Cloud

7/26/2016
10:05 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Security Holes Exposed In Smart Lighting System

Sylvania Osram Lightify vulnerabilities could allow an attacker to turn out the lights or ultimately infiltrate the corporate network.

Researchers at Rapid7 have uncovered flaws in the Home and Pro versions of Sylvania Osram Lightify products that could allow attackers to hack a corporate network via the lighting system in an office or retail store.  

Deral Heiland, research lead at Rapid7, says his tests were conducted with the full knowledge and cooperation of Sylvania, which already has issued patches for the vast majority of the discovered flaws. The most potentially harmful issues were found in the Pro Edition of the Osram Lightify, which is sold to businesses, mostly offices and retailers. 

The team found that Osram Lightify systems’ installed web management console, which runs on ports 80 and 443, is open to a persistent cross site scripting (XSS) vulnerability that could let a malicious actor inject JavaScript and HTML code into various fields within the Pro web management interface.

The injected code could be executed under the guise of an authenticated user, allowing an attacker to modify the system configuration, exfiltrate or alter stored data, or take controls of the product to launch browser-based attacks against the authenticated user’s workstation that manages the lighting system.

Heiland was also able to wage an XSS attack on the Wireless Client Mode configuration page via another XSS flaw the team found. He did this by using a rogue access point to broadcast via WiFi SSID containing the XSS payload. Using a script command, it’s possible to broadcast the XSS payload as an SSID name. This could allow an attacker to infiltrate the corporate network remotely.

“So essentially, it’s possible to put the exploit code in the SSID,” Heiland explains. “What’s dangerous is that it’s possible to reconfigure the device and then interact with the enterprise corporate network. In fact, the probability of using this to carry out further attacks and exploits against the device and the authenticated user to the device to exploit the network [remotely] is most likely.”

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

Heiland also found weak default WPA2 pre-shared keys (PSKs) on the devices he examined: they used an eight-character PSK that used only the characters from the set “0123456789abcdef.” This small keyspace of limited characters and a fixed, short length makes it possible to crack a captured WPA2 authentication handshake, which gives the hacker remote access to the cleartext WPA2 PSK.

“I was able to crack one device in about five hours and another device in about two hours,” Heiland says of his research.

Illuminating the Issue

Heiland added that a vendor-supplied patch will provide longer default PSKs that will use a larger keyspace that includes both uppercase and lowercase alphanumeric characters and punctuation. These are more secure because they are not typically intended to be remembered by humans.

Although the flaws found in the Home version of the Sylvania products were not as serious as the Pro version, Heiland says that it does give both the enterprise and home IoT industry more insight into the potential risk.

The Home edition contained a flaw in the pre-authentication command execution. When Heiland examined the network services on the gateway, he found that port 4000/TCP is used for local control when Internet services are down and it didn’t require authentication to pass commands to this TCP port.

With this access, a hacker can execute commands to change lighting and also execute commands to reconfigure the devices.

“While it’s not as serious as the flaw we found in the Pro edition -- which could access a corporate network -- we thought it was important to point these type of flaws out so they don’t migrate to the Pro editions,” he says.

UPDATE 7/27:

Osram provided this statement to Dark Reading:

"OSRAM agreed to security testing on existing LIGHTIFY products by Security researchers from Rapid7. Since being notified about the vulnerabilities identified by Rapid7, OSRAM has taken actions to analyze, validate and implement a risk-based remediation strategy, and the majority of vulnerabilities will be patched in the next version update, currently planned for release in August. 

Rapid7 security researchers also highlighted certain vulnerabilities within the ZigBee® protocol, which are unfortunately not in OSRAM’s area of influence. OSRAM is in ongoing coordination with the ZigBee® Alliance in relation to known and newly discovered vulnerabilities."

Related Content:

 

 

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
'Hidden Tunnels' Help Hackers Launch Financial Services Attacks
Kelly Sheridan, Staff Editor, Dark Reading,  6/20/2018
Inside a SamSam Ransomware Attack
Ajit Sancheti, CEO and Co-Founder, Preempt,  6/20/2018
Tesla Employee Steals, Sabotages Company Data
Jai Vijayan, Freelance writer,  6/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12697
PUBLISHED: 2018-06-23
A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in work_stuff_copy_to_from in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. This can occur during execution of objdump.
CVE-2018-12698
PUBLISHED: 2018-06-23
demangle_template in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM) during the "Create an array for saving the template argument values" XNEWVEC call. This can occur during execution of objdump.
CVE-2018-12699
PUBLISHED: 2018-06-23
finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write of 8 bytes. This can occur during execution of objdump.
CVE-2018-12700
PUBLISHED: 2018-06-23
A Stack Exhaustion issue was discovered in debug_write_type in debug.c in GNU Binutils 2.30 because of DEBUG_KIND_INDIRECT infinite recursion.
CVE-2018-11560
PUBLISHED: 2018-06-23
The webService binary on Insteon HD IP Camera White 2864-222 devices has a stack-based Buffer Overflow leading to Control-Flow Hijacking via a crafted usr key, as demonstrated by a long remoteIp parameter to cgi-bin/CGIProxy.fcgi on port 34100.