Slashdot Mirror
Hacking Lightbulbs To Cause a Sustained Blackout
An anonymous reader writes "Researcher Nitesh Dhanjani just published an evaluation of the Philips Hue wireless lighting system that is available at Apple stores (and online). These lightbulbs come with a wireless bridge that you can control from your iPhone. Dhanjani has published a video demonstrating a vulnerability he found that can be exploited by malware to cause a sustained blackout. The video shows how the malware script can continuously turn the light bulbs off. Dhanjani also discusses other scenarios such as the systems' tie in with IFTTT (If This Then That) to cause a blackout by tagging a Facebook user on a completely black photo. Lots of interesting ideas on security vulnerabilities targeting future malware and smart devices. The paper can be downloaded here (PDF)."
Why do I feel like I'm standing in line at the supermarket reading the cover of some tabloid rag right now...
It seems to me a bit frivolous to be connecting lights, toilets, refrigerators and whatnot to wireless technology.
Some people die at 25 and aren't buried until 75. -Benjamin Franklin
On, controllable, off?
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
Black Ops?
More worried about sustained 5 to 45Hz strobes giving everyone seizures.
A simple script doing the equivalent of a pecker toy on the wireless "off switch". And that's "hacking" and "a security vulnerability".
Guys, if this is "security research" then it's no wonder we're making no progress.
Turning off a single or set of light bulbs is not a "sustained blackout." Shutdown all electrical systems in a city (or at least a neighborhood) and maybe you can start talking blackout. But turning off a couple of light bulbs isn't even inconvenient. What kind of hyperbolic dipshittery headline writing is this?
Apologies in advance for the trolling but that section seems a bit unnecessary... it's basically saying "if something bad happens to the service you use, something bad can happen to you"?
The light device has little to do with the hypothetical compromise of a cloud service IMO. As well as the feature of changing hue from another image. "Blackout" is a little alarmist when it's just doing what it's told to do...
The hack/comprimised access itself is neat though.
I guess I should maybe rethink my purchase of my Philips Wireless Beltbuckle.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
"Which is precisely the sort of thing we need to know," insisted the girl. "Do people want fire that can be fitted nasally?"
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Now that the mood lighting has been disabled I can proceed with my insidious plot.
My only political goal is to see to it that no political party achieves its goals.
Why do light bulbs need IP addresses?
Security issues aside, wireless connectivity uses some small amount of power. To me this is energy wasting of the highest order. My lightbulbs constantly listening for the one time per month that maybe I want to turn them on from my phone? Yes please and a side of mountain top removal coal mining please!
Great warrior...hrmph! Wars not make one great.
Well, i have a lot of these bulbs in my house. And since the protocol is open (zigbee protocol) anyone can script a "blackout". Or a disco. The only news in this article is that somehow the handshake token gets hijacked by the script. Well, anyone near the bridge can just create a new token, so there is no need to hijack one.
The hack described in the article is interesting from a technical perspective, but the use of the term "blackout" is hysterical and misleading.
When I think of the term "blackout", I take that to mean no more 120/240 in any of my sockets.
Yes, appliance hacks are something that we all should think about as more and more of the ubiquitous appliances, like lights, HVAC, water and sewer, that truly make the modern world function come online, but cmon....
I need one of these for when my group has star parties. One that covers about 50 miles in all directions.
There is no reason for a light bulb to be connected to the internet, this proves it. If you are too stupid or lazy to be able to turn on/off your own lights using a mechanical switch you deserve getting the "blackout of shame".
I haven't thought of anything clever to put here, but then again most of you haven't either.
Why would anyone want to connect stuff to the Internet that doesn't need it?
Appliances, lighting, heating/AC, etc. being hackable is a more massive security risk than losing data on your computer - if someone screws with your gas oven, for example, death is a possible outcome.
To me, power savings and the "hey, cool" factor isn't worth it. Some stuff should not be publicly accessible, and core infrastructure is what comes to mind first.
Mr Bean did this with television sets:
http://youtu.be/RtNpuYJSwjM?t=6m42s
Aye, I was rather dubious of this product for this reason and others. Another fundamental problem is they're taking something simple and cheap and adding a great deal of complexity and cost to it which increases the price, reduces the market and lowers reliability. I don't need lightbulbs that can think for themselves, talk to each other or talk to me. Just turn on and off. That's enough.
Its sold at APPLE STORES!! Oh noes!! FUD FUD FUD!
Have gnu, will travel.
Power companies are putting in smart meters that will allow them to turn off your power at their command for unpaid bills but the kicker is that they also will be allowed to turn off your air conditioner when they think it's best for them do to so. Forget if you have an old person living with you that can't take the heat outside. http://tucsoncitizen.com/wryheat/2013/02/18/tep-wants-to-control-your-air-conditioner-this-summer/
Paul: Father... father, the sleeper has awakened! - Dune
Why do we consider multiple security vulnerabilities in control software a 'smart' device? More like a stupid device designed by a fool!
Everything wireless is less secure than its wired counterpart. Always prefer wired if given an option.
The only question to ask yourself is how bad is the potential downside?
Just think of the most basic aspects. Wireless by definition means *direct these signals through the air in all directions and receive signals from the air in all directions*
What could possibly go right?
Wireless communication between car components? No thanks!
Wireless lights everywhere? No thanks!
Apparently the android version of the software is awful. It's missing a ton of features available on iOS. They can't even bother to release adequate software on multiple platforms, let alone think about security.
The last three Philips products I've bought have all malfunctioned somehow. I've vowed never to buy their stuff again. I have to admit I was tempted this time. Glad I did not.
Has network connection = can be hacked. That's a law of physics. If you don't want your [insert device here] to get hacked, make sure it doesn't have any form of networking capabilities. If you're still on the fence, go watch Ghost in the Shell: Standalone Complex.
...sound a little bit like what we used to do with fax machines, Fax someone a black piece of paper. As the leading edge of the paper comes out of the machine, scotch tape it to the trailing edge. Recipient's machine runs until it's out of paper or toner.
Everything old is new again...
Quite expensive, knowing a (remote) LED light controller costs only about 25$ and a LED (color)strip costs about 30$ ..
This can be hacked -way cheaper- through a microcontroller like Arduindo ..
--- I am known for the ones who want to find me on the net. Is that a privacy risk or a privilege? One might wonder..
So, what happens when your lights crash?
Waterfox - a Firefox fork with legacy extension support, security updates and better privacy by default.
Toaster of 2113:
Takes 2 minutes to boot, has 16 Yottabytes of memory and 2 Xenabytes of permanent storage.
After you put your toast in it, it rejects it on the basis that you've had too much white bread this week and the company doesn't want to be held liable for serving you more unhealthy food. ...After putting some brown bread in the toaster, the toaster plays an ad for some other food you can't eat whilst analyzing the DNA of the bread and checking that the seeds that made the bread were correctly licensed from Monsanto.
Waterfox - a Firefox fork with legacy extension support, security updates and better privacy by default.
do hese companies think that people want everything in their home to connect to the internet? I can see my PC, my tablet, my kindle, and my roku. Maybe a smartphone if I had one. Nothing else needs an internet connection for any reason! No my TV will never have a camera and a microphone! The only reason for a TV to have a camera and mic is to violate my privacy.
Same with other appliences and systems in my home. I have a "dumb" phone because a smartphone makes it too easy for my privacy to be violated in too many ways to count! Even then my "dumb" cell phone spends most of its time turned off and in a carry bag with my tablet and Kindle.
If the time ever comes that I cannot get a TV without camera and mic, I will stream video to my laptop. It doesn't have a camera, and its mic is disconnected. So called "smart appliences" that connect to the internet are just another way to violate peoples privacy.