fi router | Old firmware, default admin login | A route to every other device at home |
| Smart hub | Credentials stored in plain text | Wi-Fi password and linked devices exposed |
| Smart TV | Insecure apps, stale software | Viewing data and accounts exposed |
| Smart plug or switch | Vulnerable firmware | Appliances switched remotely; foothold on network |
Some flaws need physical access, some need the attacker already on your home network, and some only need your password. Before panicking about a headline, check which kind it is.
Five Lessons from Fifty Years
- Default passwords are an open door: Mirai needed nothing else.
- A camera is a data collector: the Ring case showed insiders can be the risk too.
- Updates are physical security: an unsupported lock or camera gets weaker every year.
- Hubs concentrate risk: one weak hub can expose the Wi-Fi password for the whole home.
- Interoperability is not immunity: Matter secures the link between devices, not your account.
How to Secure a Smart Home: Practical Checklist
Ten steps, most taking under five minutes.
| Action | Why it matters |
|---|---|
| Change every default password | Stops attacks using publicly known logins, as Mirai did |
| Use a unique password per account | A leak elsewhere cannot unlock your camera |
| Turn on two-factor authentication | Blocks most account takeovers, as in the Ring cases |
| Update router and device firmware | Fixes known flaws, such as the Tapo hub issues |
| Put IoT devices on a guest or separate network | Limits what one hacked device can reach |
| Disable unused remote access and UPnP | Reduces exposure to the internet |
| Review camera and microphone permissions | Controls who can see and hear inside your home |
| Check the maker’s update-support period | Avoids buying a device that will soon be abandoned |
| Factory-reset devices before selling or binning | Removes stored Wi-Fi passwords and account links |
| Secure hubs and outdoor devices physically | Prevents firmware extraction attacks |
🏠 For Indian households
Search CERT-In’s vulnerability notes (cert-in.org.in) for the exact model before buying or continuing to use a hub, Wi-Fi lock or camera. Where a note names a firmware version, open the device app and confirm the update has actually installed; many devices do not update themselves.
What Comes Next
- AI cameras: on-device classification of people, pets and vehicles raises accuracy and data-retention questions.
- Home agents: AI assistants that can unlock doors or disarm alarms will need tight, auditable permissions.
- Edge processing: more video analysed locally means less sent to the cloud, but local hubs still need patches.
- Device identity: cryptographic attestation, as in Matter, is becoming the norm.
- Lifecycle duties: the EU CRA’s December 2027 rules make security over a product’s whole life a legal obligation.
Terms Explained
- IoT: the Internet of Things, physical devices connected to networks.
- Botnet: a network of infected devices controlled together by an attacker.
- DDoS: distributed denial of service, flooding a target with traffic to knock it offline.
- Credential stuffing: trying passwords leaked from one site on other sites.
- Firmware: the software built into a device’s hardware.
- Device attestation: a cryptographic check that a device is genuine and certified.
- Thread: a low-power mesh network protocol used by many Matter devices.
Explore More Timelines
People Also Ask
Frequently Asked Questions
Based on CERT-In, FTC, FBI, NIST, Connectivity Standards Alliance, UK Government and European Commission records.
⚠️ Editorial Note
Dates and figures come from primary records where possible: CERT-In and Cyber Swachhta Kendra notes, FTC press releases, the FBI’s 2017 PSA, NIST publication pages, Connectivity Standards Alliance releases, UK Government guidance and the European Commission’s CRA page. The FTC’s Ring findings are allegations resolved by a civil settlement, not a court ruling. CERT-In advisories describe vulnerabilities, not confirmed attacks. NIST lists IR 8259 Rev. 1 only as April 2026. This article is general information, not security advice for a specific device.
Related Reading on AiTimeline
Sources & further reading
Every dated entry above was checked against these references. Last reviewed 11 November 2026.
- Cyber Resilience Act: Reporting obligations
- NIST IR 8259 Rev. 1: Foundational Cybersecurity Activities for IoT Product Manufacturers (April 2026)
- NISTIR 8259A: IoT Device Cybersecurity Capability Core Baseline (May 2020)
- NISTIR 8259B: IoT Non-Technical Supporting Capability Core Baseline (August 2021)
- Matter 1.5.1: Enhancing Camera Performance and Expanding Device Flexibility (31 March 2026)
- Matter 1.5 Introduces Cameras, Closures, and Enhanced Energy Management Capabilities (20 November 2025)
- Matter 1.4 Enables More Capable Smart Homes (7 November 2024)
- CERT-In Vulnerability Note CIVN-2025-0072: TP-Link Tapo H200 smart hub (9 April 2025)
- CERT-In Vulnerability Note CIVN-2025-0043: Tinxy smart devices (11 March 2025)
- CERT-In Vulnerability Note CIVN-2024-0331: TP-Link Tapo H100 smart hub (4 November 2024)
- Regulations: consumer connectable product security (PSTI)
- FTC Sends Refunds to Ring Customers Stemming from 2023 Settlement (23 April 2024)
- FTC Says Ring Employees Illegally Surveilled Customers, Failed to Stop Hackers from Taking Control of Users' Cameras (31 May 2023)
- Ring Refunds
- Common Internet of Things Devices May Expose Consumers to Cyber Exploitation (17 October 2017)
- Justice Department Announces Charges and Guilty Pleas in Three Computer Crime Cases (Mirai, December 2017)
- Mirai Botnet affecting IoT devices (25 October 2016)
- Understanding the Mirai Botnet (USENIX Security 2017)
- MeitY mandates new rules for CCTV cameras
- The WIRED Guide to the Internet of Things