> Your Connected Life Is Your Weakest Link

You secured your laptop with GrapheneOS on your phone. You use Signal for messaging. You're not clicking suspicious links. But what about your thermostat? Your baby monitor? Your smart TV? Your electric car charging at night? These aren't just appliances anymore — they're computers connected to the internet, running outdated firmware, vulnerable to remote exploitation, and often incapable of receiving security updates.

The Internet of Things (IoT) has exploded. By 2025, there were over 15 billion connected devices worldwide. That's two devices for every person on Earth. And almost all of them are insecure. Manufacturers prioritize cost and features over security. Security updates are optional, sometimes non-existent. Default passwords are ubiquitous. Encryption is an afterthought.

Meanwhile, electric vehicles are essentially computers on wheels. Teslas, BYDs, Volkswagens, BMWs — they all have internet connectivity, over-the-air updates, mobile apps that control the car, and dozens of electronic control units (ECUs) talking to each other. A 2023 study found that the average modern car has more than 100 million lines of code. More than a fighter jet. More than Windows. And many of these systems are remotely exploitable.

This page is about the invisible attack surface in your home and your garage. The things you don't think about until someone uses them to own your entire network.

🌐> Why IoT Security Is Broken

The fundamental problem isn't technical — it's economic. Security costs money. It slows development. It requires ongoing maintenance. In the race to get cheap gadgets to market, security is the first casualty.

• No patching lifecycle — 60% of IoT devices receive zero security updates after purchase. When a vulnerability is discovered, it stays unpatched forever.
• Hardcoded credentials — thousands of cameras, routers, and printers shipped with the same admin password. Mirai botnet alone infected 600,000 devices in 2016 using hardcoded credentials.
• Unencrypted communications — many devices communicate with their cloud servers in plaintext. Credentials, telemetry, control commands — all sniffable on the local network or ISP level.
• Insecure APIs — mobile apps that talk to devices often have weak authentication. API endpoints that allow unauthorized control of the device.
• Supply chain compromise — firmware updated through third-party CDNs or third-party hosting. Compromise one vendor and you own all their customers' devices.
• Local network exposure — IoT devices are typically on the same LAN as your laptops and phones. Once an attacker owns the smart bulb, they own your home network.

The Mirai botnet proved how dangerous insecure IoT can be. In October 2016, Dyn's DNS infrastructure was taken down by a DDoS attack launched from 100,000 compromised IoT devices. Twitter, Netflix, Reddit, GitHub, Spotify — all offline for hours. The attackers didn't hack any major company. They hacked webcams, DVRs, and routers — devices whose owners never knew they were participating in a cyberattack.

🏠> Smart Home Devices: Ranked by Danger

Not all IoT is created equal. Some devices are relatively safe. Others are nightmares waiting to happen. Here's the ranking from least to most dangerous.

🚗> Electric Vehicles: Computers With Wheels

An electric vehicle (EV) is fundamentally different from a gasoline car. Every gasoline car has electronics — engine control unit (ECU), transmission, ABS, airbags. But EVs have more computers, more sensors, and crucially: internet connectivity.

Tesla Model S has ~100 ECUs. Modern EVs stream data to manufacturers continuously: location, speed, battery health, braking patterns, climate settings, even cabin audio (for "customer service"). Tesla's CEO claimed in 2021 that their cars generate 25 GB of data per day. Multiply that by 4 million Teslas — that's petabytes of telemetry.

And every connection is a potential attack vector.

🔋> Charging Infrastructure Risks

Your car is only half the equation. Where you charge it matters too. Public charging stations are connected computers running Linux (often), communicating with your car via proprietary protocols, and billing through payment processors.

Attack Vectors at Charging Stations

• Plug-and-charge exploitation — ISO 15118 protocol allows automatic authentication. Researchers demonstrated man-in-the-middle attacks stealing credentials.
• Firmware updates via charger — some chargers push firmware to vehicles. Compromised charger = compromised car.
• Payment data theft — skimming devices, SQL injection in backend databases, credential harvesting at station interfaces.
• Grid sabotage — charging infrastructure connected to electrical grid. Malicious actors could overload transformers, cause localized blackouts.
• Social engineering — fake charging apps that steal account credentials. Fake QR codes on broken chargers redirecting to phishing sites.

Mitigation: Use trusted networks (home charging ideal). Avoid public chargers for critical travel (battery anxiety makes you desperate). Check charger integrity before plugging in (look for tamper signs). Use physical adapter for payment instead of storing card digitally.

🛡️> Hardening Your IoT Ecosystem

You can't eliminate all risk. But you can raise it to the point where casual attackers move on and targeted attacks become expensive. Here's the practical checklist.

Network Segmentation

• VLAN isolation — Put all IoT devices on separate VLAN from main devices (laptops, phones). Use router/firewall rules to block IoT from initiating connections to main network.
• Guest network — if VLAN is too advanced, at minimum use guest Wi-Fi for IoT. Guest networks typically can't access main subnet.
• Router choice matters — pfSense, OPNsense, Ubiquiti UniFi. Cheap ISP routers lack granular firewall controls.

Device Selection Criteria

• Check update history — visit manufacturer's security advisories. No updates in 2+ years? Skip it.
• Look for security certifications — UL certification, ETSI EN 303 645 (EU IoT security standard), ANSI/UL 2900.
• Prefer local control — devices that work offline via local API are safer than cloud-dependent ones.
• Avoid no-name brands — Amazon Basics devices, AliExpress specials, random Kickstarter campaigns. They vanish when vulnerabilities are found.

Authentication Hygiene

• Change default credentials — yes, really. Write them down in password manager if needed.
• Mandatory 2FA — every device that supports it. Prefer authenticator app over SMS.
• Unique passwords per device — don't reuse your main email password on your smart bulb account.
• Disable unused features — remote access, cloud backup, voice assistant integration — turn them off if you don't use them.

Monitoring

• Network traffic analysis — use tools like Wireshark, ntopng, or firewall logs to spot anomalies. IoT devices shouldn't be making thousands of outbound connections.
• Unusual behavior alerts — if your fridge suddenly starts downloading 10GB of data, investigate immediately.
• Log review — check device admin consoles monthly. Look for unrecognized login locations or access times.

Physical Security

• Lock routers/firewalls — keep them in locked cabinets. Physical access = game over for most security measures.
• Secure cameras — don't point them at entry points where passwords might be entered. Cover them when not needed.
• Factory reset before disposal — wipe everything. Some devices have hidden partitions that survive normal resets.

⚠️> The EV Purchase Decision

Should you buy an electric vehicle given all these risks? Here's a framework to evaluate based on your threat model.

For most people, EVs represent a net positive for security and sustainability. The environmental benefits are real. The convenience factors (remote preconditioning, over-the-air updates fixing bugs) are tangible. The attack vectors exist but remain largely theoretical in practice.

The exception: if you're a high-value target (journalist, activist, corporate insider, government official, whistleblower), the risk calculus changes dramatically. Your threat model includes nation-state adversaries. Nation-states have budgets for vehicle exploitation. In that context, every connected device is a liability.

> The Bottom Line

IoT and electric vehicles represent convenience traded for security. You gain remote access, automation, efficiency. You lose control over your attack surface. That's not necessarily a bad trade — it depends on your priorities.

But the trade-off must be informed. Most people buy smart thermostats and EVs without reading the privacy policy, checking the security track record, or understanding the network implications. That's negligence disguised as trust.

Here's the truth no marketing department will admit:

• Every connected device collects data — even if "we don't sell your data," you're still being profiled internally.
• Security updates are rarely guaranteed — unless explicitly stated (GrapheneOS promises 5 years, Tesla does OTA regularly), assume no patches after 2 years.
• Vulnerabilities are inevitable — every complex system has bugs. The question is whether the vendor responds responsibly when flaws are found.
• Your network is only as secure as its weakest link — a compromised smart plug can be the gateway to your entire LAN.
• Physical and digital security converge — hacked smart locks enable burglaries. Hacked cars enable kidnappings. The stakes aren't just data loss anymore.

// every plug is a portal. every sensor is a spy //