10:05 AM
Connect Directly

Security Holes Exposed In Smart Lighting System

Sylvania Osram Lightify vulnerabilities could allow an attacker to turn out the lights or ultimately infiltrate the corporate network.

Researchers at Rapid7 have uncovered flaws in the Home and Pro versions of Sylvania Osram Lightify products that could allow attackers to hack a corporate network via the lighting system in an office or retail store.  

Deral Heiland, research lead at Rapid7, says his tests were conducted with the full knowledge and cooperation of Sylvania, which already has issued patches for the vast majority of the discovered flaws. The most potentially harmful issues were found in the Pro Edition of the Osram Lightify, which is sold to businesses, mostly offices and retailers. 

The team found that Osram Lightify systems’ installed web management console, which runs on ports 80 and 443, is open to a persistent cross site scripting (XSS) vulnerability that could let a malicious actor inject JavaScript and HTML code into various fields within the Pro web management interface.

The injected code could be executed under the guise of an authenticated user, allowing an attacker to modify the system configuration, exfiltrate or alter stored data, or take controls of the product to launch browser-based attacks against the authenticated user’s workstation that manages the lighting system.

Heiland was also able to wage an XSS attack on the Wireless Client Mode configuration page via another XSS flaw the team found. He did this by using a rogue access point to broadcast via WiFi SSID containing the XSS payload. Using a script command, it’s possible to broadcast the XSS payload as an SSID name. This could allow an attacker to infiltrate the corporate network remotely.

“So essentially, it’s possible to put the exploit code in the SSID,” Heiland explains. “What’s dangerous is that it’s possible to reconfigure the device and then interact with the enterprise corporate network. In fact, the probability of using this to carry out further attacks and exploits against the device and the authenticated user to the device to exploit the network [remotely] is most likely.”

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

Heiland also found weak default WPA2 pre-shared keys (PSKs) on the devices he examined: they used an eight-character PSK that used only the characters from the set “0123456789abcdef.” This small keyspace of limited characters and a fixed, short length makes it possible to crack a captured WPA2 authentication handshake, which gives the hacker remote access to the cleartext WPA2 PSK.

“I was able to crack one device in about five hours and another device in about two hours,” Heiland says of his research.

Illuminating the Issue

Heiland added that a vendor-supplied patch will provide longer default PSKs that will use a larger keyspace that includes both uppercase and lowercase alphanumeric characters and punctuation. These are more secure because they are not typically intended to be remembered by humans.

Although the flaws found in the Home version of the Sylvania products were not as serious as the Pro version, Heiland says that it does give both the enterprise and home IoT industry more insight into the potential risk.

The Home edition contained a flaw in the pre-authentication command execution. When Heiland examined the network services on the gateway, he found that port 4000/TCP is used for local control when Internet services are down and it didn’t require authentication to pass commands to this TCP port.

With this access, a hacker can execute commands to change lighting and also execute commands to reconfigure the devices.

“While it’s not as serious as the flaw we found in the Pro edition -- which could access a corporate network -- we thought it was important to point these type of flaws out so they don’t migrate to the Pro editions,” he says.

UPDATE 7/27:

Osram provided this statement to Dark Reading:

"OSRAM agreed to security testing on existing LIGHTIFY products by Security researchers from Rapid7. Since being notified about the vulnerabilities identified by Rapid7, OSRAM has taken actions to analyze, validate and implement a risk-based remediation strategy, and the majority of vulnerabilities will be patched in the next version update, currently planned for release in August. 

Rapid7 security researchers also highlighted certain vulnerabilities within the ZigBee® protocol, which are unfortunately not in OSRAM’s area of influence. OSRAM is in ongoing coordination with the ZigBee® Alliance in relation to known and newly discovered vulnerabilities."

Related Content:



Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
New Cold Boot Attack Gives Hackers the Keys to PCs, Macs
Kelly Sheridan, Staff Editor, Dark Reading,  9/13/2018
Yahoo Class-Action Suits Set for Settlement
Dark Reading Staff 9/17/2018
RDP Ports Prove Hot Commodities on the Dark Web
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2018
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
Flash Poll
How Data Breaches Affect the Enterprise
How Data Breaches Affect the Enterprise
This report, offers new data on the frequency of data breaches, the losses they cause, and the steps that organizations are taking to prevent them in the future. Read the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2018-09-19
An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations...
PUBLISHED: 2018-09-19
Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service (application crash) exploitable by miners via duplicate input. An attacker can make bitcoind or Bitcoin-Qt crash.
PUBLISHED: 2018-09-18
Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility.
PUBLISHED: 2018-09-18
Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.
PUBLISHED: 2018-09-18
An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escal...