

In what sounds like a plot in a bad Adam Sandler film, a security company has discovered a brand of hot tubs that can be easily hacked.
Described in excruciating details over the weekend by security researchers at Pen Test Partners Ltd., the vulnerability relates to the Balboa Water App, a mobile app used for controlling around 30,000 hot tubs manufactured by Balboa Water Group Inc.
The researchers found that the app, which connects to a hot tub over Wi-Fi, did not correctly authenticate users, potentially allowing third parties to gain access. Worse still, the location of hot tubs could also be discovered since the lack of authentication on the receiving end allowed the researchers to map their locations.
OK, so it’s unlikely that anyone would actively seek to hack hot tubs. But the researchers did note that the access would allow someone to increase or decrease the heat in the hot tub.
“It’s easy to turn your temperature down so your tub becomes unusable. It’s also easy to heat it continuously, wasting electricity,” the researchers note. “Blowers are also only turned on when someone is in the tub, so the hacker can figure out if you’re in the tub at the time. Creepy.”
In response to the news, BWG, the company behind the hot tubs told the BBC that it had been “surprised” to learn of the flaw since its app had been available for five years during which users had not reported any problems.
It went on to note that it was working with more than 1,000 owners in the U.K. and others globally to set up a system of individual usernames and passwords to secure the online controls. Perhaps worse still, it added that it had previously opted not to do so because it had wanted to “allow for simple and easy use and activation” by homeowners.
Support our open free content by sharing and engaging with our content and community.
Where Technology Leaders Connect, Share Intelligence & Create Opportunities
SiliconANGLE Media is a recognized leader in digital media innovation serving innovative audiences and brands, bringing together cutting-edge technology, influential content, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios — such as those established in Silicon Valley and the New York Stock Exchange (NYSE) — SiliconANGLE Media operates at the intersection of media, technology, and AI. .
Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a powerful ecosystem of industry-leading digital media brands, with a reach of 15+ million elite tech professionals. The company’s new, proprietary theCUBE AI Video cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.