Novel Attack Technique Uses Smart Light Bulbs to Steal Data | Hacker News Reader

Novel Attack Technique Uses Smart Light Bulbs to Steal Data

bleepingcomputer.com

84 pointsyaseen-rob39 comments

If one of the "novel attacks" is against this:

>while in the case of video visualizations, the modifications reflect the dominant color and brightness level in the current video frame.

How does this leak anything that your TV screen doesn't leak already?

This just in! People outside your window can see what color your TV screen is glowing! People at particular angles can retrieve a 4K visual representation of the media you're viewing!

I'll take a moment to spell out what's going on here, since they seem to be beating around the bush in the article itself, possibly for fear of imitation in the wild.

They take a smart lightbulb with certain features: infrared and media decoders.

They specifically hijack the infrared portion of the bulb's spectrum only. Why?

Because standing right next to the bulb, you wouldn't notice it flickering hot/cold, at millisecond intervals. So they can create a channel in the IR range to send anything they want, and go unnoticed.

So, then, at any time (not just while you are watching movies) that bulb can be made to send any information, and not just add atmosphere to your viewing habits. Indeed, it can both exfiltrate arbitrary data, without you noticing, by flickering in the invisible heat region, AND also follow along with your movies, independently, Much in the same way it can blend a blue channel and a yellow channel into green ambient light.

It needs the media decoder, so that they can gain fine-grained access to the bulb's transmission state. It needs malware and local network access to create the implant and continuously relay data to steal.

The benefit here is that it might ba able to amplify reads at a distance, perhaps greater than wi-fi. The signal is degraded at 50 meters, but if one wished to transmit a very course signal at lower bandwidth, it need not be a high-detail image, such as lena.

It could be the heavily aliased bitmaps of your password, read from across the street from a hotel parking lot, where a hotel has installed these bulbs in every room.

It could also use a control signal sequence, to automate sniffed passwords. For example, have a passive video buffer watching a specific window, waiting for S-O-S, before it starts recording, then it captures 60 second interval, and ceases for a 5 second quiet period, to await the next S-O-S.

I'm talking about their "Deducing victim's music and video tastes" section.

The data exfiltratiom part is after that, titled "Data exfiltration from personal devices", which yes, is a new means of transmitting data. Under the assumptions that there's no authentication to control the lights and that they have malware running on your computer already.

But my point is that the whole first section is absurd. Leaking what's on the TV via a light that shows the average color of what's on the TV? It's already on the TV. Stop looking at the light from the lightbulb and look at the TV. If you can't see the TV directly, look at the light from the TV, which is already the same color as what the lightbulb would tell you.

The music part doesn't seem any better. You know what's a good way to figure out what music someone's listening to? A microphone. Granted a light might be visible from farther away, but if someone is running party lights the music is probably not quiet.

Honestly, you're just being argumentative. The researchers haven't proposed that they've backdoored your computer, but historically every impressive hacking feat is built on a stack of "obvious in hind-sight" novel abuses.

Instead of writing it off as Rube Goldberg over-engineering, it would be a lot more useful (and fun) to consider what these sort of attacks could do in less obvious conditions.

The people who put the 2600hz tone whistles in the breakfast cereal didn't anticipate Apple computers.

>Instead of writing it off as Rube Goldberg over-engineering, it would be a lot more useful (and fun) to consider what these sort of attacks could do in less obvious conditions.

Having slept on it, I still can't come up with a situation where the "average screen color" mode reveals anything that wasn't already public with higher fidelity.

Maybe you can help me out?

For remote surveillance, you can use a laser microphone up to 4-500 meters away from the target house. No hardware or software in the house required.

With a $20 dongle you can perform TEMPEST attacks on the display itself.

https://www.rtl-sdr.com/tempestsdr-a-sdr-tool-for-eavesdropp...

Also this:

Moreover, the adversary needs to plant malware that encodes private data from the target device and sends it to the smart light bulbs.

...if you can already install/run code of your choice, why not just send the data out over the network and into the Internet?

Maybe there is a firewall? Lots of people put smart bulbs on their own subnet that is cut off from the internet.

Honestly, that doesn't strike me as something lots of people know how to do, nor take the effort to.

Five people tops. Maybe six.

O HAI, other four people, maybe five.

I'd never have thought that I'd need to put my audio speakers and bathroom scale behind a firewall would be a thing, but it's 2018 and here we are.

I threw my smart lightbulbs out entirely.

> I threw my smart lightbulbs out entirely.

Smart move. Perhaps I'm becoming a dinosaur (at the tender age of 34 no less!) but I genuinely never saw the appeal of these things.

I’m in an early ‘60s model house where the electrical circuit demands were way less than they are today. When the house was flipped, the living area had 4 incadessant can lights added to the existing fan/light combo. All of that is on a single switch. So for me to have the fan on, it reuired the 4 heat generating can lights to be on at 100%. It was much cheaper to add 4 LED smart lights to the cans than to completely rewire the circuit to have multiple switch legs. That was the appeal to me that pushed me over the wdge to buy them. Plus, now I have energy saving bulbs, I havent had to replace a bulb since, and now they are dimmable which is a bigger deal now than I would have thought prior to having them.

I dont try to turn the lights on remotely or any of those features. I have taken steps to prevent them from being online. I know this works because the app is constantly reminding me that it cant check for updates.

In in an apartment where I can't install hardwired dimmers, so lightbulbs are the only way I can have my lighting at all adjustable. Color is a bonus.

Uploading data to a server leaves a trail. Theoretically there are allegedly untraceable servers leased in the underground but they're quite expensive and you never know who's actually running them. In this scenario the risk is limited.

Don’t smart bulbs have the ability to connect to and broadcast to arbitrary networks?

Reminds me of TEMPEST https://en.m.wikipedia.org/wiki/Tempest_%28codename%29

and System bus radio https://fulldecent.github.io/system-bus-radio/

> Light bulbs need to support infrared lighting and should not require authorization for controlling them over the local network. Moreover, the adversary needs to plant malware that encodes private data from the target device and sends it to the smart light bulbs.

If you've already exploited the target device, why not just send private data to the attacker's servers instead? This has to be one of the most convoluted attack vectors.

To exfiltrate data from a network not connected to the internet. Drop USB drive in parking lot to get malware inside the network. Use a signaling mechanism like this one to get data out.

Heck, drop a smart bulb in the parking lot...

This might sound too obvious to work but I know a non-zero number of people who picked up lightbulbs and plugged them in at home.

I know a non-zero number of people who picked up telecommunications panels, terminals, monitors, trunk test equipment, access codes and other items and plugged them in at home.

https://en.wikipedia.org/wiki/Kevin_Poulsen

https://archive.org/stream/JustinTannerPeterson/1346919-0_-_...

>A couple of hours later, Neal accompanied Poulsen to his condominium down the street from SRI. Against one wall stood a six-foot-long phone monitoring station. Strewn on the floor or stuffed in the closet were line-testing equipment, trunk test sets, telecommunication panels, terminals, monitors, cables and a switching device. At the same time that he had an SRI security clearance, Poulsen had been pulling nighttime burglaries on Pacific Bell facilities, stealing manuals, passwords, anything that might provide access, the San Jose indictment charged. The handful of books and papers ranged from "How to Buy Stocks" to a copy of "Watchmen," a violent comic book scries, to a bright yellow report binder that might have been scribbled by an eighth-grader but for its title. "Burglar Alarm Procedures."

>A police photograph taken at the scene showed Poulsen leaning against the door, a sour look on his long face. "I had him sign a copy of what we were taking away," says Neal. "I think he finally realized there wasn't going to be an easy way out."

Or in a network with intrusion detection or firewalls this could be a way to exfiltrate data without the system noticing.

TBH a a network with intrusion detection or firewalls doesn't really go in the same room as a smart bulb. You don't build a secure network and then say "hey, I should put some fun into it" :).

Nonsense. As smart light bulbs get even cheaper and more likely, the chances of them being used to achieve useful ends, like automatically dimming up and down as daylight requires, turning off when not needed at light-level instead of room-level, et cetera, rises. Once they're cheaper than alternative methods of doing that they _will_ be used, and eventually you _will_ get a smart bulb on an airgapped network.

I'll just repeat myself, maybe the finer points were missed: If you set up a secure network with IDS and firewalls, you control all aspects of that network. Saying that you'll put some IoT smart bulb crap on that network is just like saying you have an airgapped network that's connected to the internet.

It doesn't make sense to build a secure network and then connect insecure crap to it or to allow anyone else to do it.

There's nothing inherently insecure about a smart lightbulb. With studies like this proving the danger inherent even in a 100% perfectly secure bulb, then yes, people likely won't attach them to secure networks. _Without these studies_, they would, because nobody would know of any dangers.

You're thinking too current. There's no reason why an "industry" smartbulb won't exist in the not too distant future, with hardened security and professional use cases. This study is flagging up that even with hardened security there are new attack vectors.

> You're thinking too current.

Sure, because I know that the second the "industry" smartbulb is launched and connected to secure networks (someone will definitely provide a good reason to connect a lightbulb to a network with confidential data just like today you connect your phone over WiFi to a secure network to Snapstagram) IDS systems will detect flickering lights on all wavelengths thus preempting any attempt to exfiltrate data that way :). This would make the whole point moot. Hence me staying in the present.

In all seriousness there is absolutely no good reason to ever connect anything to a secure network that's not critical for the functioning of that system. But maybe I'm too current, maybe future networks are managed by... creative people.

You'd be surprised. Also, who says the bulb was deposited there by security experts.

See reply above. Did it ever happen to you to come home and find a random fridge in the living room? Then why would you expect that anyone building a secure network would allow anything to be connected to it without any controls?

A smart light bulb usually needs some additional "infrastructure": the bridge that has to be connected somehow. Even if you made the mistake of not physically securing the ports of your secure network, and also don't authenticate any device that connects, and you somehow allow random devices to be connected to a secure [0] network, you'll still be able to catch any device that gets connected. And if your bulb somehow goes straight to WiFi why would you allow random devices on that network?

[0] Did I mention secure enough times? I just have the feeling that this is the crux of the discussion because you consider setting up firewalls and IDS that block any exfiltration as normal but somehow a smartbulb on the network doesn't raise any flags.

I am afraid this is already passé.

Cf. - https://blog.acolyer.org/2017/06/22/iot-goes-nuclear-creatin...

Please also read research work by Shyam Gollakota of University of Washington.

Alternatively: One more novel way to work stupid smart consumer habits into a profit.

How many engineers do you need to change a smart light bulb?

Seriously, I don't know...

How many software engineers do you need to change a smart light bulb?

None. It is a hardware problem.

It depends on the regional dialect:

Q: How many Northern Californian software engineers does it take to change a smart lightbulb?

A: Hella!

Q: How many Southern Californian software engineers does it take to change a smart lightbulb?