Su Casa Es Mi Casa – Vera automation hub hacked

Xipiter has a great write-up on how they hacked the MiCasaVerde Vera quickly and easily:

The device has embedded SSH private keys on THE IMMUTABLE sections of the firmware image so we know that all these devices have the same embedded ssh key. It uses that key to access the manufacturers backend and set up ssh port forwards… While this a simple little device, the ability to attack it on the local network and potentially reach it THROUGH the manufacturers own servers as a beachhead to other computers on your home network is a reminder of why devices like this need to be understood better

This is a good illustration how the funky remote access methods for Vera got them into trouble. They would be better served with the API keys & calls other IoT hubs have been focused on. If you are running a Vera, it may be worth investigating offline mode until there is some confirmation that the remote access is possible or not.