Flaw in Philips Smart Light Bulbs Exposes Your WiFi Network to Hackers

Whether it’s about exploiting operating system and software
vulnerabilities or manipulating network traffic, every attack
relies on the reachability between an attacker and the targeted
devices.

In recent years, we have seen how hundreds of widely used
smart-but-insecure devices made it easier for remote attackers to
sneak into connected networks without breaking WiFi passwords.

In the latest research shared with The Hacker News, Check Point
experts today revealed a new high-severity vulnerability affecting
Philips Hue Smart Light Bulbs that can be exploited
over-the-air from over 100 meters away to gain entry into a
targeted WiFi network.

The underlying high-severity vulnerability, tracked as
CVE-2020-6007, resides in the way Philips implemented the
Zigbee communication protocol in its smart light bulb, leading to a
heap-based buffer overflow issue.

ZigBee is a widely used wireless technology designed to let each
device communicate with any other device on the network. The
protocol has been built into tens of millions of devices worldwide,
including Amazon Echo, Samsung SmartThings, Belkin Emo and
more.

“Through this exploitation, a threat actor can infiltrate a home
or office’s computer network over-the-air, spreading ransomware or
spyware, by using nothing but a laptop and an antenna from over 100
meters,” the Check Point researchers told The Hacker News.

Check Point also confirmed that the buffer overflow happens on a
component called the “bridge” that accepts remote commands sent to
the bulb over Zigbee protocol from other devices like a mobile app
or Alexa home assistant.

How Does Philips Smart Bulbs Vulnerability Work?

Though researchers choose not to reveal complete technical details
or PoC exploit for the flaw at this moment to give affected users
enough time to apply patches, they did share a video demonstrating
the attack.
As shown in the video, the attack scenario involves:

1. By exploiting a previously discovered^[1]
   bug, an attacker first takes control over the smart bulb.
2. This makes the device ‘Unreachable’ in the users’ control app,
   tricking them into resetting the bulb and then instructing the
   control bridge to re-discover the bulb.
3. The bridge discovers the hacker-controlled bulb with updated
   firmware, and the user adds it back onto their network.
4. The hacker then exploits the ZigBee protocol vulnerabilities to
   trigger a heap-based buffer overflow on the control bridge,
   allowing him to install malware on the bridge that’s connected to
   the targeted network.
5. The hacker can use malware to infiltrate the network,
   eventually leaving millions of other devices connected to the same
   network at risk of remote hacking.

“Many of us are aware that IoT devices can pose a security risk,
but this research shows how even the most mundane, seemingly ‘dumb’
devices such as lightbulbs can be exploited by hackers and used to
take over networks, or plant malware,” Yaniv Balmas, Head of Cyber
Research at Check Point Research, told The Hacker News.
Check Point responsibly reported these vulnerabilities to Philips
and Signify, owner of the Philips Hue brand, in November 2019, who
just last month released an updated, patched firmware for the
device.

“It’s critical that organizations and individuals protect
themselves against these possible attacks by updating their devices
with the latest patches and separating them from other machines on
their networks, to limit the possible spread of malware. In today’s
complex cyberattack landscape, we cannot afford to overlook the
security of anything that is connected to our networks.”

If automatic firmware update download feature is not enabled,
affected users are recommended to manually install patches and
change settings to revive future updates automatically.