Lightbulb Worm - Revision history

RArzberger: /* Phillips reaction */

2024-12-10T15:27:46Z

Phillips reaction

← Older revision		Revision as of 15:27, 10 December 2024
Line 99:		Line 99:


	;Unfixed vulnerabilities		;Unfixed vulnerabilities - [[Don't be silly - it's only a lightbulb]]

	In 2020 the researcher Eyal Itkin revealed a new form of hack for the Philips Hue System.<ref name="hack2020"/> In this article he describes the still working vulnerabilities including the Firmware Update Attack and also the Take over Attack still being possible. Only the proximity check is fixed, making the lightbulb worm impossible to spread but still leaves the door wide open for further attacks. Following up on this discovery the possibility of taking over a lightbulb and infecting it with self written code provided the basis for an attack against the Philips Hue Bridge. The attacker was able to find a vulnerability that leveraged a buffer overflow attack to escalate to root privileges. Following this an attack on devices in the LAN network was possible.		In 2020 the researcher Eyal Itkin revealed a new form of hack for the Philips Hue System.<ref name="hack2020"/> In this article he describes the still working vulnerabilities including the Firmware Update Attack and also the Take over Attack still being possible. Only the proximity check is fixed, making the lightbulb worm impossible to spread but still leaves the door wide open for further attacks. Following up on this discovery the possibility of taking over a lightbulb and infecting it with self written code provided the basis for an attack against the Philips Hue Bridge. The attacker was able to find a vulnerability that leveraged a buffer overflow attack to escalate to root privileges. Following this an attack on devices in the LAN network was possible.

RArzberger at 12:37, 8 December 2024

2024-12-08T12:37:29Z

RArzberger: /* Phillips reaction */

2024-12-08T11:20:30Z

Phillips reaction

← Older revision		Revision as of 11:20, 8 December 2024
Line 101:		Line 101:
	;Unfixed vulnerabilities		;Unfixed vulnerabilities

	In 2020 the researcher Eyal Itkin revealed a new form of hack for the Philips Hue System.</ref name="hack2020"/> In this article he describes the still working vulnerabilities including the Firmware Update Attack and also the Take over Attack still being possible. Only the proximity check is fixed, making the lightbulb worm impossible to spread but still leaves the door wide open for further attacks. Following up this discovery the possibility to take over a lightbulb and infect it with self written code provided the basis for a attack against the Philips Hue Bridge. The attacker was able to find an vulnerability which leveraged a buffer overflow attack to escalate to root privileges. Following this a attack on devices in the LAN-network was possible.		In 2020 the researcher Eyal Itkin revealed a new form of hack for the Philips Hue System.<ref name="hack2020"/> In this article he describes the still working vulnerabilities including the Firmware Update Attack and also the Take over Attack still being possible. Only the proximity check is fixed, making the lightbulb worm impossible to spread but still leaves the door wide open for further attacks. Following up this discovery the possibility to take over a lightbulb and infect it with self written code provided the basis for a attack against the Philips Hue Bridge. The attacker was able to find an vulnerability which leveraged a buffer overflow attack to escalate to root privileges. Following this a attack on devices in the LAN-network was possible.

RArzberger: /* Phillips reaction */

2024-12-08T11:19:53Z

Phillips reaction

← Older revision		Revision as of 11:19, 8 December 2024
Line 101:		Line 101:
	;Unfixed vulnerabilities		;Unfixed vulnerabilities

	In 2020 the researcher Eyal Itkin revealed a new form of hack for the Philips Hue System.</ref name="~~2020hack~~"/> In this article he describes the still working vulnerabilities including the Firmware Update Attack and also the Take over Attack still being possible. Only the proximity check is fixed, making the lightbulb worm impossible to spread but still leaves the door wide open for further attacks. Following up this discovery the possibility to take over a lightbulb and infect it with self written code provided the basis for a attack against the Philips Hue Bridge. The attacker was able to find an vulnerability which leveraged a buffer overflow attack to escalate to root privileges. Following this a attack on devices in the LAN-network was possible.		In 2020 the researcher Eyal Itkin revealed a new form of hack for the Philips Hue System.</ref name="hack2020"/> In this article he describes the still working vulnerabilities including the Firmware Update Attack and also the Take over Attack still being possible. Only the proximity check is fixed, making the lightbulb worm impossible to spread but still leaves the door wide open for further attacks. Following up this discovery the possibility to take over a lightbulb and infect it with self written code provided the basis for a attack against the Philips Hue Bridge. The attacker was able to find an vulnerability which leveraged a buffer overflow attack to escalate to root privileges. Following this a attack on devices in the LAN-network was possible.

RArzberger: /* References */

2024-12-08T11:19:36Z

References

← Older revision		Revision as of 11:19, 8 December 2024
Line 152:		Line 152:
	<ref name="philipspr">[https://www.signify.com/global/our-company/news/press-release-archive/2016/20161103-media-alert-reports-of-philips-hue-products-being-infected-by-a-virus-are-inaccurate MEDIA ALERT: Reports of Philips Hue products being infected by a virus are inaccurate, 2016]</ref>		<ref name="philipspr">[https://www.signify.com/global/our-company/news/press-release-archive/2016/20161103-media-alert-reports-of-philips-hue-products-being-infected-by-a-virus-are-inaccurate MEDIA ALERT: Reports of Philips Hue products being infected by a virus are inaccurate, 2016]</ref>

	<ref name="~~2020hack~~">[https://research.checkpoint.com/2020/dont-be-silly-its-only-a-lightbulb/ Don’t be silly – it’s only a lightbulb, 2020]</ref>		<ref name="hack2020">[https://research.checkpoint.com/2020/dont-be-silly-its-only-a-lightbulb/ Don’t be silly – it’s only a lightbulb, 2020]</ref>

	</references>		</references>

RArzberger: /* Phillips reaction */

2024-12-08T11:19:19Z

Phillips reaction

← Older revision		Revision as of 11:19, 8 December 2024
Line 101:		Line 101:
	;Unfixed vulnerabilities		;Unfixed vulnerabilities

	In 2020 the researcher Eyal Itkin revealed a new form of hack for the Philips Hue System</ref name="2020hack"/>. In this article he describes the still working vulnerabilities including the Firmware Update Attack and also the Take over Attack still being possible. Only the proximity check is fixed, making the lightbulb worm impossible to spread but still leaves the door wide open for further attacks. Following up this discovery the possibility to take over a lightbulb and infect it with self written code provided the basis for a attack against the Philips Hue Bridge. The attacker was able to find an vulnerability which leveraged a buffer overflow attack to escalate to root privileges. Following this a attack on devices in the LAN-network was possible.		In 2020 the researcher Eyal Itkin revealed a new form of hack for the Philips Hue System.</ref name="2020hack"/> In this article he describes the still working vulnerabilities including the Firmware Update Attack and also the Take over Attack still being possible. Only the proximity check is fixed, making the lightbulb worm impossible to spread but still leaves the door wide open for further attacks. Following up this discovery the possibility to take over a lightbulb and infect it with self written code provided the basis for a attack against the Philips Hue Bridge. The attacker was able to find an vulnerability which leveraged a buffer overflow attack to escalate to root privileges. Following this a attack on devices in the LAN-network was possible.

RArzberger: /* Phillips reaction */

2024-12-08T11:18:25Z

Phillips reaction

← Older revision		Revision as of 11:18, 8 December 2024
Line 96:		Line 96:
	== Phillips reaction ==		== Phillips reaction ==

	Before releasing the found vulnerabilities the research team informed Philips Lighting (now Signify) with reasonable time to fix the issues. Philips then released an update short before the release and also later released a press release. In the information Philips stated "Their research findings helped us to develop and roll out the software update."<ref name="philipspr"/>		Before releasing the found vulnerabilities the research team informed Philips Lighting (now Signify) with reasonable time to fix the issues. Philips then released an update short before the release and also later released a press release. In the information Philips stated "Their research findings helped us to develop and roll out the software update.". No indication of a unfixed vulnerability.<ref name="philipspr"/>


Line 105:		Line 105:

	The buffer overflow vulnerability was then fixed but the other vulnerabilities seem to be unpatchable leaving attack vectors for threat actors.		The buffer overflow vulnerability was then fixed but the other vulnerabilities seem to be unpatchable leaving attack vectors for threat actors.

			To this day (last updated: 08.12.2024) the vulnerabilities are still as stated above are still not fixed.

	== Countermeasures ==		== Countermeasures ==

RArzberger: /* Phillips reaction */

2024-12-08T11:16:47Z

Phillips reaction

← Older revision		Revision as of 11:16, 8 December 2024
Line 96:		Line 96:
	== Phillips reaction ==		== Phillips reaction ==

	Before releasing the found vulnerabilities the research team informed Philips Lighting (now Signify) with reasonable time to fix the issues. Philips then released an update short before the release and also <ref name="philipspr"/>		Before releasing the found vulnerabilities the research team informed Philips Lighting (now Signify) with reasonable time to fix the issues. Philips then released an update short before the release and also later released a press release. In the information Philips stated "Their research findings helped us to develop and roll out the software update."<ref name="philipspr"/>


			;Unfixed vulnerabilities

			In 2020 the researcher Eyal Itkin revealed a new form of hack for the Philips Hue System</ref name="2020hack"/>. In this article he describes the still working vulnerabilities including the Firmware Update Attack and also the Take over Attack still being possible. Only the proximity check is fixed, making the lightbulb worm impossible to spread but still leaves the door wide open for further attacks. Following up this discovery the possibility to take over a lightbulb and infect it with self written code provided the basis for a attack against the Philips Hue Bridge. The attacker was able to find an vulnerability which leveraged a buffer overflow attack to escalate to root privileges. Following this a attack on devices in the LAN-network was possible.


			The buffer overflow vulnerability was then fixed but the other vulnerabilities seem to be unpatchable leaving attack vectors for threat actors.

	== Countermeasures ==		== Countermeasures ==

RArzberger: /* References */

2024-12-08T11:07:54Z

References

← Older revision		Revision as of 11:07, 8 December 2024
Line 141:		Line 141:

	<ref name="philipspr">[https://www.signify.com/global/our-company/news/press-release-archive/2016/20161103-media-alert-reports-of-philips-hue-products-being-infected-by-a-virus-are-inaccurate MEDIA ALERT: Reports of Philips Hue products being infected by a virus are inaccurate, 2016]</ref>		<ref name="philipspr">[https://www.signify.com/global/our-company/news/press-release-archive/2016/20161103-media-alert-reports-of-philips-hue-products-being-infected-by-a-virus-are-inaccurate MEDIA ALERT: Reports of Philips Hue products being infected by a virus are inaccurate, 2016]</ref>

			<ref name="2020hack">[https://research.checkpoint.com/2020/dont-be-silly-its-only-a-lightbulb/ Don’t be silly – it’s only a lightbulb, 2020]</ref>

	</references>		</references>

RArzberger: /* Phillips reaction */

2024-12-08T11:04:31Z

Phillips reaction

← Older revision		Revision as of 11:04, 8 December 2024
Line 95:		Line 95:

	== Phillips reaction ==		== Phillips reaction ==

			Before releasing the found vulnerabilities the research team informed Philips Lighting (now Signify) with reasonable time to fix the issues. Philips then released an update short before the release and also <ref name="philipspr"/>

	== Countermeasures ==		== Countermeasures ==

← Older revision		Revision as of 12:37, 8 December 2024
Line 2:		Line 2:

	The Lightbulb Worm is an attack on Philips Hue lamps discovered by the research team of Colin O'Flynn, Eyal Ronen, Adi Shamir, and Achi-Or Weingarten.		The Lightbulb Worm is an attack on Philips Hue lamps discovered by the research team of Colin O'Flynn, Eyal Ronen, Adi Shamir, and Achi-Or Weingarten.
	Based on two main attacks in the Zigbee based Philips Hue ecosystem they provide the ingredients for the first worm that affects smart lighting systems.		Based on two main attacks in the Zigbee-based Philips Hue ecosystem they provide the ingredients for the first worm that affects smart lighting systems.

	The worm has the power to spread only through physical proximity and opens the possibility ~~to deploy~~ malicious code via a firmware update. It only takes one infected lightbulb to be installed, and the worm can spread - through its ZigBee wireless connectivity - directly to the physical neighbors of this lamp. These newly infected lamps would again infect all their neighbor lamps.		The worm has the power to spread only through physical proximity and opens the possibility of deploying malicious code via a firmware update. It only takes one infected lightbulb to be installed, and the worm can spread - through its ZigBee wireless connectivity - directly to the physical neighbors of this lamp. These newly infected lamps would again infect all their neighbor lamps.
	That can lead to a massive chain reaction that spreads in an epidemic fashion and attacks whole cities. The critical mass to infect all lightbulbs within a urban area like Paris was estimated to be around 15.000 lightbulbs. <ref name="ronenarticle"/>		That can lead to a massive chain reaction that spreads in an epidemic fashion and attacks whole cities. The critical mass to infect all lightbulbs within an urban area like Paris was estimated to be around 15.000 lightbulbs. <ref name="ronenarticle"/>

	== Philips Hue and Zigbee Light Link ==		== Philips Hue and Zigbee Light Link ==
Line 26:		Line 26:
	This encryption key is unique for every PAN and encrypted by a “Master key."		This encryption key is unique for every PAN and encrypted by a “Master key."

	This “Master key" is a secret key, but it is used and stored on every ZLL certified product. In the case ~~for~~ Philipps Hue products the same AES-CCM key was used on every device. In 2015 the key was leaked online and could be found on various ~~website~~ including Twitter (now X). This resulted in the fact that the team was able to interfere with the encrypted connection of the light bulb and the bridge opening the doors for various attacks.		This “Master key" is a secret key, but it is used and stored on every ZLL-certified product. In the case of Philipps Hue products, the same AES-CCM key was used on every device. In 2015 the key was leaked online and could be found on various websites including Twitter (now X). This resulted in the fact that the team was able to interfere with the encrypted connection of the light bulb and the bridge opening the doors for various attacks.

	The Touchlink protocol provides two message types with which the state of a lightbulb can be changed:		The Touchlink protocol provides two message types with which the state of a lightbulb can be changed:

	1. Reset to factory new request: If the target device receives this message		1. Reset to factory new request: If the target device receives this message
	~~with~~ a valid Transaction ID, it is reset to a factory new state, and all Network information and keys are deleted.		With a valid Transaction ID, it is reset to a factory new state, and all Network information and keys are deleted.

	2. Join (or start) network request: With this message, the device is instructed to join		2. Join (or start) network request: With this message, the device is instructed to join
Line 46:		Line 46:
	== Ingredients of the Lightbulb Worm ==		== Ingredients of the Lightbulb Worm ==

	;Take over Attack - the worm moving ~~lateral~~ by spreading from one bulb to another		;Take over Attack - the worm moving laterally by spreading from one bulb to another
	:To perform a take over attack against a Philips Hue lightbulb two major attack vectors were used:		:To perform a take over attack against a Philips Hue lightbulb two major attack vectors were used:
	* The leaked "Master Key" made it possible for the ~~researches~~ to interfere with the encrypted communication of the bridge and the lightbulb. This enabled them to send the "Factory Reset" and "Join" ~~message~~ to the targeted bulb.		* The leaked "Master Key" made it possible for the researchers to interfere with the encrypted communication of the bridge and the lightbulb. This enabled them to send the "Factory Reset" and "Join" messages to the targeted bulb.
	* By sending a transaction ID of all zeros, due to an implementation error in the code, the proximity check was bypassed enabling a attack over a greater distance.		* By sending a transaction ID of all zeros, due to an implementation error in the code, the proximity check was bypassed enabling an attack over a greater distance.

	:So they just had to set the lightbulbs to a Factory New state and make the lightbulbs actively search for ZigBee networks and are open to connection.		:So they just had to set the lightbulbs to a Factory New state and make the lightbulbs actively search for ZigBee networks and are open to connection.
	:Setting them to a Factory New state was possible due to a software bug ~~which~~ could have been found with negative testing during the Zigbee certification process. <ref name="ronenpaper"/>		:Setting them to a Factory New state was possible due to a software bug that could have been found with negative testing during the Zigbee certification process. <ref name="ronenpaper"/>


	;Firmware Update Attack - Persistence of code execution on the lamps to take over the control of the lamps		;Firmware Update Attack - Persistence of code execution on the lamps to take over the control of the lamps
	:The researchers achieved the Persistence of Code Execution by exploiting the (OTA - Over the Air) update mechanisms of the Philips Hue. It is possible for any device in the network to send an firmware update to another device due to the interoperability approach ZigBee is using. The only limitation still in place was the signature check of the lightbulb. The ~~researches~~ first found out that the same key is used for all Philips Hue ~~lightbulb~~ signing the firmware and second what type of encryption mechanism is used (AES-CCM). By using a combination of Correlation Power Analysis (CPA) and Differential Power Analysis (DPA), both of which are side channel attacks, the research team was able to extract the key used for signing software ~~update~~.		:The researchers achieved the Persistence of Code Execution by exploiting the (OTA - Over the Air) update mechanisms of the Philips Hue. It is possible for any device in the network to send a firmware update to another device due to the interoperability approach ZigBee is using. The only limitation still in place was the signature check of the lightbulb. The researchers first found out that the same key is used for all Philips Hue lightbulbs signing the firmware and second what type of encryption mechanism is used (AES-CCM). By using a combination of Correlation Power Analysis (CPA) and Differential Power Analysis (DPA), both of which are side-channel attacks, the research team was able to extract the key used for signing software updates.
	:This enabled them to perform firmware updates over the air with ~~there~~ own manipulated code inside. The key was never released by the research team.<ref name="ronenpaper"/>		:This enabled them to perform firmware updates over the air with their own manipulated code inside. The key was never released by the research team.<ref name="ronenpaper"/>

	== Security Issues of the Philips Hue System ==		== Security Issues of the Philips Hue System ==
Line 81:		Line 81:
	System administrators usually try to stop such an attack by isolating subnetworks from each other, which in this case would not be possible because only ZigBee communication is used, which is not monitored or protected.		System administrators usually try to stop such an attack by isolating subnetworks from each other, which in this case would not be possible because only ZigBee communication is used, which is not monitored or protected.

	Also, locating the source of the attack and ~~also~~ detecting the attack itself would be very difficult. <ref name="ronenpaper"/>		Also, locating the source of the attack and detecting the attack itself would be very difficult. <ref name="ronenpaper"/>

	== Possible Attacks ==		== Possible Attacks ==
Line 90:		Line 90:
	:ZigBee runs over the IEEE 802.15.4 standard, which uses the 2.4 GHz, license-free band (continuous wave signal from 'test mode' could overlap other channels)		:ZigBee runs over the IEEE 802.15.4 standard, which uses the 2.4 GHz, license-free band (continuous wave signal from 'test mode' could overlap other channels)
	;Data infiltration and exfiltration		;Data infiltration and exfiltration
	;Affect ~~peoples~~ health		;Affect people's health
	:The light can be programmed in such a blinking rate ~~which~~ causes epileptic seizures		:The light can be programmed at such a blinking rate that it causes epileptic seizures
	:The LEDs can also be driven at frequencies that are creating discomfort in humans <ref name="ronenpaper"/>		:The LEDs can also be driven at frequencies that are creating discomfort in humans <ref name="ronenpaper"/>

	== Phillips reaction ==		== Phillips reaction ==

	Before releasing the found vulnerabilities the research team informed Philips Lighting (now Signify) with reasonable time to fix the issues. Philips then released an update ~~short~~ before the release and also later released a press release. In the information Philips stated "Their research findings helped us to develop and roll out the software update.". No indication of a unfixed vulnerability.<ref name="philipspr"/>		Before releasing the found vulnerabilities the research team informed Philips Lighting (now Signify) with reasonable time to fix the issues. Philips then released an update shortly before the release and also later released a press release. In the information, Philips stated "Their research findings helped us to develop and roll out the software update.". No indication of an unfixed vulnerability.<ref name="philipspr"/>


	;Unfixed vulnerabilities		;Unfixed vulnerabilities

	In 2020 the researcher Eyal Itkin revealed a new form of hack for the Philips Hue System.<ref name="hack2020"/> In this article he describes the still working vulnerabilities including the Firmware Update Attack and also the Take over Attack still being possible. Only the proximity check is fixed, making the lightbulb worm impossible to spread but still leaves the door wide open for further attacks. Following up this discovery the possibility ~~to take~~ over a lightbulb and ~~infect~~ it with self written code provided the basis for a attack against the Philips Hue Bridge. The attacker was able to find an vulnerability ~~which~~ leveraged a buffer overflow attack to escalate to root privileges. Following this a attack on devices in the LAN-network was possible.		In 2020 the researcher Eyal Itkin revealed a new form of hack for the Philips Hue System.<ref name="hack2020"/> In this article he describes the still working vulnerabilities including the Firmware Update Attack and also the Take over Attack still being possible. Only the proximity check is fixed, making the lightbulb worm impossible to spread but still leaves the door wide open for further attacks. Following up on this discovery the possibility of taking over a lightbulb and infecting it with self written code provided the basis for an attack against the Philips Hue Bridge. The attacker was able to find a vulnerability that leveraged a buffer overflow attack to escalate to root privileges. Following this an attack on devices in the LAN network was possible.


Line 112:		Line 112:
	* Unique keys per lightbulb		* Unique keys per lightbulb

	* ~~Asymetric~~ cryptography for software verification		* Asymmetric cryptography for software verification

	* Reducing the amount of damage a leaked key might be able to cause		* Reducing the amount of damage a leaked key might be able to cause
Line 146:		Line 146:
	<ref name="ronenarticle">Eyal Ronen, Colin O'Flynn, Adi Shamir, and Achi Or Weingarten. IoT Goes Nuclear: Creating a ZigBee Chain Reaction. In Proceedings – IEEE Symposium on Security and Privacy, 2017 </ref>		<ref name="ronenarticle">Eyal Ronen, Colin O'Flynn, Adi Shamir, and Achi Or Weingarten. IoT Goes Nuclear: Creating a ZigBee Chain Reaction. In Proceedings – IEEE Symposium on Security and Privacy, 2017 </ref>

	<ref name="wan13"> Jianfeng Wang. Zigbee light link and its ~~applicationss~~. IEEE Wireless Communications, 2013 </ref>		<ref name="wan13"> Jianfeng Wang. Zigbee light link and its applications. IEEE Wireless Communications, 2013 </ref>

	<ref name="ronenpaper"> Eyal Ronen, Adi Shamir, Achi Or Weingarten, and Colin O‘Flynn. IoT Goes Nuclear: Creating a Zigbee Chain Reaction. IEEE Security and Privacy, 2018 </ref>		<ref name="ronenpaper"> Eyal Ronen, Adi Shamir, Achi Or Weingarten, and Colin O‘Flynn. IoT Goes Nuclear: Creating a Zigbee Chain Reaction. IEEE Security and Privacy, 2018 </ref>