UPDATED 21:51 EDT / DECEMBER 24 2018

SECURITY

Hot tub hack machine: Hackable spas are now a thing, thanks to security vulnerabilities

In what sounds like a plot in a bad Adam Sandler film, a security company has discovered a brand of hot tubs that can be easily hacked.

Described in excruciating details over the weekend by security researchers at Pen Test Partners Ltd., the vulnerability relates to the Balboa Water App, a mobile app used for controlling around 30,000 hot tubs manufactured by Balboa Water Group Inc.

The researchers found that the app, which connects to a hot tub over Wi-Fi, did not correctly authenticate users, potentially allowing third parties to gain access. Worse still, the location of hot tubs could also be discovered since the lack of authentication on the receiving end allowed the researchers to map their locations.

OK, so it’s unlikely that anyone would actively seek to hack hot tubs. But the researchers did note that the access would allow someone to increase or decrease the heat in the hot tub.

“It’s easy to turn your temperature down so your tub becomes unusable. It’s also easy to heat it continuously, wasting electricity,” the researchers note. “Blowers are also only turned on when someone is in the tub, so the hacker can figure out if you’re in the tub at the time. Creepy.”

In response to the news, BWG, the company behind the hot tubs told the BBC that it had been “surprised” to learn of the flaw since its app had been available for five years during which users had not reported any problems.

It went on to note that it was working with more than 1,000 owners in the U.K. and others globally to set up a system of individual usernames and passwords to secure the online controls. Perhaps worse still, it added that it had previously opted not to do so because it had wanted to “allow for simple and easy use and activation” by homeowners.

Image: Pen Test Partners

A message from John Furrier, co-founder of SiliconANGLE:

Your vote of support is important to us and it helps us keep the content FREE.

One click below supports our mission to provide free, deep, and relevant content.  

Join our community on YouTube

Join the community that includes more than 15,000 #CubeAlumni experts, including Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger, and many more luminaries and experts.

“TheCUBE is an important partner to the industry. You guys really are a part of our events and we really appreciate you coming and I know people appreciate the content you create as well” – Andy Jassy

THANK YOU