Slashdot Mirror
Hacking Internet Connected Light Bulbs
An anonymous reader writes We've been calling it for years — connect everything in your house to the internet, and people will find a way to attack it. This post provides a technical walkthrough of how internet-connected lighting systems are vulnerable to outside attacks. Quoting: "With the Contiki installed Raven network interface we were in a position to monitor and inject network traffic into the LIFX mesh network. The protocol observed appeared to be, in the most part, unencrypted. This allowed us to easily dissect the protocol, craft messages to control the light bulbs and replay arbitrary packet payloads. ... Monitoring packets captured from the mesh network whilst adding new bulbs, we were able to identify the specific packets in which the WiFi network credentials were shared among the bulbs. The on-boarding process consists of the master bulb broadcasting for new bulbs on the network. A new bulb responds to the master and then requests the WiFi details to be transferred. The master bulb then broadcasts the WiFi details, encrypted, across the mesh network. The new bulb is then added to the list of available bulbs in the LIFX smart phone application."
Just don't do it.
Get free satoshi (Bitcoin) and Dogecoins
Imagine if Pinky and the Brain had possessed such capabilities! They could not have been stopped.
quiquid id est, timeo puellas et oscula dantes.
Every one of those bulbs is connected to a wired network for power, and then controlled by a poorly secured wireless network that is easily infiltrated or jammed. But it's soooo convenient... Shiny trinkets work every time.
At least they didn't have to drill a hole through the roof.
It little behooves the best of us to comment on the rest of us.
I've never heard of light bulbs like this before. But is it possible that they could some day include small, hidden cameras? This worries me, because I do not feel at all comfortable that such cameras, if they existed, would not be abused. I would not want some advertising company to watch me while I'm in the shower, or while I'm urinating or defecating. This whole idea about the internet of things or whatever it's called just creeps me out completely! I don't want advertisers watching me while I'm in the bathroom. I don't want them looking at my genitals and analyzing them and figuring out how to try to sell me more products that I don't even need.
I'm not a very technical person (I'm just a graphics designer) so I don't know a lot about all of these newfangled technologies. But everything I read about the Internet of Things scares the living bajeezus out of me! I don't want these devices listening to me or monitoring me or maybe even taking pictures and video of me while I'm showering or pissing or making poopoo or making love with myself and my signficant other. Doesn't this bother anyone else? Don't other people think it's sick and disgusting to have Internet of Things devices monitor them while they're in the bathroom? Why are such devices seen as being good? The thought of being monitored like that makes me want to vomit. I don't want these devices peering into my trousers or ogling my naked body, especially while I'm doing my private bodily business!
No need to mess with anybody. Just read temperature sensors with home-brew receiver. It now scans the entire range and decodes multiple models of sensors. Most of the 433MHz sensors are extremely easy to decode... I see no reason why they shouldn't be. Would suck if they encrypted them. The power outlet control devices though.... why would you not encrypt that? I was able to start controlling my own 110v devices with custom receiver/transmitter in about 1 day of hacking no problem. . Should be easy to control the neighbors as well (if I were so inclined). Of course, with some elevation and more power, it would be possible to be extremely annoying. In summary, make your transmit only devices un-encrypted. Make your read/write devices encrypted.
I think many such fears are unfounded. 99.999% of the time, these devices will do exactly what they claim to do, and nothing more. Remote control of a lightbulb is mostly trivial, but the complexity required to upload pictures or video or sound is orders of magnitudes higher.
I'm not saying it's not possible, just quite unlikely as it will drive up the production costs, power consumption, and complexity of such devices. It would also be pretty hard to hide in many cases. For this to be a real concern, some entity would have to have a serious vested interest in spending an inordinate amount of money to subsidize the cost or products just to see you poop. Not to mention that if they ever got caught, the lawyer and pitchfork mob would destroy them. Few people in the world are powerful enough to absorb that kind of anger and wrath.
The nice thing about home device communication standards, is that there are none...
Yes. The NSA is watching you. Now please don't post this silly question a third time.
I see what you're saying, but I just don't know if that's how things will turn out in the long term, or even in the medium term.
Just look at cell phones, for crying out loud. I went to get a new phone a few weeks ago, and even the cheapest minimalist phones my telecom provider was offering had cameras and GPS built in, along with the microphone that's obviously needed since it's a phone, and Internet capabilities. Even their shittiest low end clamshell phone had these features, and that phone was retailing for $15 without any sort of discount or subsidy! I couldn't get a plain old cell phone that was just a phone. They didn't offer them!
If a phone with all of those features costs under $20 today, I can totally see such things being way cheaper in the near future, and then ending up even in something as simple as a light bulb soon enough after that. Maybe the light bulb vendor will only want a board with wireless Internet on it, but in order to get just that it ends up being cheaper to get integrated components that have everything included. So now your IoT light bulb not only has Internet access but it also has a camera, a microphone, GPS and other sensors, even if it doesn't use any of them.
Then all it takes is a crafty neighbor to use his electronics skills and his Linux skills and his C skills to whip up a device that can control my light bulbs and their unused functionality. Now the camera that wasn't being used is controlled by him, while he sits in his mother's basement watching me as a wash my groin in the shower. He might even pleasure himself while he watches me shower. I find that to be a repulsive idea.
This is the future we're facing. I don't like it one bit!
So someone will be able to turn on and off someone else's light bulbs at the expense of their time. Life is too short to try to do it or worry that this might happen to you. I take security seriously but this is not a case where security is in danger.
While I presume the parent is meant to be some sort of satire, it's interesting that throughout history, slaves and then servants have generally been accepted in all these locations doing the same looking and listening. And the slaves/servants talked to each other -- they just didn't talk that much to the upper class, so what they said wasn't considered an issue.
What we're doing here is making our electronics replace those people, which is a good thing. The bad thing is that while we accept the devices in our lives, and consider their "conversation" meaningless to us, that conversation can be manipulated by anyone with some smarts and a network connection. So insead of slaves escaping or this month's maid getting fed up and moving on, you have devices that can leak all your personal information they have access to (lights tend to know when you're home) to the benefit of someone else.
Here's a list of reasons why I don't like the Internet of Things:
1) Internet of Things devices could watch me while I sleep.
2) Internet of Things devices could watch me while I pee.
3) Internet of Things devices could watch me while I make kaka.
4) Internet of Things devices could watch me while I pleasure myself.
5) Internet of Things devices could watch me while I wash my body in the shower.
6) Internet of Things devices could watch me while I relax in the tub.
7) Internet of Things devices could watch me while I brush my teeth.
8) Internet of Things devices could watch me while I make passionate love to my wife.
9) Internet of Things devices could watch me while I brush my hair.
10) Internet of Things devices could watch me while I read a book.
11) Internet of Things devices could watch me while I read Slashdot.
12) Internet of Things devices could watch me while I bake cake.
13) Internet of Things devices could watch me while I put in my contact lenses.
14) Internet of Things devices could watch me while I get ready to play golf.
15) Internet of Things devices could watch me while I do my laundry.
16) Internet of Things devices could watch me while I think about rugby.
17) Internet of Things devices could watch me while I tie my shoes.
18) Internet of Things devices could watch me while I celebrate the 4th of July.
19) Internet of Things devices could watch me while I water my flowers.
20) Internet of Things devices could watch me while I eat ham.
21) Internet of Things devices could watch me while I use my stapler to staple documents.
22) Internet of Things devices could watch me while I chew bubble gum.
23) Internet of Things devices could watch me while I check the oil in my car.
24) Internet of Things devices could watch me while I look for my TV remote.
25) Internet of Things devices could watch me while I blow my nose.
26) Internet of Things devices could watch me while I rearrange my stamp collection.
27) Internet of Things devices could watch me while I listen to the Backstreet Boys.
28) Internet of Things devices could watch me while I do my calisthenics.
29) Internet of Things devices could watch me while I search for a paper clip.
30) Internet of Things devices could send information about me to advertisers.
31) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I sleep.
32) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I pee.
33) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I make kaka.
34) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I pleasure myself.
35) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I wash my body in the shower.
36) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I relax in the tub.
37) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I brush my teeth.
38) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I make passionate love to my wife.
39) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I brush my hair.
40) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I read a book.
41) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I read Slashdot.
42) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I bake cake.
43) Internet of Things devices could let advertisers use the data unsuspectingly coll
If you do it right then only your stuff can see and control your other stuff. If you let google, apple, or ms provide the service or user interface then...
I work on IoT devices and all comms are encrypted. You can hang out forever on the mesh (network) and not see anything. You can do a denial of service by spraying on the frequencies but you can't see traffic.
I recall visiting a house in the 1950s that had all the light switchs connected to a relay bank in the basement. (low voltage to the switches). This meant for example that you could push the right switch and turn every light in the house on at once. Of course this had to be done when the house was being built. The home was owned by a GE employee. Here is a link to parts for that kind of system: http://www.kyleswitchplates.com/ge-low-voltage-relays-transformers/
So all you have really done is changed from dedicated wiring to using the internet. (and some more options). Note that this system did not really catch on. GE now just sells similar units for offices and factories where one switch can turn on a whole floor of lights using relays.
So its just a more up to date version of an old system (I suspect you could find similar systems in the 1920s as well)
"consists of the master bulb broadcasting for new bulbs on the network. A new bulb responds to the master "
So the new bulbs are 'Slaves'? 'Followers'? 'Disciples'?
There is no Master but Master, and QT1 is His prophet.
And no one remembers the episode of the Big Bang Theory where the guys did just that and let hackers control their lights and remote control cars?
since when are light bulbs connected to the internet? I guess they have ethernet ports?
data unsuspectingly collected about me while I listen to the Backstreet Boys.
Your list all seemed like normal stuff until I got to that one.
Now I see what you have to hide. You should be ashamed.
Why not break in to the WiFi network while you're at it. Then you could access somebody's computer's camera, microphone and files. Even steal their money. Oh wait, the computer is a 'thing', right? Scary stuff. Soon we'll have a global network of those things.
type the same phrase over and over, but could have copy/pasted if i really understood the internet of things.
The way it works is that they bundle a cool app to go with the product, which needs some server-side work to process your data.
This creates them a nice trojan horse to carry your data to be datamined.
If the app is convenient enough to use, it quickly trumps most people's concerns of privacy.
What is this "Hacking Internet"? Has somebody set up a parallel Internet, just for hackers, on the cheap by creating a giant mesh network of networkable light bulbs?
(Come to think of it, when it comes to choosing a technology for a fledgling WAN, light (in the form of lasers) seems like it could be a fairly good choice for long, point-to-point links, for which radio is likely to require licensing.)
#1 - You're not that interesting.
#2 - Connected devices can have interesting power management solutions. It's not just adjusting the home temperature when it figures out no one's going to be home for 8 hours. What about adjusting when the fridge uses the most power during times when electricity is the cheapest? Or sending you a text message if the motion detectors go off but your car is not in the driveway/garage? Or have lights go on just after dusk (regardless of time of year) and go out at a random time between 10 and 11pm (unless motion suggests people are home)?
The upfront cost of these devices are a bit more. To be absorbed by early adopters, of course. But when the prices come down and the kinks straightened out, they can be quite useful.
OnTopic: My neighbor showed me the app he had on his phone to monitor his pool. It allowed him to monitor temperature, pH, turn the filter and heater on, etc. The installer gave it a default 4 digit passcode, which was apparently the same four digit passcode that every other installation had. Since the ID number of the pool was adjustable, my neighbor joked that he would sometimes log into random people's pools and flash their pool lights (and had others do it to him as well). Fortunately no one's raised the pool temperature to 90 degrees or something like that (yet).
Help! I'm a slashdot refugee.
>Monitoring packets captured from the mesh network whilst adding new bulbs, we were able to identify the specific
Really, wtf uses the word "whilst" outside of a comic book?
Don't mean to be a troll, since the article almost provides useful information, but come on.
https://www.youtube.com/watch?...
The new right fascists are bilingual. They speak English and Bullshit.
Seriously a list of 60 reasons LOL. Wish I had the ability to deduct some of those time and add to something here that needs more time.