Researchers found security weaknesses in Twinkly IoT lights that allowed them to remotely turn off their Christmas brilliance. They estimate that about 20,000 devices are reachable over the internet. Users can manage their smart decoration via a mobile app that sends unencrypted communication over the local network; this makes trivial analyzing the traffic from a man-in-the-middle position. The authentication process, although a good idea, is flawed,” said the researchers from MWR InfoSecurity
Source: security