Comment New attack vector (Score 1) 113
All of these units will have to phone-home to a central server in order to get real-time updates on the status of the load on the grid. That data will be used to determine if it's ok to turn on or not. I can envision a plausible scenario where there is mass distribution/usage of these units, the grid starts relying on them (i.e. they don't plan for the extra load on the system any more), then some malware is deployed that exploits a vulnerability in these devices which essentially tells all of them simultaneously to turn themselves on which might result in rolling black-outs.
Worse - the malware could overwrite the firmware of these thermostats such that they are always on 100% for the opposite temperature you want (i.e. set it to "cool to 30 degrees in winter" and "heat to 120 degrees in summer") then semi-brick them so that no future firmware updates can be made. That would screw with the customers and the grid if it was deployed during a heatwave or an ice storm. Imagine trying to coordinate manually fixing hundreds of thousands of thermostats during a major weather event.
