Smart speakers, cameras, doorbells, plugs, TVs — the average connected home now runs a dozen internet-connected devices, and almost none of them shipped secure. The uncomfortable truth is that your smart home is a small network with the same problems as a corporate one: default passwords, stale firmware, and devices phoning home with data you never agreed to share. Here is how to fix that without throwing anything away.
Why IoT devices are the soft target
Three structural problems, none of them your fault:
- Default credentials: many devices ship with admin/admin or a printed password nobody changes.
- No update culture: unlike phones, IoT firmware is rarely updated — vendors release fixes, users never install them.
- Always-on and always-listening: a device with a microphone and a network connection is a listening post if compromised.
Step 1 — Put them on their own network
This single change prevents most smart-home damage. If a camera is compromised, the attacker is trapped on the IoT network and can’t reach your laptop, phone or NAS. Use your router’s guest network or, better, a dedicated VLAN/SSID for IoT. Most consumer routers support a guest network — put every smart device on it and keep your computers on the main network.
Then lock the router itself down: our router security guide covers the seventeen settings to check, and the 24-step home check shows where it fits in the wider picture.
Step 2 — Change every default password and enable MFA
Account-by-account: change the password, and if the vendor’s app supports two-factor authentication, turn it on. A compromised camera account means strangers watching your home — this is the highest-stakes password in the house. Store them in your password manager, never the notes app.
Step 3 — Kill the data you never agreed to share
Smart devices generate a surprising amount of telemetry: viewing habits, motion patterns, voice snippets, which rooms you’re in. Practical reductions:
- Turn off “improve our services” toggles in every device app — these usually mean “send us usage data”.
- Disable microphone on devices that don’t need it or use the physical mute switch where one exists.
- Set camera motion zones so they don’t record the street you don’t own and the neighbour’s window you shouldn’t.
- Enable local storage instead of cloud where the device supports it — your footage stays in the house.
- Review voice/audio history and delete it; then turn off automatic retention.
- Remove devices you no longer use — a dusty smart plug still on the network is an open door.
Step 4 — Keep firmware current
Enable auto-update wherever the device offers it, and set a calendar reminder twice a year to check the rest. This is the least glamorous step and the one that closes the most known vulnerabilities. If a device hasn’t seen a firmware update in years and the vendor no longer exists, treat it as untrusted — replace it or isolate it.
The realistic threat model
Are nation-state actors watching your doorbell? No. The plausible risks are: bulk scanning for exposed cameras (real and constant), a compromised vendor account spilling your data, and a cheap device used as a launchpad against the rest of your network. The four steps above defeat all three, and the total time investment is about an evening.
For the broader device and identity picture, the free Security Hub collects every guide — including the phishing red flags and public Wi-Fi traps that reach your home network from outside.
Frequently Asked Questions
Can my smart speaker really be hacked?
Yes — usually through reused or default credentials on the linked account, or unpatched firmware. The mitigation is the same as any account: unique password in a manager, MFA if offered, auto-updates on, and the device on an isolated network so compromise stays contained.
Is a separate network for smart devices worth it?
It’s the single highest-value change for a connected home. Guests and IoT devices on a separate SSID means a compromised camera can’t reach your laptop or files. Most consumer routers support a guest network, so the setup cost is minutes.
Should I cover my webcam?
A physical cover is a cheap, honest control for cameras in private rooms, and many devices ship with one. Treat it as a complement to the real work — passwords, isolation and updates — not a replacement. For indoor cameras, also check that the app’s motion zones and recording rules don’t capture areas you’d rather not keep.