Bulbs Emfcamp 2018

You might also like

Download as odp, pdf, or txt
Download as odp, pdf, or txt
You are on page 1of 85

Everything you never wanted to know

about smart light bulbs

Matthew Garrett
<mjg59@srcf.ucam.org>
@mjg59
In the past were the dinosaurs
(Very little interesting lightbulb
development during this time)
18th century: electricity all the things
19th century: the lightbulb is invented
(by, like, eleventy billion people roughly
simultaneously)
Carbon filament
Tungsten filament
Halogen
CFL
LED
The dawn of smart lighting
X10
Smart switches
NOT WHAT WE’RE TALKING ABOUT
Smart bulbs speak to a network themselves
Variety of protocols
Z-Wave
Zigbee
Wifi
Bluetooth
Something entirely custom
Why do you want them?
Dimmable
Colour or temperature changing
React to external events
Control from your phone
Control by shouting
Compensate for annoying lighting setups
So what’s in one of these things?
Diffuser
LEDs
Heatsink
Radio
Controller
Driver
Speaker(!)
RGB/RGBW
White light is hard
White LEDs are bright
RGB and white together may blow your thermals
Reverse engineering protocols
Android Bluetooth debugging
tcpdump
Wireshark
Swearing
Gin
Some of these bulbs are… strange
Setup with AT commands
Random cloud services to forward packets
Probably all fine
(Not always fine)
iSuper iRainbow001
Button for physical presence auth!
Button does nothing
No credentials for cloud communication
Running a hidden wifi network
…which exposes telnet
…with hardcoded credentials
In-home rootkit
Philips Hue
Good proof of physical presence
Unique cryptographic ID
Wholesome, friendly, good life partner material
Bulbs vulnerable to sidechannel attacks
Researchers extracted AES key used for firmware
(Sidenote: do not use AES for firmware auth)
Researchers discovered how to take over bulbs
Reauth requires close physical locality
Reset didn’t
Researchers replaced firmware
Researchers replaced firmware with firmware
capable of carrying out the same attack
http://iotworm.eyalro.net/
Initial setup
Zigbee, Z-Wave
Bluetooth
Run an AP, accept configuration
…just blast creds encoded in packet size
Any better alternatives?
Many cheap bulbs based on esp8266
Of course they have a serial port
https://github.com/stelgenhof/AiLight/
https://github.com/xoseperez/espurna
Expose control over standard interfaces
(take care not to exceed thermal design)
Matthew Garrett
<mjg59@srcf.ucam.org>
@mjg59

You might also like