Tavares Insurance Services

Received some good news today.
We are all being impacted by California's wild fires (if your a homeowners). And its become increasingly difficult to place coverage if your home is located in a brush exposure area.
Its not just what you believe or think, we have many local residential neighborhoods that fit the exposure.
So back to the good news, if your homeowners insurance either non-renews or increases your rates, we have been notified that additional carriers are coming into the California market for us to rate through.
Please keep us in mind for your insurance needs.
O. Tavares
Tavares Insurance Services

Is your teen koalafied to drive? Find out and learn more about your state's graduated driver licensing (GDL) laws.

State GDL Laws Before beginning practice driving, parents should make sure that their teens know their state GDL laws and how to follow them for safety.

Distracted driving is the cause of more than half of teen crashes – many of them fatal. Understand what causes distracted driving and how to talk to your teen about it to keep them 100% focused while behind the wheel.

The Largest Cause of Teen Crashes and What You Need to Know About It Distracted driving definition, examples, and stats. Teen distracted driving. How does distracted driving affect car insurance? What you need to know.

Teens and bad driving: they just don't click! October 20-26, 2019, is ! This week – and every week – talk to your teen about dangers for teen drivers, the rules of the road and how to stay safe behind the wheel of a car.

National Teen Driver Safety Week | Traffic Safety Marketing National Teen Driver Safety Week is October 20-26, 2019This week - and every week, parents should have conversations with their teens about the important rules they need to follow to stay safe behind the wheel of a motor vehicle. These rules address the greatest dangers for teen drivers: alcohol, in...

Smart Home Product Security Risks Can Be Alarming

Say you’re on your laptop at Starbucks, minding your own business, when an acquaintance of yours across the room isn’t minding his.

Unbeknownst to you, he’s using the same store Wi-Fi as you to conduct a virtual invasion of your smart home: accessing your light switch app and using it to disable your home’s security camera so real thieves can break in – or walk in, if he’s disabling the smart lock, too.

And you’re none the wiser – until you get home and discover your home’s been hacked. And burgled.

This is just one scenario demonstrating one of many inherent flaws that computer scientists at the College of William and Mary discovered in internet-connected smart home devices during tests they conducted over the summer.

This particular flaw allows hackers to attack a smart home’s low-security device – a light switch or thermostat, for instance – and use that access to attack a high-security device they could not otherwise access.

It’s one example of what’s called lateral privilege escalation, and experts warn that such smart home hacks are easier than you might think. They can lead to all kinds of potential mischief, if not outright harm, from switching off your security system to cranking up your smart oven until it overheats and burns the house down.

“The possibilities are limitless,” said Adwait Nadkarni, lead investigator and assistant professor of computer science. “There are so many devices in the home that affect your security, affect the integrity of your home.”

Experts say that in just two years there will be 20 billion smart home products in use.

“You can imagine the possible combinations of these kinds of attacks will obviously increase as we’ll have more interconnected devices,” said associate professor Denys Poshyvanyk. “At this point, it’s hard for us to imagine what else people will do.”

Nadkarni and Poshyvanyk co-authored a paper on their work that they’ll present at the 9th annual ACM Conference on Data and Application Security and Privacy in Dallas in March. Student co-authors include Kaushal Kafle and Sunil Manandhar and post-doctoral fellow Kevin Moran.

In the paper, they lay out the potential misuses of the computer routines or portions of code that control smart home products and offer 10 key findings with “serious security implications.”

“The diversity of these products is staggering,” the paper states, “ranging from small physical devices with embedded computers such as smart locks and light bulbs to full-fledged appliances such as refrigerators and HVAC systems.”

And the risks, it states, can be rather alarming.

“Because many of these products are tied to the user’s security or privacy (e.g., door locks, cameras), it is important to understand the attack surface of such devices and platforms in order build practical defenses without sacrificing utility.”

For their research, Nadkarni and Poshyvanyk focused on two of the most popular smart home platforms – Google Nest and Philips Hue – that implement home automation “routines.”

Routines are the interactions between smart home devices and the apps that control them. They are becoming the heart of seamless home automation.
Two Routines

According to the paper, there are two broad categories of routines: one that allows users to “chain together” a variety of devices using a third-party app interface, and one that uses a “centralized data store” as a sort of switchboard where devices and apps can communicate with each other over the internet.

Both are intended to make smart home automation more seamless for the user, and both were found to be vulnerable, giving hackers the ability to attack all the internet-connected devices in the home.

For the centralized data store platform, for instance, when you use your mobile app to communicate with a low-security device – say, a light switch – the device accesses your smart home using an authorization token.

“Anybody can steal that access token,” Nadkarni said, and use it to, say, make your smart home think you’re inside and turn off the security camera.

The scientists insist it’s not that hard.

“You don’t need any specialized education,” said Poshyvanyk. ‘You just need to know how to run certain programs. Even a high schooler could do that.”

They blame the vulnerabilities on consumer demand and the headlong rush to meet it.

“Manufacturers race to release these systems without having a good understanding of how they will be used in the wild,” Poshyvanyk said.

After the researchers identified the security flaws, they contacted platform vendors Google and Philips and app developer and manufacturer TP Link to report what they found.

TP Link fixed the flaw in its latest Kasa Switch light dimmer app, which prevents the type of theoretical lateral attack outlined earlier. Philips is expected to roll out a fix to its platform and Google is working to address vulnerabilities.

But the issue is bigger than one company – it’s the industry overall that needs to get smarter.

“We’re basically arguing that we need a systemic effort in terms of properly designing these systems with security in mind,” Poshyvanyk said.

“Because these problems will get worse with time. More devices will be added. (If) they’re not thinking about designing in security in the first place, we’re going to be having even bigger problems down the road.”