Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security //

Data Leakage

8/29/2018
09:05 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Data Leaks Via Smart Light Bulbs? Believe It

Researchers from the University of Texas at San Antonio have shown it's possible to exfiltrate data from a smart-bulb system. But there's no need to go back to candles just yet.

There are times when a threat model does not allow for unusual enabling devices, but a smart light bulb is not thought of as being one of them.

But two researchers from the University of Texas at San Antonio have shown that it is possible to exfiltrate information from an air-gapped system through their use.

There are some assumptions made in this work.

First, they assume the bulb (like a LIFX or a Phillips Hue) has a multimedia-visualization function enabled that is intended for use in conjunction with a song or video playing on a nearby media player. The intended result is a a vibrant lighting effect that synchronizes with the tones present in the audio or the dominant colors in the video stream, respectively.

This is what used to be called a "color organ" back in the day.

They found that audio-visualizing applications (which are separate from the bulb and use an on-device microphone) will transmit approximately 10 packets to the bulb per second, and video-visualizing applications transmit approximately 1 packet per second. Communication in the case of the LIFX bulbs happens with an 802.11 access point, whereas the Phillips Hue bulb employs 802.15.4 (Zigbee) protocol to communicate with the mobile app.

If the bulb also has an infrared capability (like the LIFX+), they show how it can be used to create a covert channel that can exfiltrate a user's private data out of his/her secured personal device or the network to which it is assumed to be connected. (The adversary is assumed to have infrared sensing capability, of course.)

For infrared exfiltration, the adversary also needs to insert some kind of malware which encodes private data from the target device and then feeds it to the smart light bulbs. This is a non-trivial part of the exploit that is assumed to be operational in order to get any actual exfiltration of data happening. Design of this software is left as an exercise for the reader.

Both indoor and outdoor receptors with optical lenses were used by the researchers to test the feasibility of the exploits. Indoor receptors gave more correct results, but acceptable results were seen even with the higher error rates of outdoor sensors.

Information exfiltration attacks on air-gapped systems by employing visible-light LED indicators have previously been shown.

But as the researchers state, "infrared-enabled smart lights can act as a superior data exfiltration gateway because (a) they have fine-grained control of brightness/intensity, which can be used to design communication protocols that achieve higher throughput, (b) they are brighter than LED indicators found on computers and routers, increasing the possibility of data reconstruction from a longer distance, and (c) the adversary does not have to surreptitiously place any additional malicious hardware in the target area (i.e., in addition to the smart light already installed by the user)."

So, the takeaway from all of this is simple. A smart bulb can be a data leak. It's a ubiquitous device that has to be considered when security models are developed.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Another COVID-19 Side Effect: Rising Nation-State Cyber Activity
Stephen Ward, VP, ThreatConnect,  7/1/2020
Lessons from COVID-19 Cyberattacks: Where Do We Go Next?
Derek Manky, Chief of Security Insights and Global Threat Alliances, FortiGuard Labs,  7/2/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15600
PUBLISHED: 2020-07-07
An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password.
CVE-2020-15599
PUBLISHED: 2020-07-07
Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.
CVE-2020-8916
PUBLISHED: 2020-07-07
A memory leak in Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, when used in an environment where wpanctl is directly interfacing with the control driver (eg: debug environments) can allow an attacker to crash the service (DoS). We recommend updating, or to res...
CVE-2020-12821
PUBLISHED: 2020-07-07
Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack.
CVE-2020-15008
PUBLISHED: 2020-07-07
A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user su...