Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security //

Data Leakage

8/29/2018
09:05 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Data Leaks Via Smart Light Bulbs? Believe It

Researchers from the University of Texas at San Antonio have shown it's possible to exfiltrate data from a smart-bulb system. But there's no need to go back to candles just yet.

There are times when a threat model does not allow for unusual enabling devices, but a smart light bulb is not thought of as being one of them.

But two researchers from the University of Texas at San Antonio have shown that it is possible to exfiltrate information from an air-gapped system through their use.

There are some assumptions made in this work.

First, they assume the bulb (like a LIFX or a Phillips Hue) has a multimedia-visualization function enabled that is intended for use in conjunction with a song or video playing on a nearby media player. The intended result is a a vibrant lighting effect that synchronizes with the tones present in the audio or the dominant colors in the video stream, respectively.

This is what used to be called a "color organ" back in the day.

Comfreak via Pixabay
Comfreak via Pixabay

They found that audio-visualizing applications (which are separate from the bulb and use an on-device microphone) will transmit approximately 10 packets to the bulb per second, and video-visualizing applications transmit approximately 1 packet per second. Communication in the case of the LIFX bulbs happens with an 802.11 access point, whereas the Phillips Hue bulb employs 802.15.4 (Zigbee) protocol to communicate with the mobile app.

If the bulb also has an infrared capability (like the LIFX+), they show how it can be used to create a covert channel that can exfiltrate a user's private data out of his/her secured personal device or the network to which it is assumed to be connected. (The adversary is assumed to have infrared sensing capability, of course.)

For infrared exfiltration, the adversary also needs to insert some kind of malware which encodes private data from the target device and then feeds it to the smart light bulbs. This is a non-trivial part of the exploit that is assumed to be operational in order to get any actual exfiltration of data happening. Design of this software is left as an exercise for the reader.

Both indoor and outdoor receptors with optical lenses were used by the researchers to test the feasibility of the exploits. Indoor receptors gave more correct results, but acceptable results were seen even with the higher error rates of outdoor sensors.

Information exfiltration attacks on air-gapped systems by employing visible-light LED indicators have previously been shown.

But as the researchers state, "infrared-enabled smart lights can act as a superior data exfiltration gateway because (a) they have fine-grained control of brightness/intensity, which can be used to design communication protocols that achieve higher throughput, (b) they are brighter than LED indicators found on computers and routers, increasing the possibility of data reconstruction from a longer distance, and (c) the adversary does not have to surreptitiously place any additional malicious hardware in the target area (i.e., in addition to the smart light already installed by the user)."

So, the takeaway from all of this is simple. A smart bulb can be a data leak. It's a ubiquitous device that has to be considered when security models are developed.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3830
PUBLISHED: 2021-09-26
btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-21742
PUBLISHED: 2021-09-25
There is an information leak vulnerability in the message service app of a ZTE mobile phone. Due to improper parameter settings, attackers could use this vulnerability to obtain some sensitive information of users by accessing specific pages.
CVE-2020-20508
PUBLISHED: 2021-09-24
Shopkit v2.7 contains a reflective cross-site scripting (XSS) vulnerability in the /account/register component, which allows attackers to hijack user credentials via a crafted payload in the E-Mail text field.
CVE-2020-20514
PUBLISHED: 2021-09-24
A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated attackers to delete all users.
CVE-2016-6555
PUBLISHED: 2021-09-24
OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP trap supplied data. By creating a malicious SNMP trap, an attacker can store an XSS payload which will trigger when a user of the web UI views the events list page. This issue was fixed in ver...