Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security //

Data Leakage

8/29/2018
09:05 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Data Leaks Via Smart Light Bulbs? Believe It

Researchers from the University of Texas at San Antonio have shown it's possible to exfiltrate data from a smart-bulb system. But there's no need to go back to candles just yet.

There are times when a threat model does not allow for unusual enabling devices, but a smart light bulb is not thought of as being one of them.

But two researchers from the University of Texas at San Antonio have shown that it is possible to exfiltrate information from an air-gapped system through their use.

There are some assumptions made in this work.

First, they assume the bulb (like a LIFX or a Phillips Hue) has a multimedia-visualization function enabled that is intended for use in conjunction with a song or video playing on a nearby media player. The intended result is a a vibrant lighting effect that synchronizes with the tones present in the audio or the dominant colors in the video stream, respectively.

This is what used to be called a "color organ" back in the day.

Comfreak via Pixabay
Comfreak via Pixabay

They found that audio-visualizing applications (which are separate from the bulb and use an on-device microphone) will transmit approximately 10 packets to the bulb per second, and video-visualizing applications transmit approximately 1 packet per second. Communication in the case of the LIFX bulbs happens with an 802.11 access point, whereas the Phillips Hue bulb employs 802.15.4 (Zigbee) protocol to communicate with the mobile app.

If the bulb also has an infrared capability (like the LIFX+), they show how it can be used to create a covert channel that can exfiltrate a user's private data out of his/her secured personal device or the network to which it is assumed to be connected. (The adversary is assumed to have infrared sensing capability, of course.)

For infrared exfiltration, the adversary also needs to insert some kind of malware which encodes private data from the target device and then feeds it to the smart light bulbs. This is a non-trivial part of the exploit that is assumed to be operational in order to get any actual exfiltration of data happening. Design of this software is left as an exercise for the reader.

Both indoor and outdoor receptors with optical lenses were used by the researchers to test the feasibility of the exploits. Indoor receptors gave more correct results, but acceptable results were seen even with the higher error rates of outdoor sensors.

Information exfiltration attacks on air-gapped systems by employing visible-light LED indicators have previously been shown.

But as the researchers state, "infrared-enabled smart lights can act as a superior data exfiltration gateway because (a) they have fine-grained control of brightness/intensity, which can be used to design communication protocols that achieve higher throughput, (b) they are brighter than LED indicators found on computers and routers, increasing the possibility of data reconstruction from a longer distance, and (c) the adversary does not have to surreptitiously place any additional malicious hardware in the target area (i.e., in addition to the smart light already installed by the user)."

So, the takeaway from all of this is simple. A smart bulb can be a data leak. It's a ubiquitous device that has to be considered when security models are developed.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21070
PUBLISHED: 2021-04-19
Adobe Robohelp version 2020.0.3 (and earlier) is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation. An attacker with permissions to write to the file system could leverage this vulnerability to escalate privileges.
CVE-2020-7851
PUBLISHED: 2021-04-19
Innorix Web-Based File Transfer Solution versuibs prior to and including 9.2.18.385 contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the internal method. A remote attacker could induce a user to access a crafted web page, causing damage...
CVE-2021-29399
PUBLISHED: 2021-04-19
XMB is vulnerable to cross-site scripting (XSS) due to inadequate filtering of BBCode input. This bug affects all versions of XMB. All XMB installations must be updated to versions 1.9.12.03 or 1.9.11.16.
CVE-2021-23381
PUBLISHED: 2021-04-18
This affects all versions of package killing. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23374
PUBLISHED: 2021-04-18
This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.