Hacking into Internet-Connected Light Bulbs

http://www.contextis.co.uk/blog/hacking-internet-connected-light-bulbs/

by TomAnthony • 12 years ago

96 40 12 years ago

contextis.co.uk

I have the pleasure of having been involved with one of the first network protocol reverse-engineers of the LIFX [0], and off the back of that hacked together a NodeJS library and a Wireshark dissector. I've updated the NodeJS lib to handle the new firmware (it does more over UDP, whereas it used to use a mixture of UDP and TCP) but not the dissector yet.

There's absolutely no authentication on the network protocol at all; as long as you're in the same network as the bulbs then you can send UDP packets and control the bulbs. I imagine this is a good and a bad thing; XBoxes automatically setting mood lighting when playing games etc... I'd rather they had to ask my permission before doing that, though.

[0] https://github.com/magicmonkey/lifxjs/blob/master/Protocol.m...

lbotos• 12 years ago

Thank you for sharing your work. I've considering getting some small cheap ir rgb bulbs and building some kind of "rPi/arduino lifx bridge" to control them all from the lifx side. This will help a lot. :)

dgoodlad• 12 years ago

There's also an official Ruby library for communicating with LIFX devices: https://github.com/LIFX/lifx-gem

RyJones• 12 years ago

They're a member of the AllSeen Alliance, so in the future they will probably support AllJoyn for control.

Disclaimer: I work on AllJoyn.

https://git.allseenalliance.org/cgit/lighting/service_framew... https://allseenalliance.org

easy_rider2• 12 years ago

I just bought 3 Miilight bulbs, and obviously after installing them I was like. Man my neighbours could probably control my lights... I also have a RF remote which operates on 2,4ghz and does not require network authentication. The Wifi bridge does require authentication however. I was thinking of building an RF "cannon" with a directional antenna and see how far I can go. I also got a DVB-T dongle. I should be able to "catch" the signal, right?

DanHulton• 12 years ago

I can't seem to find anything on the Googles for that product.

Is it spelled correctly? Can you give me a link to it? I'm interested in home automation, but all the ones I've looked into so far don't really do it for me.

profil• 12 years ago

I guess he means http://www.milight.com/

cromulent• 12 years ago

Probably a typo. Try http://www.milight.com.

easy_rider2• 12 years ago

Thanks guys, typo indeed. [0]

Here is a article [1] describing a setup involving this type of RGB light and the raspberry. It also covers some other type of RGB lights.

The wifi bridge has been sitting on my desk for a while now. not bothered yet since the remote is sufficient for now. So can not really comment on that. Otherwise happy with one of the cheaper alternatives. No problems as of yet. Waiting for my lights to get switched on and off though :D The remote doesn't require line of sight as its RF, and already has quite the range.

[0] http://www.milight.com/

[1] http://iqjar.com/jar/home-automation-using-the-raspberry-pi-...

madeofpalk• 12 years ago

Have you looked much at the Philips Hue? The combination of a reletively low price (at least compared to LifX) and an open RESTful API, they're my favourite.

Recently I created a little node service that listens to events from our site from RabbitMQ and flashes the Hue lightbulbs when interesting things happen.

boredinballard• 12 years ago

The dvbt dongles can usually only make it up to 2.2ghz max.

lucaspiller• 12 years ago

You can plug a down converter into it so that the 2.4GHz is within range of the RTL-SDR device:

http://blog.cyberexplorer.me/2014/01/sniffing-and-decoding-n...

userbinator• 12 years ago

A light bulb has more processing power than the PC I used in the early 90s. What an interesting world we live in.

pling• 12 years ago

Just remember that back then your computer was unreliable and your light bulb was reliable.

Now your light bulb is unreliable as well as your computer :)

a3n• 12 years ago

The light bulb halting problem, pre-IoT: Will it turn off? Yes.

The light bulb halting problem, now: Will it turn off? Impossible to say.

Timmmmbob2• 12 years ago

Not really, unless your early 90s PC was really shit.

me1010• 12 years ago

Yes really. The 50 to 100 MHz 486 processor was the state of the art consumer computing platform of the early 90s.

The bulb in question here has not just one, but two processors that both run faster than the 100MHz 486. Also, when Windows 95 came out - in 1996 - the minimum required RAM was 4MB. The ST processor in the light bulb has built in RAM of 1MB. So, in theory, it would be possible with a few hacks to get the bulb to run MS Windows 95...

EDIT: I guess it was OSR2 in 1996... still, the light bulb is a decent computing machine in comparison to early to mid-90s consumer tech...

tokenizerrr• 12 years ago

At the end a new secure on-boarding mechanism is mentioned. How does this now work?

Timmmmbob2• 12 years ago

Presumably you have to use a smart phone to connect to each bulb when you install it and send it a non-fixed key.

Udo2• 12 years ago

That reminds me of a little accident I had with my home automation interface.

In an effort to make the UI accessible from the outside (for me), I forwarded the Raspberry Pi's HTTP server port to the server where I host my normal web stuff. Only I screwed up the proxy rule in the NginX config. All of a sudden, lights and blinds went haywire all over the house.

Turns out whoever visited any of my domains at the time got the HA control panel instead. And people clicked on the devices!

wildpeaks• 12 years ago

Add a webcam and turn it into an art installation :)

Udo2• 12 years ago

Surveillance cams are part of the setup ;) They're old, modified Android phones, actually.

vfclists• 12 years ago

What is the purpose of internet connected light bulbs? Is the internet of things a way to spy on people who remove the batteries from their mobile phones or what?

Is it just some excuse to con investors into buying stocks in some insanely valued IPOs?

I don't mean to be negative and I understand the value of information in our economic life, but how much info is required from the internet of things to support our home life of eating, drinking, fornicating, watching TV and going to bed at the end of day?

who keeps all this info and what to they do with it?

egypturnash• 12 years ago

I am pretty sure the purpose is mostly "have cool multicolored lights you control with your phone".

PeterGriffin• 12 years ago

This is why Nest didn't start, like many, with internet controlled colored light bulbs. It's a very lazy product with a small market (namely, people so bored with their life, they want internet controlled colored lightbulbs).

You gotta admit thermostats have a purpose for being connected though. It's nice to have your thermostat know you're coming home or going away, and adjust things accordingly.

Also doors with locks of all kinds. It's very interesting to have your key be your smartphone.

It's also very interesting for thiefs to unlock said doors without physically breaking in, causing noise and so on.

Which means you can sell internet connected home alarms.

When all is said and done, we'll be all "internet of things". Things that do stuff, and things that protect us from the side effects of the first things. The possibilities are endless.

icebraining• 12 years ago

I'm pretty sure the intersection of people worried enough to remove the batteries from their cellphones and willing to buy internet-connected lightbulbs is indistinguishable from the null set.

As for their purpose, well, to the company it's too make money, to the buyers, that's explained by this classic¹ strip of C&H: http://assets.amuniversal.com/6e921050df960131725e005056a954...

¹ yes, it's redundant, I know

__david__• 12 years ago

Due to the technical challenges involved, specialist equipment required and general perception that it would be the hardest, we decided to begin our search for vulnerabilities in the intra-bulb 802.15.4 6LoWPAN wireless mesh network.

Sentences like that make me happy. I love the hacker spirit.

dmd• 12 years ago

Wait, intra-bulb? There's a wireless mesh network within different parts of the bulb, not just between the bulbs?

Ecio78• 12 years ago

I suppose it's a typo or a mistake between intra and inter

cryo2• 12 years ago

The LIFX guys should asap enable the lock bits on the micro conrollers. Reading out the firmware from a product is a no-go.

The TI CC2538 should be safe against attacks in which the flash could be obtained even after a chip erase like in older modules [1].

[1] TI CC2430 Attack http://www.blackhat.com/presentations/bh-usa-09/GOODSPEED/BH...

e12e3• 12 years ago

They're distributing the firmware on-line (for updates) -- why prevent reading the firmware from the chip itself?

mschuster912• 12 years ago

Distribute encrypted firmwares instead so that hackers have to first extract the (in this case globally distributed) private key.

e12e3• 12 years ago

Great stuff. And yet, all I can think of is:

CRASH AND BURN

spb• 12 years ago

But who would want to hack a lightbulb? http://www.gunpointgame.com/

Hacking into Internet-Connected Light Bulbs

Related Stories