Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security //

Data Leakage

8/29/2018
09:05 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Data Leaks Via Smart Light Bulbs? Believe It

Researchers from the University of Texas at San Antonio have shown it's possible to exfiltrate data from a smart-bulb system. But there's no need to go back to candles just yet.

There are times when a threat model does not allow for unusual enabling devices, but a smart light bulb is not thought of as being one of them.

But two researchers from the University of Texas at San Antonio have shown that it is possible to exfiltrate information from an air-gapped system through their use.

There are some assumptions made in this work.

First, they assume the bulb (like a LIFX or a Phillips Hue) has a multimedia-visualization function enabled that is intended for use in conjunction with a song or video playing on a nearby media player. The intended result is a a vibrant lighting effect that synchronizes with the tones present in the audio or the dominant colors in the video stream, respectively.

This is what used to be called a "color organ" back in the day.

Comfreak via Pixabay
Comfreak via Pixabay

They found that audio-visualizing applications (which are separate from the bulb and use an on-device microphone) will transmit approximately 10 packets to the bulb per second, and video-visualizing applications transmit approximately 1 packet per second. Communication in the case of the LIFX bulbs happens with an 802.11 access point, whereas the Phillips Hue bulb employs 802.15.4 (Zigbee) protocol to communicate with the mobile app.

If the bulb also has an infrared capability (like the LIFX+), they show how it can be used to create a covert channel that can exfiltrate a user's private data out of his/her secured personal device or the network to which it is assumed to be connected. (The adversary is assumed to have infrared sensing capability, of course.)

For infrared exfiltration, the adversary also needs to insert some kind of malware which encodes private data from the target device and then feeds it to the smart light bulbs. This is a non-trivial part of the exploit that is assumed to be operational in order to get any actual exfiltration of data happening. Design of this software is left as an exercise for the reader.

Both indoor and outdoor receptors with optical lenses were used by the researchers to test the feasibility of the exploits. Indoor receptors gave more correct results, but acceptable results were seen even with the higher error rates of outdoor sensors.

Information exfiltration attacks on air-gapped systems by employing visible-light LED indicators have previously been shown.

But as the researchers state, "infrared-enabled smart lights can act as a superior data exfiltration gateway because (a) they have fine-grained control of brightness/intensity, which can be used to design communication protocols that achieve higher throughput, (b) they are brighter than LED indicators found on computers and routers, increasing the possibility of data reconstruction from a longer distance, and (c) the adversary does not have to surreptitiously place any additional malicious hardware in the target area (i.e., in addition to the smart light already installed by the user)."

So, the takeaway from all of this is simple. A smart bulb can be a data leak. It's a ubiquitous device that has to be considered when security models are developed.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3746
PUBLISHED: 2021-10-19
A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerability ...
CVE-2011-1075
PUBLISHED: 2021-10-19
FreeBSD's crontab calculates the MD5 sum of the previous and new cronjob to determine if any changes have been made before copying the new version in. In particular, it uses the MD5File() function, which takes a pathname as an argument, and is called with euid 0. A race condition in this process may...
CVE-2021-26589
PUBLISHED: 2021-10-19
A potential security vulnerability has been identified in HPE Superdome Flex Servers. The vulnerability could be remotely exploited to allow Cross Site Scripting (XSS) because the Session Cookie is missing an HttpOnly Attribute. HPE has provided a firmware update to resolve the vulnerability in HPE ...
CVE-2021-27001
PUBLISHED: 2021-10-19
Clustered Data ONTAP versions 9.x prior to 9.5P18, 9.6P16, 9.7P16, 9.8P7 and 9.9.1P2 are susceptible to a vulnerability which could allow an authenticated privileged local attacker to arbitrarily modify Compliance-mode WORM data prior to the end of the retention period.
CVE-2021-36832
PUBLISHED: 2021-10-19
WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][headline]) input.