The hidden attack surfaces in the things we use every day
You can spend a morning on the Grid before you ever open a laptop.
The thermostat adjusts the temperature. A speaker answers a question. The television remembers where you stopped watching. The stove checks in with an app, the robot vacuum gets to work, and the toothbrush has an opinion about your technique. Somewhere, a bird feeder is sending photographs.
TRON gave us light cycles and glowing suits. Our version came with a firmware update for the kitchen.... and an account for the cat’s litter box.
That is the Grid I mean: the overlapping local networks, phone apps, cloud services, and remote systems woven into everyday life. We recognize the computer on the desk. We are much less consistent about recognizing the computers doing everything else.
The devices we stop seeing
Start in the kitchen. Smart stoves, connected cooktops and ovens, refrigerators, coffee machines, dishwashers: whole categories of appliances can now communicate with apps and online services. Home Connect’s own connection guide spans those categories, along with washing machines and dryers. The object still looks like an appliance. Its dependencies may include a wireless network, a user account, and software maintained elsewhere. [1]
Move into the living room. Smart TVs, streaming boxes, HomePods, and other voice assistants sit alongside connected lights, blinds, plugs, and thermostats. A second-generation HomePod includes Wi-Fi, Bluetooth, and Thread networking. Samsung’s SmartThings instructions connect compatible TVs to both a network and an account. What looks like entertainment equipment can also be part of a home’s control system. [2]
Then there are the devices that still make us pause. Take the “Wi-Fi toothbrush.” That shorthand can hide the actual route: connected Philips Sonicare brushes pair with a nearby phone over Bluetooth. The brush and the app are distinct parts of the system. Understanding their relationship matters more than applying the same wireless label to every smart object.
The obscure end of the inventory is wonderfully crowded. Ember mugs pair with an app; Whisker’s app monitors connected litter boxes and pet feeders. [4] Birdbuddy puts a Wi-Fi camera in the bird feeder. Rachio connects the sprinkler controller. [5] Eight Sleep’s Pod brings connected temperature control to the bed. [6] We have extended software dependencies into breakfast, gardening, pet care, and sleep.
Add printers, baby monitors, doorbell cameras, smart locks, garage-door openers, robot vacuums, and leak sensors. A security inventory starts to look remarkably like a walk through the house.
Each device has an attack surface: the places where someone or something can interact with its hardware, software, data, or controls. That might be a radio interface, a local service, an app, an account-recovery process, or a cloud API. These products illustrate different kinds of connectivity; their risks depend on their design, configuration, and support.
The stakes differ, too. A printer handles documents. A baby monitor handles intimate sound and images. A stove controls heat. A lock controls access. A device on a poorly separated network may also offer access to something more valuable than itself. Cybersecurity begins by understanding those consequences, even when the computer has been given a more familiar name.
When convenience became a command.
I recently had the pleasure of watching a live webcast featuring Alissa Valentina Knight’s, and her work helps connect these everyday objects to the larger systems behind them. Her book, Hacking Connected Cars, examines telematics, infotainment, wireless interfaces, threat modeling, and risk assessment. Her satellite API research asks related questions at a very different scale. The useful habit is the same: follow what a system trusts, wherever that leads. [7]
Cars provide a particularly clear history of what changes when a physical action becomes a radio message. A metal key presents a shape to a lock. A wireless key presents information to a receiver. The receiver must decide whether that information represents a legitimate request happening now.
In fixed-code systems, recording a valid transmission and sending it again can reproduce the request: a replay attack. Rolling codes improve on this by changing the accepted code and rejecting previously used ones. The receiver needs a way to distinguish an old message from a fresh one. [8]
Freshness is only one assumption. In 2011, Aurélien Francillon, Boris Danev, and Srdjan Čapkun demonstrated relay attacks against passive entry and start systems in ten cars from eight manufacturers. A relay forwards a live conversation between the genuine key and vehicle, making a distant key appear nearby. The cryptography can work even when the system misjudges distance. [9]
In 2015, Samy Kamkar’s RollJam showed how jamming combined with recording could preserve an unused rolling code for later use on vulnerable systems. [10] That same year, Charlie Miller and Chris Valasek demonstrated a remote compromise of an unmodified Jeep Cherokee that reached some physical vehicle functions. The history runs from assumptions about radio messages into the software that can influence machinery. [11]
These are different techniques, but they share a common lesson: controls address particular threats. Security depends on the assumptions surrounding it.
Cars are also a substantial part of the Grid. Berg Insight estimated 338 million active cars with embedded connectivity worldwide at the end of 2025, and embedded connections in 83 percent of new cars sold globally that year. The latter is a new-car sales figure, not the share of every vehicle on the road. Connectivity also says nothing, by itself, about whether a vehicle is exploitable. [12]
The wider system can include mobile apps, manufacturer services, dealership infrastructure, and updates. Knight emphasized the relationship between the vehicle and the backend in a 2020 Cloud Security Podcast interview. APIs—application programming interfaces—let one software system request information or an action from another. An app’s button can begin a journey through several services before anything physical responds. [13]
In 2024, Sam Curry and fellow researchers reported flaws in Kia’s dealer infrastructure that allowed control of connected functions on affected, properly equipped vehicles, using a license plate as the starting identifier. The reported functions included location, locking, and remote start. The researchers reported that the flaws were fixed. The decisive problem was authorization in the supporting software. Better protection for the key-fob signal alone would not have repaired it. [14]
That question belongs beside every smart appliance, too: who gets to ask it to do something, and which system decides whether the request is allowed?
Small devices, large consequences.
An overlooked device can matter beyond its owner’s home. Mirai demonstrated that in 2016 by recruiting vulnerable Internet-connected devices, including cameras and digital video recorders, into a botnet used for distributed denial-of-service attacks. Ordinary equipment became part of someone else’s attack infrastructure. [15]
SonicWall’s published IoT malware detections rose from 32.7 million in 2018 to 112.3 million in 2022. Later reports describe further annual increases in IoT exploit or attack activity, including 11 percent growth in 2025, when SonicWall recorded 609.9 million IoT intrusion-prevention hits. [16]
Figure 1. Published SonicWall IoT detections and annual growth. The two panels use different measures and should be read separately.
These observations come from a vendor’s sensor network, not a census of hacked devices. The chart separates the older malware counts from the newer growth figures because the labels and reporting scope differ. It documents growth within the reported periods without pretending that every measurement belongs in one continuous series.
The obscure device is easy to dismiss because its intended job seems unimportant. An attacker can value its connectivity, credentials, or computing resources for entirely different reasons.
The lesson at the other end of the path
At the 2025 Military Tactical Communications Summit in National Harbor, Maryland, I heard Bonnie L. Triezenberg of RAND Corporation explain a lesson I have mentioned before. As I remember it, securing a satellite link does not secure the computer at the other end. If that computer is vulnerable, an attacker may achieve the objective without ever defeating the proprietary satellite waveform. [17]
Triezenberg’s observation has stayed with me because we tend to protect the part of a system we understand best. Communications specialists see the radio link, network engineers see the route, and application developers see the service. Security depends on how those parts interact.
Encryption remains essential. It protects specified communications and data against specified threats. It cannot make every action taken by a compromised endpoint legitimate, and a proprietary waveform is not, on its own, proof of security.
Knight’s September 8, 2026 ISC2 webcast, From Ground Control to Star Wars: What Satellite Hacks Reveal About Defending APIs from Autonomous AI, brings that lesson into focus. She discussed a scenario that places the attack surface in the ground segment, where APIs support satellite tasking, telemetry, scheduling, and mission operations. The session describes chaining weaknesses into broader command authority in an isolated lab, using a deliberately vulnerable API and a three-dimensional visualization of the consequences. This was a demonstration environment, not a reported takeover of an operational satellite constellation. [18]
Her accompanying explanation emphasizes the software surrounding the AI: its tools, context, permissions, and ability to keep working toward an objective. My takeaway is that automation can make overlooked relationships faster to explore and exploit. Preventing a small authorization failure from becoming a much larger one becomes even more valuable. [19]
Viasat’s account of the February 24, 2022 KA-SAT attack offers a real-world example of disruption through supporting infrastructure. It describes entry through a misconfigured VPN appliance, movement into a trusted management network, and abuse of management commands that disrupted residential modems. Viasat reported no evidence that the satellite itself was compromised. [20]
A home appliance and a satellite service carry different risks. Both depend on more than the visible object and the signal reaching it.
Follow the whole signal path.
Defense in depth gives a system several opportunities to prevent, contain, detect, or recover from an attack. It assumes an individual control can fail. NHTSA’s guidance makes that principle explicit for vehicles. [21] NIST’s IoT baseline identifies capabilities such as restricting interfaces and securely updating device software. [22] The principle travels well beyond either category.
I would follow a request from its origin to its effect, then examine the maintenance and administrative paths that can influence it:
The device and its software. Know what is connected, who supports it, and whether updates still arrive. Restrict unnecessary interfaces and use trustworthy update mechanisms. A stove, printer, or thermostat can remain useful long after its software support ends.
The radio link and network. Use appropriate encryption and authentication, address replay and proximity where relevant, and separate systems by risk. Protect availability as well as confidentiality. A guest or IoT network helps only as far as its rules restrict unwanted access. [23]
The computers and identities at either end. Protect phones, operator workstations, administrator accounts, and recovery processes. Limit service-account privileges and safeguard credentials. A protected connection can still carry requests from a compromised machine. [24]
The APIs and cloud services. Verify that the requester may perform this action on this particular device or record. Being logged in is insufficient. OWASP’s guidance on broken object-level authorization makes this distinction explicit. [25]
The ability to notice and recover. Record meaningful activity, investigate unexpected commands, revoke compromised access, and rehearse restoration. Consequential physical actions also need suitable authorization and safety constraints. Recovery should include what the device can still do when its app, account, or cloud service is unavailable. [26]
For owners, that can start with a room-by-room inventory, supported updates, protected accounts, and deciding which remote features are useful enough to enable. Manufacturers and service operators remain responsible for firmware, backend systems, authorization logic, and support lifecycles that owners cannot inspect or repair.
The signal path rarely forms a single tidy line. A technician’s laptop, an old API, a supplier connection, or a password-reset workflow may influence the same destination. Every relevant branch needs appropriate protection, an owner, and a way to recognize failure.
The analogy I prefer is a bank vault. A capable attacker might leave the steel completely alone and compromise the system that authorizes transfers. They study who can move the money, how approval is granted, and whether a plausible request can be mistaken for a legitimate one.
Just because a bank vault door holds doesn’t protect you from a fraudulent wire transfer being cleared.
Thinking outside the box starts with questioning where we drew the box. The toothbrush, the television, the stove, the car, and the satellite each belong to something larger. Life on the Grid means learning to see those relationships—and protecting the whole journey from request to consequence.
Notes:
[1]. Home Connect, “Connect Your Home Appliance with the Home Connect App Now!,” connection guide, accessed September 13, 2026. https://www.home-connect.com/global/help-support/pairing-finder.
[2]. Apple, “HomePod (2nd Generation)—Technical Specifications,” especially “Wireless”; and Samsung, “Connect a Samsung TV in the SmartThings App,” both accessed September 13, 2026. https://www.apple.com/homepod-2nd-generation/specs/. https://www.samsung.com/us/support/answer/ANS10005262/.
[3]. Philips, “How Do I Connect My Toothbrush to the Sonicare App?,” accessed September 13, 2026. The instructions specify Bluetooth pairing with a nearby phone; this is not a direct Wi-Fi connection from the toothbrush. https://www.usa.philips.com/c-f/XC000006604/how-do-i-connect-my-toothbrush-to-the-sonicare-app.
[4]. Ember, “Ember Mug: How to Pair”; and Whisker, “The Whisker App,” both accessed September 13, 2026. https://support.ember.com/en-US/ember-mug-how-to-pair-1757457. https://www.litter-robot.com/uk/the-app.html.
[5]. Birdbuddy, “Frequently Asked Questions,” especially “Does It Need Wi-Fi?”; and Rachio, “Rachio 3 Smart Sprinkler Controller,” especially “Technical Specifications,” both accessed September 13, 2026. https://mybirdbuddy.com/. https://rachio.com/products/rachio-3.
[6]. Eight Sleep Engineering Team, “Making the Pod Outage-Proof: What We Built, How It Works, and Why It Matters,” Eight Sleep, October 22, 2025. https://www.eightsleep.com/blog/backup-mode/.
[7]. Alissa Knight, Hacking Connected Cars: Tactics, Techniques, and Procedures (John Wiley & Sons, 2020), publisher’s description and table of contents. https://www.wiley-vch.de/en?isbn=9781119491804&option=com_eshop&title=Hacking+Connected+Cars&view=product.
[8]. Tommaso Bianchi, Alessandro Brighente, Mauro Conti, and Edoardo Pavan, “SoK: Stealing Cars Since Remote Keyless Entry Introduction and How to Defend From It,” in Proceedings of the 3rd USENIX Symposium on Vehicle Security and Privacy (USENIX Association, 2025), 161–78, especially 162–64, 169, and 171. https://www.usenix.org/system/files/vehiclesec25-bianchi.pdf.
[9]. Aurélien Francillon, Boris Danev, and Srdjan Čapkun, “Relay Attacks on Passive Keyless Entry and Start Systems in Modern Cars,” Network and Distributed System Security Symposium, 2011. https://www.ndss-symposium.org/wp-content/uploads/2017/09/franc.pdf.
[10]. Bianchi et al., “SoK: Stealing Cars,” 169. https://www.usenix.org/system/files/vehiclesec25-bianchi.pdf.
[11]. Chris Valasek and Charlie Miller, “Remote Exploitation of an Unaltered Passenger Vehicle,” IOActive, August 5, 2015. https://www.ioactive.com/remote-exploitation-of-an-unaltered-passenger-vehicle/.
[12]. Berg Insight, “Connected Cars with OEM Telematics to Reach 580M by 2030,” research announcement reproduced by I-Connect007, July 20, 2026. Figures refer to embedded connectivity; 338 million is the active installed base at year-end 2025 and 83 percent is the 2025 new-car attach rate. https://iconnect007.com/article/150850/connected-cars-with-oem-telematics-to-reach-580m-by-2030/150847/ein.
[13]. Alissa Knight, interview by Ashish Rajan, “What Is a Connected Car? & How to Secure It’s API?,” Cloud Security Podcast, May 24, 2020, transcript, approximately 5:20–8:00. https://www.cloudsecuritypodcast.tv/videos/what-is-a-connected-car-how-to-secure-its-api.
[14]. Sam Curry, “Hacking Kia: Remotely Controlling Cars With Just a License Plate,” September 20, 2024. The write-up credits Neiko Rivera, Sam Curry, Justin Rhinehart, Ian Carroll, and Kenneth Lugo, and states that the vulnerabilities were fixed. https://samcurry.net/hacking-kia.
[15]. Manos Antonakakis et al., “Understanding the Mirai Botnet,” in Proceedings of the 26th USENIX Security Symposium (USENIX Association, 2017), 1093–1110. https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-antonakakis.pdf.
[16]. SonicWall, 2023 SonicWall Cyber Threat Report (2023), 59–60; SonicWall, “SonicWall Threat Data Exposes Depths of Cyberattacks; Propels the Need for Managed Service Providers (MSPs),” February 21, 2024; SonicWall, “Threat Actors Are Moving Faster Than Ever,” February 25, 2025; and SonicWall, 2026 Cyber Protect Report (2026), 9. The chart keeps malware counts separate from later IoT exploit/attack growth rates; sensor coverage and methods can change. https://gcti.com/wp-content/uploads/2023-cyber-threat-report-SMALL.pdf. https://www.sonicwall.com/it-it/news/sonicwall-threat-data-exposes-depths-of-cyberattacks-propels-the-need-for-managed-service-providers-msps. https://www.sonicwall.com/zh-cn/news/threat-actors-are-moving-faster-than-ever-sonicwall-warns-smbs-and-highlights-the-importance-of-not-fighting-alone. https://it.ie/wp-content/uploads/2026/04/sonicwall_cyber_protect_2026.pdf.
[17]. Robert White, personal recollection of remarks by Bonnie L. Triezenberg of RAND Corporation at the Military Tactical Communications Summit, National Harbor, MD, September 10–11, 2025, recounted September 13, 2026. This passage paraphrases the author’s recollection. For the advertised speaker and event details, see Defense Strategies Institute, “Announcing Defense Strategies Institute’s 14th Annual Military Tactical Communications Summit,” press release, July 16, 2025, https://www.pr.com/press-release/943228.
[18]. Alissa Knight, with Brandon Dunlap, moderator, “From Ground Control to Star Wars: What Satellite Hacks Reveal About Defending APIs from Autonomous AI,” ISC2 Security Briefings, sponsored by Assail AI, September 8, 2026, webcast description. Date, speakers, recorded status, and lab scope are documented in the official channel’s RSS entry for communication 674769. https://www.isc2.org/professional-development/webinars/security-briefing?commid=674769. https://www.brighttalk.com/service/channel/v2/channel/13159/feed/rss.
[19]. Alissa Valentina Knight, announcement of “From Ground Control to Star Wars: Hacking Satellite Constellations Using Autonomous AI,” DAFITC 2026 presentation, LinkedIn, accessed September 13, 2026. The announcement describes the isolated lab and the role of the AI harness. https://www.linkedin.com/posts/alissaknight_dafitc-dafitc26-ai-activity-7491541992326201344-dVdI.
[20]. Viasat, Inc., “KA-SAT Network Cyber Attack Overview,” March 30, 2022, especially “Incident Summary.” https://www.viasat.com/perspectives/corporate/2022/ka-sat-network-cyber-attack-overview/.
[21]. National Highway Traffic Safety Administration, Cybersecurity Best Practices for the Safety of Modern Vehicles, updated September 2022, especially 3, 5–6, and 12–17. https://www.nhtsa.gov/sites/nhtsa.gov/files/2022-09/cybersecurity-best-practices-safety-modern-vehicles-2022-tag.pdf.
[22]. Michael Fagan, Katerina N. Megas, Karen Scarfone, and Matthew Smith, IoT Device Cybersecurity Capability Core Baseline, NISTIR 8259A (National Institute of Standards and Technology, May 2020), 5 and 8–9. https://doi.org/10.6028/NIST.IR.8259A.
[23]. National Highway Traffic Safety Administration, Cybersecurity Best Practices, 5–6 and 12–17. https://www.nhtsa.gov/sites/nhtsa.gov/files/2022-09/cybersecurity-best-practices-safety-modern-vehicles-2022-tag.pdf.
[24]. National Highway Traffic Safety Administration, Cybersecurity Best Practices, 12–14; Viasat, “KA-SAT Network Cyber Attack Overview.” https://www.nhtsa.gov/sites/nhtsa.gov/files/2022-09/cybersecurity-best-practices-safety-modern-vehicles-2022-tag.pdf. https://www.viasat.com/perspectives/corporate/2022/ka-sat-network-cyber-attack-overview/.
[25]. OWASP API Security Project, “API1:2023 Broken Object Level Authorization,” OWASP API Security Top 10—2023. https://api-security.owasp.org/editions/2023/en/0xa1-broken-object-level-authorization/.
[26]. National Highway Traffic Safety Administration, Cybersecurity Best Practices, 5–6 and 12–17. https://www.nhtsa.gov/sites/nhtsa.gov/files/2022-09/cybersecurity-best-practices-safety-modern-vehicles-2022-tag.pdf.