Tales from the Crib

“Wake up, baby.”

When Heather Schreck heard the strange man's voice calling from her 2-year-old daughter's room, it was near midnight in early April, and she and her husband were asleep in their own bedroom in their Cincinnati-area home, she tells Angie's List.

Heather grabbed her smartphone to check the video feed from a Foscam smart camera the couple installed to keep watch over her baby. Except for her daughter, the room was empty. But the camera, which was designed to follow the baby in the crib, panned around the room.

When her husband rushed in the nursery to see what was happening, the camera turned eerily toward him. “Then it screamed at me—some bad things, some obscenities. So I unplugged the camera,” her husband told Cincinnati's Fox19 News. Someone had hacked into the family's video system and was spying on their child.

Potty Perils

In Japan, a “smart toilet” comes equipped with a bluetooth controller. Through an app called My Satis, users can control flushing, bidet water sprays and remotely open and close the toilet lid. The app even includes a “toilet diary” to monitor the user's health based on their bathroom activity.

Because of an app vulnerabilty, any person can download the My Satis app and gain control of any Satis smart toilet. Imagine that—hackers can repeatedly flush your toilet at will, driving up water costs, as well as activate the bidet or the air-dry features at inopportune times.

Fly From this Nest

In the video above from August's Black Hat tech session, Daniel Buentello from the University of Central Florida shows how he is able to gain root access and remote control over a Nest thermostat via USB in 15 seconds.

The smart home thermostat, which Google bought this year for $3.2 billion, controls temperature and lighting in the home, adjusting as a person walks room to room. Nest uses your home's sensors to tell when you are home, and it adjusts the temperature to your liking. If you are not home in the afternoon, Nest will put the heater or air conditioner into low-energy mode.

Sounds pretty nice, until hackers take over your home environmental control system.

Lock and Load

Home security devices, particularly locks, are designed to be opened with a PIN code or an app. Using a smartphone, a homeowner can change the code from anywhere–ideal for those who use their homes for Airbnb.

Also at the Black Hat tech session, Daniel Crowley demonstrated how a hacker can gain access to a front-door lock and open it from a computer. He then showed the audience how to change the lock's code.

Crowley posits that this will cause insurance complications. “If someone breaks into your house and there is no sign of forced entry, how are you going to get your insurance company's [attention]?”

It's not just the devices—the controllers also are vulnerable.

Last May, a hacker in Australia used Apple's Find My Phone feature to lock nearby iPads and iPhones, which are used to control smart home devices. The hacker demanded $100 via PayPal from the victims to unlock their phones and tablets.

Baby Blues

Just like what happened to the Schrecks in the Cinncinnatti area, a Houston family also was hacked through a baby monitor.

Last August, Marc Gilbert was doing the dishes after his birthday dinner when he heard strange noises coming from his 2-year-old daughter's room while she was sleeping. Gilbert investigated, and heard a voice calling his daughter a “F-ing moron” and to “wake up you little slut.”

The hacker, who had a British accent, then turned its attention to Gilbert and his wife, calling him a stupid moron and his wife a b-tch.

“At that point I ran over and disconnected it and tried to figure out what happened,” Gilbert told ABC News. “[I] Couldn't see the guy. All you could do was hear his voice and [that] he was controlling the camera.”

His daughter has a hearing impairment, which Gilbert called a blessing in disguise, and did not wake up during the hack.

The family has plans to sue the monitor's manufacturer, Foscam, for deceptive trade practices.