“Continuing from where the previous research left off, Check Point’s researchers showed how a threat actor could exploit an IoT network (smart lightbulbs and their control bridge) to launch attacks on conventional computer networks in homes, businesses or even smart cities,” Check Point stated in a blog post.
While annoying, there is the potential to hack a target’s network. By messing with the lighting, a user may assume there is a glitch, and then proceed to delete it from the accompanying app. This is where things can go very bad. To add the compromised bulb back into the app, it needs to be discovered by the bridge.
“The hacker-controlled bulb with updated firmware then uses the ZigBee protocol vulnerabilities to trigger a heap-based buffer overflow on the control bridge, by sending a large amount of data to it. This data also enables the hacker to install malware on the bridge—which is in turn connected to the target business or home network,” Check Point explains.
From there, the attacker has a pathway into the target’s network and can spread malware, including ransomware and spyware.
The good new is, Philips has rolled out a patch for the flaw. This should be rolled out automatically, but if you own a Philips Hue product, you should definitely check to make sure. You can do this by opening the Hue app and going to Settings > Software. The firmware version should be 1935144040 (or later).
Once the patch is in place, an attacker would not be able to spread malware through a network by leveraging this vulnerability. So, what’s the bad news? An attacker could still hack the lighting. That’s as far as they could go, though, so at least you’re protected from deeper security intrusions.
‘).insertAfter(jQuery(‘#initdisqus’));
}
loadDisqus(jQuery(‘#initdisqus’), disqus_identifier, url);
}
else {
setTimeout(function () { disqusDefer(); }, 50);
}
}
disqusDefer();
function loadDisqus(source, identifier, url) {
if (jQuery(“#disqus_thread”).length) {
jQuery(“#disqus_thread”).remove();
}
jQuery(‘
‘).insertAfter(source);
if (window.DISQUS) {
DISQUS.reset({
reload: true,
config: function () {
this.page.identifier = identifier;
this.page.url = url;
}
});
} else {
//insert a wrapper in HTML after the relevant “show comments” link
disqus_identifier = identifier; //set the identifier argument
disqus_url = url; //set the permalink argument
//append the Disqus embed script to HTML
var dsq = document.createElement(‘script’); dsq.type = ‘text/javascript’; dsq.async = true;
dsq.src = ‘https://’ + disqus_shortname + ‘.disqus.com/embed.js’;
jQuery(‘head’).append(dsq);
}
jQuery(‘.show-disqus’).show();
source.hide();
};
function disqusEvent()
{
idleTime = 0;
}