Hacked Light Bulbs Can Reveal Your Wi-Fi Password

Hacked Light Bulbs Can Reveal Your Wi-Fi Password

It’s all the new craze: the connected or smart home, where at the touch of a button on your smartphone you can dim your living room lights, close the garage door, let the housekeeper into your home because she forgot her key and turn off the water should there be a leak, all while keeping a live, virtual eye on your property. But, with sophisticated technology comes risk if you aren’t vigilant in applying the latest security updates to your smart home. In fact, the latest risk involves LED light bulbs that can be hacked to change the lighting and reveal the homeowner’s Wi-Fi Internet password.

Hacked Light Bulbs Can Reveal Your Wi-Fi PasswordResearchers at Context Information Security were intrigued by LIFX light bulb systems because these LED bulbs use new wireless network protocols, operating on the 802.15.4 6 LoWPAN wireless mesh network, built upon the same base standard used by Zigbee. For the homeowner, they work just like regular light bulbs, simply screw them in; but, with LIFX, the homeowner can also control them from a downloadable smartphone app.

Context Information Security found that “LIFX’ mesh network protocol was largely unencrypted, which allowed them to easily crop messages to control the light bulbs and replay arbitrary packet payloads.” By monitoring these packets, researchers found that when new light bulbs are added, messages are transmitted from the master bulb containing Wi-Fi details. All a hacker has to do is request these details from the master bulb because no alarms were raised within the system.  

Ultimately, researchers were able to identify what encryption code there was and inject packets into the network.

LIFX has since released a firmware update in to fix the problem, but non-updated users remain unprotected.

Even though a hacker would have to be within less than 25 yards to make a hack successful, this demonstrates that the need for cyber security is expanding into our homes.

About the Author

Ginger Hill is Group Social Media Manager.

Featured

  • Live From ISC West: Day 2 Recap

    If it’s even possible, Day 2 of ISC West in Las Vegas, Nevada, was even busier than the first. Remember to keep tabs on our Live From ISC West page for news and updates from the show floor at the Venetian, because there’s more news coming out than anyone could be expected to keep track of. Our Live From sponsors—NAPCO Security, Alibi Security, Vistacom, RGB Spectrum, and DoorKing—kept the momentum from Day 1 going with packed booths, happy hours, giveaways, product demonstrations, and more. Read Now

    • Industry Events
    • ISC West
  • Visiting Sin City

    I’m a recovering alcoholic, ten years sober this June. I almost wrote “recovered alcoholic,” because it’s a problem I’ve long since put to bed in every practical sense. But anyone who’s dealt with addiction knows that that part of your brain never goes away. You just learn to tell the difference between that insidious voice in your head and your actual internal monologue, and you get better at telling the other guy to shut up. Read Now

  • On My Way Out the Door

    To answer that one question I always get, at every booth visit, I have seen amazing product technology, solutions and above all else, the people that make it all work. Read Now

    • Industry Events
    • ISC West
  • Return to Form

    My first security trade show was in 2021. At the time, I was awed by the sheer magnitude of the event and the spectacle of products on display. But this was the first major trade show coming out of the pandemic, and the only commentary I heard was how low the attendance was. Two representatives from one booth even spent the last morning playing catch in the aisle with their giveaway stress balls. Read Now

    • Industry Events
    • ISC West

Featured Cybersecurity

New Products

  • PDK IO Access Control Software

    PDK.IO Access Control Software

    ProdataKey now allows for "custom fields" within the interface of its pdk.io software. Custom fields increase PDK's solutions' overall functionality by allowing administrators to include a wide range of pertinent data associated with each user. 3

  • Tyco Kantech EntraPass security management software

    Tyco Kantech EntraPass security management software

    Johnson Controls, the global leader in smart, healthy and sustainable buildings, and architect of the Open Blue digital connected platforms, has released the newest version of the Tyco Kantech EntraPass security management software. 3

  • Unique Oversized ID Card Printer

    Unique Oversized ID Card Printer

    Idesco Corp. is announcing its card printer – the XCR100 2.0 printer- that allows customers to personalize oversized ID cards on demand. The printer is ideal for assisting healthcare organizations find the right badging solution. As healthcare facilities continue to combat the spread of COVID-19, issuing oversized ID cards has helped identify staff clearly while adding an extra layer of security. The XCR100 2.0 printer is the only dye-sublimation printer on the market that can personalize CR100 cards (3.88" x 2.63"). The cards that are 42% larger than the standard credit card size. The printer can produce up to 180 full cards per hour in color, and up to 1,400 cards per hour in monochrome. An optional flipper is available to print dual-sided badges in one pass. Contactless encoding comes as an option to help healthcare facilities produce secure access badges on demand and the card printer features a 2-year warranty. 3