Seamlessly Insecure: Uncovering Outsider Access Risks in AiDot-Controlled Matter Devices

Matter is the recently proclaimed standard for seamless interoperability among connected Internet of Things (IoT) devices, seeking to unify the fragmented IoT landscape. In this paper, we analyze a range of Matter-enabled devices, uncovering a critical security flaw within the manufacturer’s implementation of the device commissioning process. This flaw allows the adversary to exploit an unenrolled manufacturer channel on an operational Matter device to enable unauthorized access, without notifying the user or compromising the existing Matter connection. Our research expands the discourse beyond the traditionally emphasized insider threats by eliminating the need to know specific in-home devices and the victim’s WiFi credentials, thereby opening the door to malicious outsiders. Through comprehensive testing, we demonstrate that alarmingly, 5 out of 15 commercial Matter devices, from 4 distinct manufacturers, are vulnerable to unauthorized access by outsiders, facilitated through a singular smart platform app, AiDot. While the immediate impact is evident in smart bulbs and plugs, the ramifications become increasingly severe as manufacturers extend Matter implementation to critical devices, such as security cameras, door locks, and thermostats. In light of our findings, we advocate for urgent remedial measures, recommending the enforcement of a single active device channel at any given time, thereby enhancing the security of the IoT environment.