Those convinced that the emerging Internet of Things (IoT) will become a hackers' playground were given more grist for their mill with news on Friday that security researchers have discovered a weakness in Wi-Fi/mesh networked lightbulbs.
Researchers at Context Information Security discovered that LED light bulbs from manufacturer LIFX - which are designed to be controlled from a smartphone - have security weaknesses. By gaining access to the master bulb, Context was able to control all connected lightbulbs and expose user network configurations.
Context worked with LIFX to develop a patch for the security bug before releasing a fix in the form of a firmware update. Simon Walker from LIFX stated: “Prior to the patch, no one other than Context had exposed this vulnerability, most likely due to the complexity of the equipment and reverse engineering required.”
Details of the vulnerability and the subsequent fix can in Context's advisory (summarised below)
The LIFX bulb was launched in September 2012 with crowd funding through the Kickstarter website. The architecture, based on the 802.15.4 6LoWPAN wireless mesh network, requires only one bulb to be connected to the Wi-Fi at a time. Context researchers found that they were able to monitor packets on the mesh network and identify the specific packets which shared the encrypted network configuration among the bulbs.
The detailed steps of gaining access to the device involved accessing the firmware by physically interrogating the device’s embedded microcontrollers to identify and understand the encryption mechanism in use. Armed with knowledge of the encryption algorithm, key, initialisation vector and an understanding of the mesh network protocol, Context was able to inject packets into the mesh network, capture and decrypt the network configurations, all without any prior authentication or alerting of its presence.
The fix, developed with the help of Context, is included in the new firmware and now encrypts all 6LoWPAN traffic, using an encryption key derived from the Wi-Fi credentials. It also includes functionality for secure ‘on-boarding’ of new bulbs on to the network.
Context's find is part of its ongoing research into the security of the Internet of Things (IoT) - which includes parking meters, internet-enabled fridges and much more besides. Many of these components are being put together with little thought for basic security precautions, according to Context.
“It is clear that in the dash to get onto the IoT bandwagon, security is not being prioritised as highly as it should be in many connected devices,” said Michael Jordon, research director at Context. “We have also found vulnerabilities in other internet connected devices from home storage systems and printers to baby monitors and children’s toys." ®