Saint Harmony Hub, With Spare Keys in the House

Patron of universal remotes, the smart home, and service accounts nobody knew existed.

Life

On 19 December 2018 Tenable disclosed that the Logitech Harmony universal hub, before version 4.15.206, contained two accounts written straight into the firmware, inside the XMPP server. Whoever knew them could connect remotely to the device's local API, that is to the brain of the living room that commands the TV, lights and blinds, using the spare keys left by the manufacturer.

Prayer

O Saint Harmony Hub, who keeps two keys too many under the firmware's doormat, let credentials be born unique and not in batches. Amen.

How to celebrate

Celebrated by updating the firmware to 4.15.206 and searching every smart device for the keys the manufacturer forgot.