Loading story…
A lab-based analysis of Zigbee and Z-Wave smart-home networks found that encrypted payloads do not prevent observers from inferring sensitive household activity from radio metadata and traffic timing alone. In a setup with 23 devices, passive monitoring revealed device presence, wake-up intervals, battery status, manufacturer identifiers, and bursts tied to user actions, allowing an observer to map devices and distinguish routine behavior without decrypting communications.
The report said Zigbee’s chatty 2.4 GHz mesh traffic made activity especially visible, while Z-Wave’s quieter sub-GHz operation reduced noise but still leaked pattern-of-life information. The author framed the issue as a privacy and reconnaissance exposure inherent to protocol behavior rather than an exploit or malware campaign, warning that occupancy and daily routines can be inferred through passive listening even in otherwise encrypted smart-home environments.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
The author describes a passive listening exercise in a personal lab with 23 Zigbee and Z-Wave devices, using no injection, active attacks, or decryption attempts. The observations showed that radio metadata and traffic timing could reveal device presence, wake intervals, battery status, and behavioral patterns.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
medium.com
Open sourcemedium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research demonstrated that a **Zigbee-connected smart lightbulb** can be turned into an entry point for attacks against a broader smart home network. The researchers showed that flaws in the bulb’s wireless communication and update process could let an attacker take control of the device from a distance, spread malicious code to the home’s Zigbee bridge, and potentially pivot into other connected systems on the same network. The report highlights how an apparently low-risk **IoT device** can become a practical foothold for wider compromise, especially in environments where consumer smart devices share connectivity with more sensitive assets. By using a common household lightbulb as the initial vector, the research underscored the security risks posed by weakly protected embedded devices and the need for vendors and users to apply firmware updates, segment networks, and scrutinize trust relationships between hubs, bridges, and endpoint devices.
Jul 12, 2026
Multiple disclosures highlighted privacy and safety risks stemming from insecure data handling in connected devices and services. A server-side storage weakness in **DJI Romo robot vacuums** allowed a researcher to obtain access tokens for more than **6,700** other vacuums and view sensitive user data such as **home floor plans**, **live video feeds**, and **microphone input**; reporting indicated some issues were patched, but residual risk remained (e.g., the ability to stream video without a security PIN). Separately, the game *Dungeon Crusher* exposed user information after a **misconfigured Elasticsearch** instance leaked **24.5 million** in-game chat records and purchase-related data, including **IP addresses**, **email addresses**, and **partial payment card details**, creating downstream risk for fraud and targeted phishing. Academic research also demonstrated how everyday systems can leak exploitable signals or be manipulated in the physical world. UC Irvine researchers presented **FlyTrap**, a physical-world attack against **autonomous target-tracking drones** in which AI-generated umbrella patterns can cause drones to approach an attacker closely enough to be captured or crashed, raising concerns for deployments in surveillance and security contexts. IMDEA Networks and partners showed that **Tire Pressure Monitoring System (TPMS)** sensors broadcast a fixed **unique ID** in cleartext radio signals, enabling low-cost receiver networks to track vehicles over time without line-of-sight, based on signals collected from **20,000+ vehicles** during a multi-week study.
Jun 29, 2026
Voice assistants and other smart home devices are generating detailed records that can later be accessed by companies or sought by law enforcement, raising concerns that everyday household technology may become a source of criminal evidence. Reporting highlighted that devices such as Amazon Alexa continuously collect behavioral, audio, and usage data, with wake-word systems capable of false activations that may cause unintended recordings to be uploaded for cloud processing and retention. The coverage pointed to U.S. criminal investigations in Arkansas, Florida, and New Hampshire in which Amazon Echo data was sought or used, underscoring how cloud-stored smart home records can become subpoenaable evidence. It also warned that smart TVs, robot vacuums, smart locks, Fitbits, and even connected water meters can create searchable logs of daily life, and urged users to reduce exposure by inventorying connected devices, limiting unnecessary internet connectivity, understanding whether devices are truly powered off, and keeping at least one room free of smart technology.
Aug 11, 2026