Google disabled remote control features for early Nest Learning Thermostats last month, yet the devices continue to transmit data back to Google. Security researcher Cody Kociemba investigated the situation and discovered that first- and second-generation Nest Learning Thermostats are still sending information such as manual temperature adjustments, occupancy detection, and sunlight exposure back to Google.
After replicating Google’s API to develop custom software, Kociemba accessed logs from customer devices that he subsequently disabled. He noted that while Google removed the ability to remotely control these devices, the systems still retain the capability to upload logs, which contain extensive data.
In addition to disabling remote access, Google has also stopped users from checking their device status through the Nest or Google Home app and has halted security and software updates. According to Google’s support documentation, the unsupported devices will continue to report logs used for issue diagnostics; however, Kociemba contends that the data being collected is no longer actionable.
Kociemba stated that the logs might include technical information like HVAC error states, but since Google has fully discontinued support for these devices, it cannot assist customers who rely on them, even in situations involving device malfunctions. He expressed surprise that the connection to Google was not entirely severed, maintaining a one-way flow of information.
As a result of his findings, Kociemba, along with another collaborator known as Team Dinosaur, received a reward of $14,772 from FULU for their efforts in restoring smart functionalities to the unsupported thermostats. Google has not yet responded to requests for comment on the matter.
Source: https://www.theverge.com/news/820600/google-nest-learning-thermostat-downgraded-data-collection