Philips Hue LED smart lights hacked, home blacked out by security researcher

Within a the last two decades, lighting has very rapidly moved from Thomas Edison’s highly controlled burning to semiconductor-based illumination. The logical next step after our lights became electronic devices was to turn them into internet-connected gadgets, which Philips did quite successfully with the Hue lighting system. Joining the internet of things is an important advance for lighting, but it means that these devices are subject to the same security issues that all other connected products must face. This week we learned that Philips fell short in its security precautions and a security researcher was able to crack into the Hue’s supposedly closed system, creating a localized blackout.

Using a malware script, Nitesh Dhanjani hacked into a Hue installation and issued a blackout command through the bridge (the Hue’s router) turning the connected lights out entirely. This is essentially the connected home equivalent of a hacker taking over your car, except that Dhanjani actually did it and documented the entire process.

The attack itself doesn’t seem too interesting — theoretically, the hacker gets a bit of malware onto the victim’s computer which tells the Hue bulbs connected to a bridge on the same network to turn off. The bulbs are still powered but they are not not producing light, which is the standard off-state for Hue. This shouldn’t be that bad because the Hue bulbs are designed to revert to the on state after they lose power for any period — say, a wall switch is flipped — but in this case the malware script runs continuously, so the bulbs are commanded to turn off immediately after they are powered up.

By compromising a device on the network — not the Hue system itself — this malware would completely break the Hue for almost any user, unless they thought to try the bulbswithout the bridge installed. In this case the Hue bulbs would not respond to app commands or be able to change color, leaving the owner with a set of very expensive, white Philips LED bulbs (but at least they would work).

In his paper on the hack Dhanjani walks through the Hue’s security — which is otherwise adequate — and makes the point that connected devices must focus on security. He details how the highly connected Hue can be attacked through multiple vectors, including links on Facebook, IFTTT recipes, or by theoretically finding a flaw in the radio protocol (Zigbee Light Link). By placing the malware on a local PC it becomes persistent and much more effective then attacking the Hue itself. Not only does this method circumvent the Hue’s otherwise adequate security, but it would render replacement Hue systems useless as well.

This proof-of-concept hack might not seem very concerning — it’s an exploit, coded by a director at Ernst & Young who’s the whitest of white hat hackers, that disables a few bulbs in a very small number of homes — but its point is clear enough. Philips needs need get smarter about its security, and be more careful about steps that are skipped solely for ease of use. In this case the Hue’s whitelist tokens cannot be edited once they are in place without accessing the debugger, which is not only the malware’s attack vector but also the reason the malware can continue to operate, causing a perpetual blackout.