Good to know, In my experience they have been getting better about security over the last year and are much harder to update without an account than they were a year ago. Also I am not connecting to the beacons when using them for location so the URL issue is not a problem for the indoor location use. Even with these issues someone would have to be in my yard to even attempt to overwrite information on the beacons...... So I would not use them to broadcast a URL, but I still feel completely safe reading power levels without connecting to the beacon. I'm sure many of us have Internet connected devices that are much more vulnerable to to attack.