[BugsBunnySan]

a) the sockets all connect to a central server in China b) the sockets identify themselves to that server with their MAC address (kind of makes sense, it's a readily available, global unique (more or less) identifies) c) if you send a message to a socket (identified by its MAC address) from the app on your phone and your mobile phone can't find it on the local network, the app sends a message to the central server in China, which sends it on to the socket, if that happens to be turned on and is thus connected over the internet to that central server

So, it's not that you can suddenly magically access devices by MAC address over the Internet (MAC addresses are still local network only), but since the sockets are all connected to a central server who knows them by their MAC address, that makes it possible to send those messages.

This would all not be a problem with good crypto for authentication (and secrecy), but apparently they put pretty much none of that into the product/app. So it should be realtivly easy to find out the MAC address and then very easy to talk to the central server and tell it to send messages to whatever device.

(It's a little like an open relay mail server, and bad for similar reasons)

[gargravarr]

One other issue is that MAC addresses are allocated in contiguous blocks to manufacturers. If you know the general pattern (the first N characters are manufacturer-specific), there is precious little stopping you writing a script to loop through all the possibilities and spam the server with them. Most network devices have the MAC address printed on a label (with a barcode for an admin to scan), so it would be trivial to grab an example from a photo.

[BugsBunnySan]

"Your ideas are intriguing to me and I wish to subscribe to your newsletter!" XD

It would be pretty cool to remote control all of those sockets and make a blinkenlights display visible from space :D

[gargravarr]

I'll start the GitHub project :D

[Godel_unicode]

N=6, this is called the OUI.

[yuubi]

Sometimes N=9, such as when the address starts 00:50:c2. This block is divided into blocks of 4096 instead of the usual 2^24 so small users can get a block for a few hundred dollars instead of over a thousand.

[gargravarr]

Thanks for clarifying.