From Temporary Access to Persistent Surveillance: Why Matter Matters in Smart Homes

2026-10-02

AI Summary

This study addresses critical design flaws in the Matter standard within physical access scenarios, demonstrating that brief adversarial contact enables credential extraction and device impersonation to achieve persistent surveillance and control over smart home ecosystems. Without relying on protocol reverse engineering, this work identifies cross-vendor attack surfaces through cryptographic analysis and protocol parsing. The proposed attack paths are validated in a simulated smart home environment utilizing a hybrid deployment of commercial off-the-shelf devices and development boards. By successfully demonstrating credential extraction and device spoofing, this research confirms that transient physical access can be escalated into permanent control. Furthermore, four targeted defense mechanisms are proposed, substantially enhancing both the awareness and resilience of the Matter ecosystem against physical threats.

Abstract

Matter aims to unify smart home ecosystems through an open, interoperable, and secure standard, relying on cryptographic mechanisms for device authentication and data confidentiality. However, its openness also exposes protocol details, credential structures, and implementation characteristics to adversaries. We show that an attacker with temporary physical access can exploit design and implementation flaws to extract credentials and impersonate devices and controllers. These replicas integrate seamlessly into the fabric, enabling persistent surveillance and control even after the attacker departs. Notably, the attack is vendor-agnostic and requires no device-specific reverse engineering, as long as the device is not physically secured. We validate its practicality through a proof-of-concept on a simulated smart home with both commercial devices and development boards. Our findings uncover previously underestimated attack surfaces in Matter, particularly under physical access scenarios, and motivate four targeted mitigation strategies.

Problem

• Matter protocol
• smart home security
• physical access attack
• persistent surveillance
• credential extraction

Innovation

• Matter protocol
• Smart home security
• Credential extraction
• Physical access attack
• Device impersonation