A new type of vulnerability is found in Phillips Smart Hue Bulbs that could let hackers hack the localhost and all the device connected to them.
Hacking can be done over-the-air within a range of 100m to gain access to one’s Wifi network. The hacker uses the ZigBee protocol vulnerabilities and installs malware on the control bridge – which is in turn connected to the target network.
Zigbee is a low-cost wireless technology widely used wireless technology designed to communicate with devices designed to communicate with other devices.
Through this exploitation, a threat actor can infiltrate a home or office’s computer network over-the-air, spreading ransomware or spyware, by using nothing but a laptop and an antenna from over 100 meters,
Check Point researchers
The vulnerability is marked as CVE-2020-6007.
The hackers hack as follows:
- The hacker controls the bulb’s color or brightness to trick users to reset it.
- After successfully exploiting the vulnerability hacker triggers a heap-based buffer overflow by sending a large amount of data to it which enables hackers to install malware into the bridge.
- The malware connects back to the victim and hackers hack the target IP network.
Many of us are aware that IoT devices can pose a security risk, but this research shows how even the most mundane, seemingly ‘dumb’ devices such as lightbulbs can be exploited by hackers and used to take over networks, or plant malware.
Yaniv Balmas, Head of Cyber Research at Check Point Research
The good news is Checkpoint has reported this to Philips and Signify (owner of Philips Hue brand) has released a patch Firmware version 1935144040 for the vulnerability.
