When selling a smart home, follow these security tips

Recently, one of our neighbors sold their home and they had a Google Nest thermostat. This became an issue during the sale process. The prospective buyers wanted the Nest to remain, but current owners wanted to take it with them.

This brought up the question of whether the Nest was considered like a major appliance and was part of the home. Or was it more like the furniture, which moves to the next residence with the original owners.

As we move to a world where more devices in the home become part of the Internet of Things, you can see where this issue could become quite thorny.

What happens when several members of a family have multiple apps on their phones and maybe even in their cars that control the home lighting, heat, security, coffee maker, garage door, refrigerator?

How do the sellers untangle from all of these accounts, passwords, SSIDs, cloud-based services, apps, etc? And how does the new owner gain assurance that someone in the seller’s family can’t still get into the garage or mess with the thermostat?

Here’s a checklist of things to consider.

1. Reconfigure smart utility meters

In the past, the new owner contacted the local utility companies in advance and established service to switch over to their account on a specific date. This may include electric, gas, water/sewage, and trash/recyclable removal. In many homes, these services may not be internet-enabled.

However, more of these services are becoming “smart” with smart-meters to help the residence measure energy consumption and help conserve energy. Some of these services may include a web interface or a mobile app for the resident to monitor services, understand usage and pricing, and pay their bill.

+ ALSO ON NETWORK WORLD Without proper security measures, smart homes are just begging to be targets +

When the service is terminated, the previous owner may need to un-install these applications from their mobile devices. When the service is re-established, the new owner will need to configure these systems.

2. Don’t forget location-based internet services

Internet connectivity is not like a major appliance, it is more like cable TV or telephone service. The previous homeowner cancels service and it’s up to the new owner or tenant to re-establish it.

Most of the time, the homeowner will take their home router and wireless system with them to the new home. When the WAP moves, so goes the SSID that many of the smart-home devices are tied to. If there are critical home infrastructure systems, such as lighting systems and thermostats, tied to a specific SSID, then the new homeowner will need to reset all of these systems immediately.

Changing ISPs may seem like a trivial part of the home ownership transfer process. However, this may be more complex if there are cloud-based services looking for communications from in-home IoT devices that are communicating with a specific source address.

Most homes would have a home gateway that would be performing a NAT/PAT function and using a single public IPv4 address for the source address of outbound communications. As those IoT devices in the home relay their status to an internet-based or cloud service, they all appear to be coming from a single public IPv4 address allocated by the residential broadband ISP.

When smart devices use IPv6, then they can each have a unique global address. Because IPv6 is intended to operate without a NAT66 or NPTv6 function, as the new ISP connectivity is enabled, the IPv6 addresses these IoT devices are using will change.

If the IoT service relies on the address of these devices to determine the location of the IoT device, then changing the IP address may require some configuration adjustment.

3. Switch online IoT accounts

One technique to make the transfer of property easier would be to use an e-mail address specific to the house for all of the accounts for the home IoT devices and systems. In this way, the current owner would just relinquish the password to that e-mail account. The new owner can simply log into that e-mail account and change the password.

What about selling an IoT home where there are subscription-based or cloud services that have a recurring cost? Selling a home that has owner-specific accounts that are tied to a credit card or a PayPal account may be more complicated. There may need to be a day or two where the current owner and the new owner get together and transition those financial arrangements.

This may not be that difficult if the home has a home-security service. The new owner can elect to continue the service and call the home-security provider and establish a new account. The new owner may need to relay to that home security provider their payment details along with contact details and mobile phone numbers. There may even be a mobile app that the new owner may need to download onto their smartphones to be able to keep track of the door locks, the garage door status and be alerted to alarm conditions.

4. Update smart appliances

It is intriguing to see pictures of intelligent appliances that use sensors to help make life easier and automate common tasks. You may eventually have a “smart” refrigerator that senses when you are running low on eggs and calls the grocery store service to have some automatically delivered. If the refrigerator remains with the property after a sale, then the new owner would need to update this functionality. The previous owner would not want to continue automatic payments for food being ordered by the refrigerator at their former residence.

+ RELATED: Privacy & security nightmares: Hacking smart toilets, smart toys, smart homes +

5. Identify all garage door openers and home security hardware

Selling a house with an electronic garage door opener is not necessarily a problem. The current owner just gathers up the door remote controls and turns those over to the new owner at time of sale, just like the physical keys to the locks. However, newer cars have electronic door openers integrated into the overhead console. Some newer cars may even have the ability to trigger the garage door opening when the car approaches the home. It would be the responsibility of the new home owner to change the digital security code for the garage door opener so that none of the previous door openers could work anymore.

If your current home has a security system that includes some form of notification service, then you will want to discontinue service and stop alerts generated by the new home owner. Some of these home security services also include a mobile application that can remotely allow you to monitor doors, windows, surveillance cameras, and other access and motion sensors. All of these systems and the associated accounts will need to be terminated by the former owner.

If your home has any one of the new array of electronic door locks, then these will need to be changed over to the new owner. Modern electronic door locks may use Radio-Frequency Identification (RFID) access cards, Near Field Communications (NFC) with your mobile device, or use some form of an access code or wireless fob. These lock settings and monitoring applications with their associated usernames and passwords will need to be transferred over to the new property owner.

6. Reconfigure home automation systems

Lighting systems have historically been very simple, just flip a switch. Modern lighting systems may be customizable to adjust lighting levels and hue based on personal preference and configurable using a web interface or have mobile app integration. You might have a coffee maker that automatically starts at a pre-set time every morning and you are likely to take that with you to your new residence. However, if there are other home automation systems tied to specific accounts and e-mail addresses, then these will need special consideration when selling the property.

There may be smart-home devices that use the room name (e.g. kitchen, basement) or the person’s name (e.g. Bobby’s room) as part of their configuration. An example of this might be lighting control systems that use the name of the room to help the user know which lights are located where. The new home owner will need to reconfigure these systems with new names that have meaning to them.

There are many home automation systems that use hubs to connect the various devices in the home. These hubs may use protocols such as SmartThings, Z-Wave, and ZigBee. These smart hubs help with the control of these diverse products and coordinate configuration. It would be likely that the current homeowner will want to move these hubs to their new residence. However, if these are left behind, the new homeowner will need to spend some time figuring out how they are configured and connected and re-establish functionality with the new network connectivity in the home.

If the home has an intelligent smoke detector system, and that system has an automated method of alerting the local fire department, then this can prove problematic during property transfer. It would be vitally important that these types of safety systems have the correct physical address of the residence so that emergency services will be dispatched to the correct location. If these systems are moved to a new location, then the address will need to be updated accordingly.

Summary

Moving can be a stressful time in anyone’s life as they prepare their former residence for sale, pack up and move their belongings to the new location, and re-establish life at their new residence. Buying a home involves a tremendous amount of paperwork including bank documents, finances, loan paperwork, and local legal documents.

Terminating and transferring these IoT and smart systems just adds to this long list of tasks. As more and more internet-connected devices become part of the home, selling won’t be as easy as it has been.

If these systems continue to be point-solutions that do not interoperate or tie into a single central management system, then each of these individual systems will need to be considered at the time of sale. Hopefully these systems and their protocol standards and operations will converge and there will be a single account for intelligent home systems that can make property ownership transference simpler.

Scott Hogg is the CTO for Global Technology Resources, Inc. (GTRI). He also writes the Core Networking and Security blog for Network World. He can be reached at scott@hoggnet.com.