Smart devices have the potential to make our lives easier. Remote light control, intelligent home temperature management, even a refrigerator that can display its contents on your phone screen – it all sounds great, doesn’t it? However, how many users actually consider the security implications of such devices? Not everyone is aware of how vulnerable Internet of Things (IoT) devices can be to various types of attacks, mainly because they have very limited computational power, which practically makes it impossible to enable any form of traffic encryption. Let’s not forget about recent vulnerabilities and issues associated with smart devices.
Let’s start with… light bulbs. They may seem like simple devices, either they light up or they don’t, and sometimes you can adjust their color or brightness. However, even such a light bulb can be used to execute a simple attack. As an example, let’s take a product from a well-known networking equipment manufacturer, TP-Link, specifically the Tapo L530E light bulb. Researchers from universities in London and Catania analyzed this product, mainly due to its popularity. The results of this analysis demonstrate how vulnerable IoT devices can be. Several vulnerabilities were found in this device, with the first one marked as highly critical (CVSS score 8.8) because it allowed for credential theft, providing an opportunity for attackers to take control of the device. The second vulnerability was also considered highly critical (score 7.6) and resulted from a fixed-length checksum, leading to low randomness during encryption key generation and high predictability. The third vulnerability, or rather a manufacturer oversight, was that the session key remained active for 24 hours, giving hackers plenty of time to carry out malicious activities.
Individually, these vulnerabilities may not be easy to exploit in a meaningful way, but when combined and used together, they create the potential for easy access to the Wi-Fi password of the bulb’s network. And this opens up much greater possibilities…
The second issue with smart devices is that some of them have a significant number of sensors that enable environmental scanning (some have cameras, infrared sensors, GPS modules). However, have you ever wondered how this information is processed? Is it only available locally, or is it transmitted elsewhere? A good example is the iRoomba cleaning robot, a very popular robotic vacuum cleaner that took pictures of household members in various situations.
How did this situation arise? The manufacturer conducted an experimental program aimed at improving and adapting the device to operate in various conditions. The mentioned images were sent to the company ScaleAI, but unfortunately, as often happens, some employees were not very honest and shared the obtained photos on the internet. This triggered a significant discussion about our privacy concerning these types of devices.
So, what’s the moral of both of these stories? It’s worth having limited trust in smart devices, especially those that connect to external servers of various companies. How can you protect yourself from this? Consider using a local controller for smart devices, such as HomeAssistant or Domoticz. There are many free and continually developed solutions that are definitely worth considering.
Source:
TP-Link smart bulbs can let hackers steal your WiFi password
Kobieta siedziała na toalecie, a robot Roomba zrobił jej zdjęcie. Trafiło do sieci
