A vulnerability found in Philips Hue devices allows anyone with sufficient knowledge to take control of the light bulbs, to turn them on or off, but allows you to access any other device connected to the same network, with all that this implies.
The risk is still present today, as Philips has not released any part that addresses this vulnerability but has at least blocked access to the bridge used by Hue products so that friends of others cannot reach the rest of the home device, including any PC connected to the same network.
This vulnerability has been discovered in the Zigbee communication protocol, the one used by Philips Hue bulbs, so it is also available in all home automation products that use this communication protocol, such as Amazon Echo Plus, Samsung SmartThings, Belkin, in Yale smart locks, Honewell thermostats, Ikea Tadfri, Samsung Comcast Xfinity Box, Bosh Security Systems ...
Check Point security researchers, who have discovered a way to scale the attack from a lightbulb to the entire network, they explain to us how it works:
- The attacker uses the original vulnerability to take control of a single light bulb.
- The user sees a random behavior and is unable to manage the correct operation of the bulb, and since the bulb cannot be managed, the user resets the bulb and adds it back to the system.
- At that moment, bulb malware has access to the Hue bridge and it spreads to all devices and computers connected to the same network.
Once he has access to any computer in the home, the attacker can install applications to record keystrokes (and access our passwords) and install ransomware to encrypt our computer and request a ransom to regain access.