Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Novel Attack Technique Uses Smart Light Bulbs to Steal Data

bleepingcomputer.com

Post reply on HN
Print view View original

11–20 of 41 posts

Re: Novel Attack Technique Uses Smart Light Bulbs to Steal Data

#11

Post by semi-extrinsic »

wlesieutre wrote: post #8
hw_penfold wrote: post #6

Earlier quoted context omitted.

I'll take a moment to spell out what's going on here, since they seem to be beating around the bush in the article itself, possibly for fear of imitation in the wild. They take a smart lightbulb with certain features: infrared and media decoders. They specifically hijack the infrared portion of the bulb's spectrum only. Why? Because standing right next to the bulb, you wouldn't notice it flickering hot/cold, at milli…

I'm talking about their "Deducing victim's music and video tastes" section. The data exfiltratiom part is after that, titled "Data exfiltration from personal devices", which yes, is a new means of transmitting data. Under the assumptions that there's no authentication to control the lights and that they have malware running on your computer already. But my point is that the whole first section is absurd. Leaking what…

For remote surveillance, you can use a laser microphone up to 4-500 meters away from the target house. No hardware or software in the house required.

Re: Novel Attack Technique Uses Smart Light Bulbs to Steal Data

#12

Post by peteforde »

wlesieutre wrote: post #8
hw_penfold wrote: post #6

Earlier quoted context omitted.

I'll take a moment to spell out what's going on here, since they seem to be beating around the bush in the article itself, possibly for fear of imitation in the wild. They take a smart lightbulb with certain features: infrared and media decoders. They specifically hijack the infrared portion of the bulb's spectrum only. Why? Because standing right next to the bulb, you wouldn't notice it flickering hot/cold, at milli…

I'm talking about their "Deducing victim's music and video tastes" section. The data exfiltratiom part is after that, titled "Data exfiltration from personal devices", which yes, is a new means of transmitting data. Under the assumptions that there's no authentication to control the lights and that they have malware running on your computer already. But my point is that the whole first section is absurd. Leaking what…

Honestly, you're just being argumentative. The researchers haven't proposed that they've backdoored your computer, but historically every impressive hacking feat is built on a stack of "obvious in hind-sight" novel abuses.

Instead of writing it off as Rube Goldberg over-engineering, it would be a lot more useful (and fun) to consider what these sort of attacks could do in less obvious conditions.

The people who put the 2600hz tone whistles in the breakfast cereal didn't anticipate Apple computers.

Re: Novel Attack Technique Uses Smart Light Bulbs to Steal Data

#13

Post by elorant »

userbinator wrote: post #3
wlesieutre wrote: post #2

If one of the "novel attacks" is against this: >while in the case of video visualizations, the modifications reflect the dominant color and brightness level in the current video frame. How does this leak anything that your TV screen doesn't leak already? This just in! People outside your window can see what color your TV screen is glowing! People at particular angles can retrieve a 4K visual representation of the med…

Also this: Moreover, the adversary needs to plant malware that encodes private data from the target device and sends it to the smart light bulbs. ...if you can already install/run code of your choice, why not just send the data out over the network and into the Internet?

Uploading data to a server leaves a trail. Theoretically there are allegedly untraceable servers leased in the underground but they're quite expensive and you never know who's actually running them. In this scenario the risk is limited.

Re: Novel Attack Technique Uses Smart Light Bulbs to Steal Data

#15

Post by bayesian_horse »

lxe wrote: post #7

> Light bulbs need to support infrared lighting and should not require authorization for controlling them over the local network. Moreover, the adversary needs to plant malware that encodes private data from the target device and sends it to the smart light bulbs. If you've already exploited the target device, why not just send private data to the attacker's servers instead? This has to be one of the most convoluted…

Or in a network with intrusion detection or firewalls this could be a way to exfiltrate data without the system noticing.

Re: Novel Attack Technique Uses Smart Light Bulbs to Steal Data

#17

Post by close04 »

bayesian_horse wrote: post #15
lxe wrote: post #7

> Light bulbs need to support infrared lighting and should not require authorization for controlling them over the local network. Moreover, the adversary needs to plant malware that encodes private data from the target device and sends it to the smart light bulbs. If you've already exploited the target device, why not just send private data to the attacker's servers instead? This has to be one of the most convoluted…

Or in a network with intrusion detection or firewalls this could be a way to exfiltrate data without the system noticing.

TBH a a network with intrusion detection or firewalls doesn't really go in the same room as a smart bulb. You don't build a secure network and then say "hey, I should put some fun into it" :).

Re: Novel Attack Technique Uses Smart Light Bulbs to Steal Data

#18

Post by underwater »

userbinator wrote: post #3
wlesieutre wrote: post #2

If one of the "novel attacks" is against this: >while in the case of video visualizations, the modifications reflect the dominant color and brightness level in the current video frame. How does this leak anything that your TV screen doesn't leak already? This just in! People outside your window can see what color your TV screen is glowing! People at particular angles can retrieve a 4K visual representation of the med…

Also this: Moreover, the adversary needs to plant malware that encodes private data from the target device and sends it to the smart light bulbs. ...if you can already install/run code of your choice, why not just send the data out over the network and into the Internet?

Don’t smart bulbs have the ability to connect to and broadcast to arbitrary networks?

Re: Novel Attack Technique Uses Smart Light Bulbs to Steal Data

#19

Post by bayesian_horse »

close04 wrote: post #17
bayesian_horse wrote: post #15

Earlier quoted context omitted.

Or in a network with intrusion detection or firewalls this could be a way to exfiltrate data without the system noticing.

TBH a a network with intrusion detection or firewalls doesn't really go in the same room as a smart bulb. You don't build a secure network and then say "hey, I should put some fun into it" :).

You'd be surprised. Also, who says the bulb was deposited there by security experts.

Re: Novel Attack Technique Uses Smart Light Bulbs to Steal Data

#20

Post by annabellish »

close04 wrote: post #17
bayesian_horse wrote: post #15

Earlier quoted context omitted.

Or in a network with intrusion detection or firewalls this could be a way to exfiltrate data without the system noticing.

TBH a a network with intrusion detection or firewalls doesn't really go in the same room as a smart bulb. You don't build a secure network and then say "hey, I should put some fun into it" :).

Nonsense. As smart light bulbs get even cheaper and more likely, the chances of them being used to achieve useful ends, like automatically dimming up and down as daylight requires, turning off when not needed at light-level instead of room-level, et cetera, rises. Once they're cheaper than alternative methods of doing that they _will_ be used, and eventually you _will_ get a smart bulb on an airgapped network.
Post reply on HN