@scrchngwsl it is a bit scary, but for sites like Givenergy, I would assume they run behind the tech curve, so there’s every chance they’re still running a safe and secure version like 8.3 or 8.4. That said, you never know, and the world’s websites are dependent on PHP. We always run a version behind here on RHH for stability and plug-in compatibility more than anything else, but we’ll now add security to our update decisions. 

Posted by: @scrchngwsl

↑

Another angle to this is how vulnerable it leaves you to hackers.

I have a GivEnergy battery. The company, somewhat infamously, is now defunct. Their inverters, however, still phone home to GivEnergy's servers.

Those servers run PHP. PHP has a massive security flaw that essentially allows hackers to do whatever they want with the server. The fix has been released, but it requires server admins to apply the patch manually. It's not clear if whoever still operates GivEnergy's cloud servers will do that.

Consequently, a lot of consumers will now have inverters who are connected to a cloud that could have been hacked. Since those servers control the inverter's firmware/software updates, the hackers could force upload malicious software to your inverter at home.

The mitigation from an end user perspective is to change your router settings to block the inverter from connecting to the internet. You can still allow it to connect to your wifi, and thus be controlled locally, but not remotely via the cloud.

However, most users will not know anything about this. They won't know about the vulnerability in PHP. They won't know that GivEnergy's servers are affected and might be compromised indefinitely. They won't know that their inverters contact those servers and may be affected too. They won't know if their inverters have had malicious code uploaded to them by GivEnergy's servers. And they won't know how to change their router settings to block their inverter from connecting to the internet.

It's pretty scary tbh.

There is plenty of truth in this, @scrchngwsl, but it needs to also be tempered in a couple of areas.

The simple fact is that it is very difficult to find a commercial API that doesn't at times exchange what is known under GDPR as personally identifiable information. Any organisation that in some way handles or processes personally identifiable information has to do so in accordance with GDPR and the penalties are severe.

In the case of GivEnergy, those cloud servers may well now be run by someone else but if they are hacked and personal information is compromised then that someone else is liable. It doesn't matter whether they have commercial reasons for providing the service or if the service is being kept running by the goodness of their hearts. As a result, I can't say the GivEnergy cloud servers ARE being patched, but if they're not then the new owners of those servers are risking their business by not doing so. Given the new owners are a different arm of the GivEnergy group, I would therefore bet real money that they are at least trying to get the servers fixed. I would therefore certainly challenge the idea that the servers might be compromised "indefinitely".

Everything else you say about the risks of using cloud based services, about mitigations and about how much consumers typically realise is still valid, though. It's still scary, but we also shouldn't start jumping at shadows.

@editor I think that you're being a bit optimistic. From my brief investigation (I have a couple of trivial websites) I found this.

"PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately."

Which strongly implies that earlier versions are vulnerable. I wouldn't expect a nearly defunct company to be keeping up to date with patches.

Posted by: @hml1827

↑

@editor I think that you're being a bit optimistic. From my brief investigation (I have a couple of trivial websites) I found this.

"PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately."

Which strongly implies that earlier versions are vulnerable. I wouldn't expect a nearly defunct company to be keeping up to date with patches.

From what I have seen, this is a long standing vulnerability that was identified back in 2024 as a theoretical flaw but thought implausible to use in practice in an attack. AI has changed that and, thanks to a security company involved in the audit releasing a video too early of how to exploit the flaw, it has now become a high priority to fix. So yes, earlier versions are potentially vulnerable.

As for "a nearly defunct company", it's worth bearing in mind that GivEnergy Ltd is indeed either defunct or nearly so. However, it was or is part of a wider group that is anything but defunct and has a lot to lose if it were to be fined for breaching GDPR. Bear in mind that GDPR penalties can be applied upwards to the owning group. As far as I'm aware, the servers are now being run by GivEnergy Software Ltd and the current publicity over the vulnerability would leave them with little opportunity to claim patches weren't applied due to being unaware. I would most certainly expect them to be keeping up to date with patches in this case.

@hml1827 I've just checked our server and can confirm that Renewable Heating Hub is running on a PHP version that now includes the security fixes for these vulnerabilities, so touch wood, we're covered on that front.

It's a pretty serious vulnerability though, especially given the potential for unauthenticated remote code execution. Definitely not one to take lightly, and a timely reminder of just how important it is to keep server software patched and up to date. We pay a lot to keep our server secure and safe. 

Interestingly we had an internet outage about a month ago. A wiring fault in our phone line took out our internet connection for a week before someone from Open Reach eventually came round and fixed it. It was very annoying that we had to go through our internet provider for this, which resulted in three false starts on a problem that is supposed to be fixed urgently i.e. on a 24 hour timescale.

What we found was as follow:

The gas boiler didn't notice. It doesn't know what the internet is. It's smart functionality is limited to reading a thermistor (outdoor temperature reading for the weather compensation) and some switched live connections to turn things on an off for the heating and hot water. If the RF connection is lost to the portable programmable timer thermostat as happens when its battery runs out, then the gas boiler can be controlled on/off via two buttons on the RF receiver on the wall. However, usually we just replace the battery.

The Solar PV inverter kept doing what it does, charging the batteries overnight, exporting etc. We could no longer see it on the app, and have a gap in the monitoring data as a result. It is possible to connect to the inverter's own wifi via a smart phone or to control it via an LCD display on the front panel, however, we didn't bother with either. It just kept doing what it is supposed to do.

Heat pumps (two A2A units), app offline, but full functionality available via dumb remote controls - a bit clunky but could do everything the app can do just a bit slower.

Posted by: @batpred

↑

@scrchngwsl 

It can be a bit worse. 

Much software these days is developed so quickly that sometimes security is an optional upgrade. One that has not been budgeted for... 

Yes I actually have a copy of a tool that whenever a certain brand of "camping" style battery appears on a local network it will disable it to the point that it has to go back to the manufacturer. It's an accidental byproduct of reverse engineering.

The standards are also going down not up despite being abysmal to start with as people are now AI slopping together code, telling the AI to test it (at which point it usually makes up tests and test results) and then shipping it anyway.

I have been gradually moving away from cloud-based home control stuff and collecting everything into Home Assistant. 

Our heat pump is web-connected and can be remotely monitored or controlled via an app, or by the manufacturer. Honestly, I basically never use the app now, so this is mostly a potential risk. If we see any more attacks happening, like the supermarket freezer attack, I'll probably pull the connect key out or block its access to the internet. I get much better data out of Home Assistant anyway.

Apart from the heat pump, I've been moving smart devices to locally controlled zigbee, and have now removed every device from SmartThings, Alexa, Google Home etc. We do still have some Alexa speakers, but they now access devices exclusively through Home Assistant, not the other way around, and the set of devices they can control is minimal. I'm becoming increasingly interested in some of the homebrew stuff I've seen using Echo Dots, though, and there's a lot of people tinkering with other local smart speaker concepts, so I'm hopeful we'll be able to move away from this in time.

Recently, I've been looking at getting a home battery, but requirement number one is that it must be locally controllable.

The only things I haven't been able to get fully local are:

• Dishwasher - Some might argue having a 'smart' dishwasher is pointless. I'd agree. It came with the flat, though, so I connected it out of curiosity.
• Robovac - While I have brought control into Home Assistant, it still works over the cloud. Sadly, pretty much all robot vacuums are completely locked down. If/when I replace it, however, I'll be looking into something I can run with Valetudo.
• Ring Doorbell - This was a gift, but if it ever craps out on us, I'll move right on over to something local instead.

I wonder if worth evaluating what happens if our local grid is off? 
Ups takes over, but will we still be able to control the devices or do they require internet connectivity? 

Posted by: @steelbadger

↑

The only things I haven't been able to get fully local are:

...

• Dishwasher - Some might argue having a 'smart' dishwasher is pointless. I'd agree. It came with the flat, though, so I connected it out of curiosity.

I believe there's an integration for Home Assistant to support Home Connect for Bosch and Siemens kit using a direct local network connection. Anything else I'm not so sure about. That said, I'm with you; I personally need a "smart" dishwasher as much as I need lipstick on a pig. Others may find value but I don't and so don't have one.

Posted by: @steelbadger

↑

• Robovac - While I have brought control into Home Assistant, it still works over the cloud. Sadly, pretty much all robot vacuums are completely locked down. If/when I replace it, however, I'll be looking into something I can run with Valetudo.

You've reminded me of the world of pain that is Tuya. I have a Eufy robovac and retrospectively I'd've considered amateur self-dentistry in preference to setting the vac up in Home Assistant. That said, many robovacs that have a Tuya-based app actually have a local API so that control actually is local where possible.

Posted by: @steelbadger

↑

• Ring Doorbell - This was a gift, but if it ever craps out on us, I'll move right on over to something local instead.

We don't have a doorbell; people knock on the door. However, we do have a security camera above our porch, and that camera is:

1. PoE and therefore a wired connection and so immune to any wifi jammers.
2. Better quality video than most.
3. Linked to a network video recorder.
4. Integrated - along with the NVR - to Home Assistant via local connections.

One thing that occurs to me is that there's a lot of discussion on this topic about companies going bust, data security and so forth. However, whilst those points are valid there's a rather more mundane elephant in the room and that is that most people have spent thousands or - if we include inverters and heat pumps - perhaps tens of thousands on "smart" kit and yet funnel all that Internet traffic through a single £30 router. Many even rely on that router for local wifi as well so even local communication can be prone to the same single point of failure.

Moving control of smart devices over to local comms is a good move but it's well worth considering upgrading your link with the outside world to something designed to be a little more robust than the cheap kit your ISP considers the bare minimum necessary to keep you happy.

Some of that depends on the provider. I'd trust the hardware from folks like A&A or Zen for example for most uses as they tend to use good quality products - eg Zen use Fritzbox stuff. You pretty much can't replace them with most low end internet providers because you immediately get dropped into

"Our line is being unreliable"

"Our diagnostics can't see your equipment"

"I changed it"

"Then its your problem"

and also you now own maintaining the router and doing upgrades in a hurry sometimes whereas the ISP used to manage it.

Having a box between the ISP and your home stuff is a good practice, typically with anything that you don't trust on the ISP side or a separate ethernet so it so it can't get at your house either.