Labs · Cyber Security
Lab: Secure Your Home IoT: Inventory Smart Devices, Change Default Passwords, Update Firmware and Move Them to a Guest Network
Course: Cyber Security · Chapter 43: IoT and OT Security – Cameras, Smart Devices, Plant Networks
Chapter 43 covers IoT and OT security; this lab applies the same principles (inventory, credentials, patching, segmentation) to the smart devices in your own home.
Chala mitrano! Smart cameras, plugs, TVs and speakers are small computers that rarely get attention. Many still use default passwords and old firmware, and they sit on the same Wi-Fi as our laptops. Today we do what factories do for their machines: list them, lock them, update them, and put them in their own network. Chala, ghar smart ani safe!
चला मित्रांनो! Smart cameras, plugs, TVs आणि speakers हे छोटे computers आहेत ज्यांच्याकडे क्वचितच लक्ष दिलं जातं. अनेक अजूनही default passwords आणि जुनं firmware वापरतात, आणि आपल्या laptops च्याच Wi-Fi वर असतात. आज आपण factories त्यांच्या machines साठी जे करतात ते करणार: list करा, lock करा, update करा, आणि वेगळ्या network मध्ये ठेवा. चला, घर smart आणि safe!
चलो दोस्तों! Smart cameras, plugs, TVs और speakers छोटे computers हैं जिन पर शायद ही ध्यान जाता है। कई अभी भी default passwords और पुराना firmware इस्तेमाल करते हैं, और हमारे laptops वाले Wi-Fi पर ही होते हैं। आज हम वही करेंगे जो factories अपनी machines के लिए करती हैं: list करो, lock करो, update करो, और अलग network में रखो। चलो, घर smart और safe!
Suppose we are…
Suppose we work in the OT (operational technology) security team at Tata Steel, where every plant machine must be listed, patched and kept on a separate network. At home we have a TP-Link Tapo camera, a Mi smart plug, an Amazon Echo and a smart TV. We apply the same four plant rules at home: inventory, credentials, firmware, segmentation.
Goal of this lab
By the end you will have:
- An inventory of every device on your home network, with owner and purpose.
- Strong unique passwords and 2-step verification on each smart-device app account; default device passwords changed.
- Firmware updated, and smart devices moved to a guest or IoT Wi-Fi network away from laptops and phones.
What you need (all free)
- Admin access to your own home router (Lab 25) and the apps for your smart devices.
- Your password manager (Lab 22). About 40 minutes.
Safety and ethics
Change settings only on devices you or your family own. Never try default passwords on cameras or devices that belong to neighbours or anyone else, even if you can see them on a network.
Steps
-
Open your router admin page (Lab 25) and find the device list: Connected devices, DHCP clients or Device list.
What you should see: each device's name (for example
Tapo_C200,chuangmi-plug,Echo-Dot,android-xxxx), IP address and MAC address. -
Make an inventory table: Device, Brand/app, IP, Owner, Needed? , Default password changed?, Firmware version, Network (main/guest). Unknown devices: find them by unplugging devices one at a time, or remove them.
- For each smart device app (Tapo, Mi Home, Alexa, the TV's account), sign in and change the account password to a strong unique one from your password manager. Turn on 2-step verification in the app's account/security settings where available.
- Change device-level passwords where they exist, for example a camera's local/RTSP "camera account" password or a DVR/NVR admin password (CP Plus, Hikvision). Never leave
admin/adminoradmin/12345. -
Update firmware: in each app open the device → Settings → Firmware update (or Device info → Check for updates). Turn on auto-update if offered.
What you should see: "Latest version" for each device; note the version in your table.
-
Create or check a guest network on your router (Lab 25 challenge) with its own strong password and client/AP isolation on, so guest devices cannot reach your main network.
- Move smart devices to the guest network: in each app, use Wi-Fi settings or reset network and connect to the guest SSID. (Some devices need a reset and re-pairing; do it one at a time.)
-
Verify from your laptop on the main network:
arp -aWhat you should see: your router, phones and laptops, but no longer the smart devices' IPs (they are on the guest network now).
-
Check the devices still work from their apps on mobile data. Cloud-connected devices keep working from the guest network.
- Turn off features you do not use: camera cloud sharing with old accounts, "remote access" on a DVR, UPnP on the router (Lab 37 challenge).
Ravindra Bagale's Tip
Before buying a smart device, check three things: does the brand still release firmware updates, does the app support 2-step verification, and can you change the default password? A ₹500 cheaper camera with no updates becomes a permanent weak spot. Swasta pan mahaga padu shakta!
Ravindra Bagale's Tip – मराठी
Smart device विकत घेण्याआधी तीन गोष्टी check करा: brand अजून firmware updates देतो का, app मध्ये 2-step verification आहे का, आणि default password बदलता येतो का? Updates नसलेला ₹500 स्वस्त camera कायमचा कमकुवत बिंदू बनतो. स्वस्त पण महाग पडू शकतं!
Ravindra Bagale's Tip – हिंदी
Smart device खरीदने से पहले तीन बातें check करो: क्या brand अभी भी firmware updates देता है, क्या app में 2-step verification है, और क्या default password बदल सकते हैं? Updates के बिना ₹500 सस्ता camera हमेशा का कमज़ोर हिस्सा बन जाता है। सस्ता पर महँगा पड़ सकता है!
Common mistakes
| Mistake | What happens | Fix |
|---|---|---|
| Changing the Wi-Fi password but not the app account password | Someone with the old app password still sees the camera | Change app passwords and turn on 2-step verification |
| Leaving unknown devices on the network | A neighbour or old device keeps access | Identify or remove every unknown device |
| Guest network without client isolation | IoT devices can still reach laptops | Turn isolation on |
| Updating firmware during a power cut risk | Device can be bricked | Update on stable power, one device at a time |
| Sharing camera access with old phone numbers/accounts | Ex-tenants or old staff still watch | Review "shared users" in the camera app |
Self-check checklist
0 of 5 done
Try-at-home challenge
Your Tapo or CP Plus camera app shows a list of "shared users" or "family members". Who should be on it, and what do you do with the rest?
Check your answer
Only current family members who need live view. Remove old phones, ex-tenants, the installer's account and anyone you do not recognise. Then change the main account password, so removed people cannot simply log in again with old credentials.
Samjla ka? Inventory, credentials, firmware, segmentation: plant rules, at home. Aata pudhe jaauya: Chapter 44 secures the phone in your pocket.