Smart Lightbulbs Used to Compromise Home and Business Networks

guest · Feb 5, 2020

Smart Lightbulbs Used to Compromise Home and Business Networks
February 5, 2020
https://www.securityweek.com/smart-lightbulbs-used-compromise-home-and-business-networks

In 2016, earlier researchers were able to compromise Philips Hue lightbulbs with malicious firmware, and then propagate to other adjacent lightbulbs. The vendor was able to fix the propagation issue, but due to design issues was unable to fix the original vulnerability.

Now researchers at Check Point have been able to use this initial vulnerability to compromise the lightbulb and use it as a platform to take over first the controlling bridge, and then -- using vulnerabilities in the ZigBee communication protocol -- to propagate to other devices on the network.
ZigBee is a communication protocol that allows different smart products from different manufacturers to communicate with each other.

"Check Point's researchers," said the firm in a blog report, "showed how a threat actor could exploit an IoT network (smart lightbulbs and their control bridge) to launch attacks on conventional computer networks in homes, businesses or even smart cities."
Click to expand...

Check Point reported the issue to Philips and Signify (owner of the Philips Hue brand) in November 2019, but is not releasing full technical details of the hack until users have a chance to install the fix.

"We are thankful for responsible disclosure and collaboration from Check Point," said George Yianni, head of technology at Philips Hue in a statement. "It has allowed us to develop and deploy the necessary patches to avoid any consumers being put at risk."
Click to expand...

Check Point: The Dark Side of Smart Lighting: Check Point Research Shows How Business and Home Networks Can Be Hacked from a Lightbulb

Could attackers somehow bridge the gap between the physical IoT network (the lightbulbs) and attack even more appealing targets, such as the computer network in our homes, offices or even our smart city?

And the answer is: Yes.
Click to expand...

The research was disclosed to Philips and Signify (owner of the Philips Hue brand) in November 2019. Signify confirmed the existence of the vulnerability in their product, and issued a patched firmware version (Firmware 1935144040) which is now available on their site. We recommend users to make sure that their product received the automatic update of this firmware version.
Click to expand...

guest · Aug 12, 2020

https://research.checkpoint.com/2020/10th-august-threat-intelligence-bulletin/

Check Point Research has shared the details about vulnerabilities in Philips Hue IoT lightbulbs. By masquerading as a legitimate ZigBee lightbulb, researchers were able to infiltrate the IP network using a remote over-the-air ZigBee exploit.

Click to expand...

Don’t be silly – it’s only a lightbulb
August 7, 2020
https://research.checkpoint.com/2020/dont-be-silly-its-only-a-lightbulb/

ZigBee 101
According to Wikipedia, “ZigBee is an IEEE 802.15.4-based specification for a suite of high-level communication protocols used to create … low-power, low data rate, and close proximity wireless ad hoc networks.”
Meet Our Target
Our target for this research is the Philips Hue line of products, and more specifically, the Philips Hue Bridge. As a side note: the Hue line of products originated in the Philips-Lighting division of Philips and is now branded under a third company called Signify.
Click to expand...

Coordinated Disclosure

5 November 2019 – Vulnerabilities were disclosed to Philips, and forwarded to Signify. [...]

5 February 2020 – We released a demo video to raise awareness, and held the technical details until users have enough time to update their products.

7 August 2020 – Full public disclosure during DEF CON 28.

We just presented our talk "Don't Be Silly - It's Only a Lightbulb" on #DEFCONSafeMode, revealing the technical details behind our research of hacking a network through smart lightbulbs
Click to expand...

Presentation:

https://github.com/eyalitki/presentations
2020-08 - Don't Be Silly - It's Only a Lightbulb.pdf
Click to expand...

Log in or Sign up

Smart Lightbulbs Used to Compromise Home and Business Networks

guest Guest

guest Guest

Log in or Sign up

Smart Lightbulbs Used to Compromise Home and Business Networks

guest Guest

guest Guest

Useful Searches