Slashdot Mirror
Hacking Internet Connected Light Bulbs
An anonymous reader writes We've been calling it for years — connect everything in your house to the internet, and people will find a way to attack it. This post provides a technical walkthrough of how internet-connected lighting systems are vulnerable to outside attacks. Quoting: "With the Contiki installed Raven network interface we were in a position to monitor and inject network traffic into the LIFX mesh network. The protocol observed appeared to be, in the most part, unencrypted. This allowed us to easily dissect the protocol, craft messages to control the light bulbs and replay arbitrary packet payloads. ... Monitoring packets captured from the mesh network whilst adding new bulbs, we were able to identify the specific packets in which the WiFi network credentials were shared among the bulbs. The on-boarding process consists of the master bulb broadcasting for new bulbs on the network. A new bulb responds to the master and then requests the WiFi details to be transferred. The master bulb then broadcasts the WiFi details, encrypted, across the mesh network. The new bulb is then added to the list of available bulbs in the LIFX smart phone application."
Just don't do it.
Get free satoshi (Bitcoin) and Dogecoins
Imagine if Pinky and the Brain had possessed such capabilities! They could not have been stopped.
quiquid id est, timeo puellas et oscula dantes.
At least they didn't have to drill a hole through the roof.
It little behooves the best of us to comment on the rest of us.
1. offer some snazy new product that really isn't better than the current product
2. suck up data about the user under the guise of new cool tech features
3. ?????????????????????
4. PROFIT from the data
the key here is grabbing your data. having the ability to turn your lights on over the internet or change your home's temperature or some other useless feature for crazy OCD mental people who need total control over everything is just a cover to get hands on data about you
No need to mess with anybody. Just read temperature sensors with home-brew receiver. It now scans the entire range and decodes multiple models of sensors. Most of the 433MHz sensors are extremely easy to decode... I see no reason why they shouldn't be. Would suck if they encrypted them. The power outlet control devices though.... why would you not encrypt that? I was able to start controlling my own 110v devices with custom receiver/transmitter in about 1 day of hacking no problem. . Should be easy to control the neighbors as well (if I were so inclined). Of course, with some elevation and more power, it would be possible to be extremely annoying. In summary, make your transmit only devices un-encrypted. Make your read/write devices encrypted.
data signal between them depends on the quality of the electrical wiring itself. On top of that, improper wiring and circuit breakers can also negatively affect the performance.
While I presume the parent is meant to be some sort of satire, it's interesting that throughout history, slaves and then servants have generally been accepted in all these locations doing the same looking and listening. And the slaves/servants talked to each other -- they just didn't talk that much to the upper class, so what they said wasn't considered an issue.
What we're doing here is making our electronics replace those people, which is a good thing. The bad thing is that while we accept the devices in our lives, and consider their "conversation" meaningless to us, that conversation can be manipulated by anyone with some smarts and a network connection. So insead of slaves escaping or this month's maid getting fed up and moving on, you have devices that can leak all your personal information they have access to (lights tend to know when you're home) to the benefit of someone else.
Here's a list of reasons why I don't like the Internet of Things:
1) Internet of Things devices could watch me while I sleep.
2) Internet of Things devices could watch me while I pee.
3) Internet of Things devices could watch me while I make kaka.
4) Internet of Things devices could watch me while I pleasure myself.
5) Internet of Things devices could watch me while I wash my body in the shower.
6) Internet of Things devices could watch me while I relax in the tub.
7) Internet of Things devices could watch me while I brush my teeth.
8) Internet of Things devices could watch me while I make passionate love to my wife.
9) Internet of Things devices could watch me while I brush my hair.
10) Internet of Things devices could watch me while I read a book.
11) Internet of Things devices could watch me while I read Slashdot.
12) Internet of Things devices could watch me while I bake cake.
13) Internet of Things devices could watch me while I put in my contact lenses.
14) Internet of Things devices could watch me while I get ready to play golf.
15) Internet of Things devices could watch me while I do my laundry.
16) Internet of Things devices could watch me while I think about rugby.
17) Internet of Things devices could watch me while I tie my shoes.
18) Internet of Things devices could watch me while I celebrate the 4th of July.
19) Internet of Things devices could watch me while I water my flowers.
20) Internet of Things devices could watch me while I eat ham.
21) Internet of Things devices could watch me while I use my stapler to staple documents.
22) Internet of Things devices could watch me while I chew bubble gum.
23) Internet of Things devices could watch me while I check the oil in my car.
24) Internet of Things devices could watch me while I look for my TV remote.
25) Internet of Things devices could watch me while I blow my nose.
26) Internet of Things devices could watch me while I rearrange my stamp collection.
27) Internet of Things devices could watch me while I listen to the Backstreet Boys.
28) Internet of Things devices could watch me while I do my calisthenics.
29) Internet of Things devices could watch me while I search for a paper clip.
30) Internet of Things devices could send information about me to advertisers.
31) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I sleep.
32) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I pee.
33) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I make kaka.
34) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I pleasure myself.
35) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I wash my body in the shower.
36) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I relax in the tub.
37) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I brush my teeth.
38) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I make passionate love to my wife.
39) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I brush my hair.
40) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I read a book.
41) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I read Slashdot.
42) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I bake cake.
43) Internet of Things devices could let advertisers use the data unsuspectingly coll
Err - you're vastly missing the point.
Take a wifi antenna with moderate gain.
Now, wave it around.
If you're within 200m or so of one of these light-bulb networks, you can pretend to be a new bulb, and request the wifi login details.
You now simply tell the master bulb that you're the master bulb now, and should do all the wifi stuff (just to make very sure that no alarm bells go off).
Now, you fire up your wifi, with the MAC set to the old master bulbs MAC, and now simply login to the AP with the credentials you just downloaded.
And now, you can do whatever.
I would not want some advertising company to watch me while I'm in the shower, or while I'm urinating or defecating.
Then don't mount a security camera in your bathroom.
Unless you have a legally defensible reason for doing so, such as the care of a physically frail parent or grandparent.
I recall visiting a house in the 1950s that had all the light switchs connected to a relay bank in the basement. (low voltage to the switches). This meant for example that you could push the right switch and turn every light in the house on at once. Of course this had to be done when the house was being built. The home was owned by a GE employee. Here is a link to parts for that kind of system: http://www.kyleswitchplates.com/ge-low-voltage-relays-transformers/
So all you have really done is changed from dedicated wiring to using the internet. (and some more options). Note that this system did not really catch on. GE now just sells similar units for offices and factories where one switch can turn on a whole floor of lights using relays.
So its just a more up to date version of an old system (I suspect you could find similar systems in the 1920s as well)
And no one remembers the episode of the Big Bang Theory where the guys did just that and let hackers control their lights and remote control cars?
data unsuspectingly collected about me while I listen to the Backstreet Boys.
Your list all seemed like normal stuff until I got to that one.
Now I see what you have to hide. You should be ashamed.
Erm, no, it doesn't. The LIFX bulbs establish a wireless RF mesh network amongst themselves. This isn't X-10.
The bulbs don't have to be on the same circuit, or technically, even in the same house.
Mission: To provide products that consume time and energy as entertainingly as permitted by the laws of thermodynamics.
That's the whole point of TFA. A lightbulb will hand out the WiFi credentials to anything impersonating another lightbulb.
No need to crack WPA, just hop into the mesh network, announce that you're a lightbulb, and the keys are handed to you.
So, your lights, thermostat, lawn-watering controller, swimming pool monitor, and eventually your TV and your refrigerator become attack surfaces that roll over just by looking at them and saying "please".
Mission: To provide products that consume time and energy as entertainingly as permitted by the laws of thermodynamics.
type the same phrase over and over, but could have copy/pasted if i really understood the internet of things.
The way it works is that they bundle a cool app to go with the product, which needs some server-side work to process your data.
This creates them a nice trojan horse to carry your data to be datamined.
If the app is convenient enough to use, it quickly trumps most people's concerns of privacy.
They are actually connected to the Internet. The lights can be controlled through a smartphone. The bulbs use WiFi instead of Ethernet.
#1 - You're not that interesting.
#2 - Connected devices can have interesting power management solutions. It's not just adjusting the home temperature when it figures out no one's going to be home for 8 hours. What about adjusting when the fridge uses the most power during times when electricity is the cheapest? Or sending you a text message if the motion detectors go off but your car is not in the driveway/garage? Or have lights go on just after dusk (regardless of time of year) and go out at a random time between 10 and 11pm (unless motion suggests people are home)?
The upfront cost of these devices are a bit more. To be absorbed by early adopters, of course. But when the prices come down and the kinks straightened out, they can be quite useful.
OnTopic: My neighbor showed me the app he had on his phone to monitor his pool. It allowed him to monitor temperature, pH, turn the filter and heater on, etc. The installer gave it a default 4 digit passcode, which was apparently the same four digit passcode that every other installation had. Since the ID number of the pool was adjustable, my neighbor joked that he would sometimes log into random people's pools and flash their pool lights (and had others do it to him as well). Fortunately no one's raised the pool temperature to 90 degrees or something like that (yet).
Help! I'm a slashdot refugee.
while he sits in his mother's basement watching me as a wash my groin in the shower.
People actually wash their groins?
The new right fascists are bilingual. They speak English and Bullshit.
Because that would require planning for, designing, and implementing security as a first principle, rather than just making sure the phone app has pretty glowing buttons.
I'm not saying that these things must be insecure, just that most of them currently are insecure.
Mission: To provide products that consume time and energy as entertainingly as permitted by the laws of thermodynamics.