11 ms·
IoT Goes Nuclear: Creating a ZigBee Chain Reaction
- davimack 10y agoDomain gets tagged as distributing malware by my work's security system, FYI. Dunno what list it's gone on, but it's there.
- toomuchtodo 10y agohttp://archive.is/gRSfN http://archive.is/gRSfN
- cordite 10y agoThis too is not immune. I get it here too.
- jakobdabo 10y agoWell, the HTML contains some very shady (encoded and obfuscated) JavaScript code. If you want to investigate further replace the "return r;" in the very end of those two "evals" with "console.log(r);" then get the decoded code from the browser's console. Then run through code beautifier (built-in in Firefox JS debugger) to get readable code. But there are more code obfuscations later, though easy to reverse but I don't have the time right now.
- enzanki_ars 10y agoYou can use http://archive.is/gRSfN/image http://archive.is/gRSfN/image to get a screenshot of the page.
- Mister_Snuggles 10y agouMatrix doesn't allow this site to show either. View Source reveals that this site is actually an iframed version of http://www.wisdom.weizmann.ac.il/~eyalro/iotworm/ http://www.wisdom.weizmann.ac.il/~eyalro/iotworm/.
- midwestcode 10y ago... shouldn't this be higher up?
- 1propionyl 10y agoClearly, absolutely no one saw this coming, nor did anyone warn us. :-) How else do you explain how woefully unprepared we are?
- oldmanjay 10y agoIt's a little hard to distinguish worthwhile warnings from the near-constant din of finger-wagging
- supergeek133 10y agoExactly, for as many legitimate problems I see posted I usually see double as mean fear-mongering stories.
- pdkl95 10y agoHow, exactly, are you identifying "fear-mongering stories"? Mislabeling real security issues as "fear-mongering" is how widespread security problems are created. When attacks can be trivially copied, even obscure security issues can become easily exploitable problems under attack from bulk exploitation tools.
- supergeek133 10y agoIt's a headline problem. Typically these issues are labeled as "all of IoT is terrible". For as many of these REAL security issues we face, there are many stories published that have no real-world impact. Examples: The story from defcon (or blackhat, cant remember which) about installing ransom-ware on your smart thermostat. The headlines were all "Hackers make thermostat ransom-ware" or "Your smart thermostat is now vulnerable to ransom-ware" A few points: - It required local access - It required an SD card reader - It also required the thermostat run a local HTTP server Another decent example were the SmartThings security holes from earlier this year: - It was mostly an oauth2 authorization issue (applications requesting grant types it didn't need) - The apps were actually independently developed (not ST official) and took some technical knowledge to deploy yourself - The rest were known security issues in the Zigbee protocol that SmartThings has little control over. Similar to this article. Or the botnet of cameras which is probably the most high-profile example and most relevant are labeled as "The IoT brought down the internet" That's a lesson for the makers of those cheap DVRs and Cameras, it was also a lesson in user documentation to avoid them doing stupid things. That's the only example in recent years I've seen that goes anywhere, but the problem is it's drowned out by nonsense and clickbait headlines.
- supergeek133 10y agoDid they detail if they heard anything back from Atmel? Or did they reach out to the Zigbee alliance? I'm reading through the paper and haven't found it yet. Only that they heard from Philips. This is also why you're starting to see more and more devices opt to a completely device to cloud infrastructure instead of local communication. More control of the stack on device and in the air.
- cryo 10y agoThere is a official statement now http://www.zigbee.org/zigbee-alliance-statement-on-security/ http://www.zigbee.org/zigbee-alliance-statement-on-security/
- supergeek133 10y agoThanks.
- IshKebab 10y agoWait Hue doesn't use asymmetric keys to sign its firmware updates?
- breatheoften 10y agoI was wondering the same thing ... shouldn't a design goal for the signing mechanism be to make it impossible to derive signing capability without access to some secret not present on the device?
- Dylan16807 10y agoRight. Using "standard cryptographic techniques" is not sufficient when you are using the wrong technique for the job.
- ChuckMcM 10y agoI had a discussion once, back when I was wearing a crypto hat, which went like this: Me: "Yes triple-DES is reasonably secure, how do you exchange keys?" Them: "That is part of the connection setup." Me: "Great, how do you protect the keys during setup?" Them: "What do you mean?" Me: "What form of encryption do you use when you're doing the setup, and sending over the keys?" Them: "Well we really can't encrypt the setup part, after all we haven't even set up a connection yet." Me: "Ok, and thanks. Now move along, we'll call you..."
- arnarbi 10y agoA closer to home example: This is how the top comment starts on the HN thread about the ZLL master key being published, two years ago: "This may not be much of an attack. The master key is used only during "commissioning", when a controller is introduced to a light." [1] https://news.ycombinator.com/item?id=9249753 https://news.ycombinator.com/item?id=9249753
- timlyo 10y agoTrying to learn some more about crypto, what sort of answer would you be looking for? Would Diffie-Hellman be appropriate?
- M_Grey 10y agoLike being "blindsided"... by a steamroller... from 20 miles away. Then again, "Disaster in slow motion" seems to be the order of the day, from economics to climate.
- revelation 10y agoglobal AES-CCM key that Philips uses to encrypt and authenticate new firmware Who on earth authenticates firmware through AES. Even Sony realizes that doesn't work. (I can already imagine how the idiots fixed this: by drawing another set of bytes for a new "authentication" key..)
- aruss 10y agoIt's theoretically sound with a good HSM. But agreed, I'd rather rely on getting a sound software implementation of an asymmetric signature scheme than rely on protecting a symmetric key with hardware.
- SEJeff 10y agoAnd this is why we can't have nice things :(
- alanh 10y agoMy work is blacklisting this domain (eyaltro.net) for malware — this URL works for me: http://colinoflynn.com/iotworm/ http://colinoflynn.com/iotworm/ (Is it the same content?)
- deleted 10y ago[deleted]
- bbvnvlt 10y agoYes.
- ekux44 10y agoPhilips may have fixed the vulnerability in an update, but that's insufficient if these devices don't have high update rates. I wonder how many years until there are fewer than 15000 vulnerable Hue devices in Paris... We should hold manufacturers accountable for not aggressively pushing security updates on their users.
- swiley 10y ago>We should hold manufacturers accountable for not aggressively pushing security updates on their users. There's really no way to /force/ companies to support products they release like that. The company may not even exist a few years down the road. You could force them to release the firmware source so the users/community can patch it themselves but I don't see a way to do what you're saying.
- mivok 10y agoHue forces updates on you every time you go into the app if there's one available, and you can't use the app until you've updated. Granted this isn't ideal if you primarily use your light switch or an amazon echo to control the lights, and fully automatic updates would probably be better, but it comes pretty close to aggressively pushing updates.
- TeMPOraL 10y agoIt's pretty aggressive alright. I'm working on my own (RPi-based) controller but for now, I'm still primarily using Hue app for controlling the lights at my home. So every two weeks or so, when I come home in the evening, I'm forced to sit in darkness for 10 minutes as the update installs itself (they say lights must stay powered, so I don't dare powercycle them during the update). First world problems and all.
- user5994461 10y agoEverything will be fine =) It's not even possible to get two ZigBee products from different manufacturers to operate (like a switch and a lamp). The attack can't succeed at what the industry's been failing for 10 years.
- makmanalp 10y agoUgh, this is too true. Standard indeed.
- vanderZwan 10y agoSo what you're saying is that if someone does make it work, we should reverse engineer the worm for understanding how to achieve better device interop? ;-)
- runeks 10y ago> It's not even possible to get two ZigBee products from > different manufacturers to operate (like a switch and a > lamp). It may require a distinct payload for each type of device/software, but it should be possible. You start by infecting a group of devices of one type with a specific payload, and from there see which other types of devices are in range, and either carry the required payloads with you or fetch one over a nearby wifi. And indeed, if someone were to implement this, they would basically have built a standard ZigBee inter-device communication protocol, by using existing software features (bugs), in otherwise incompatible devices. This is not too far off from something like Stuxnet, so -- given enough available capital -- it should be possible.
- vanderZwan 10y ago> And indeed, if someone were to implement this, they would basically have built a standard ZigBee inter-device communication protocol, by using existing software features (bugs), in otherwise incompatible devices. I was indeed half-joking, half-serious. Actually, aren't there cases where viruses (the biological kind) have ended up serving a function in the DNA machinery of multi-cellular life-forms? Would be a funny parallel.
- 10y ago
- ams6110 10y agoIf you are silly enough to think that your light bulbs need to connect to the internet or to each other, you deserve what you get. I'm glad I bought up a stockpile of incandescents before they were banned.
- adt2bt 10y agoI get your point about internet connected light bulbs, but is there a particular reason you selected incandescents over other more energy efficient bulbs that don't have IoT capabilities?
- algesten 10y agothe quality of light from your average energy bulb is typically terrible. I like warm light and whilst I know I can't see infra-red frequencies I want to see a concentration of light towards that end of the spectrum. It just makes for a much more relaxed feeling. I stockpiled too. and I have dimmers on pretty much every lamp (including the toilet), so the bulbs last for a very long time. when you don't burn them on full wattage they last much much longer.
- adrianN 10y agoThey make warm-light LED bulbs.
- AnthonBerg 10y agoThe perceived color temperature of the light is not the main issue in light quality, but rather the smoothness of the frequency composition of the light. Cheap LED bulbs have a "gappy" spectrum. "High CRI" bulbs are probaably what the OP is looking for.
- Ar-Curunir 10y agoSomething cool: The Shamir here is the Shamir of RSA fame.
- mkj 10y agoObviously he's just bitter they didn't use his cryptosystem ;)
- kodfodrasz 10y agoNuclear does not mean chain reaction. I hate these catchy titles.
- mvindahl 10y agoYeah, if it works (which I'm not even sure that it would), it would bear a lot of resemblance to a computer virus and no resemblance at all to a nuclear bomb.
- kodfodrasz 10y agoNuclear does not necessarily mean a bomb It mean something in the (atomic) nuclei or related to these. Forces, reactions, particles, etc. Surely chain reaction is a member of this set, but not the only thing. Sure, most nuclear devices we hear about use the chain reaction (power plants, bombs), but an x-rax machine is also somewhat a nuclear device. Sometimes we even induce neutron capture, which is the opposite of chain reactipn (afaik to create some special isotopes, or to start/sustain a chain reaction).
- qb45 10y agoThis title is stupid indeed. My first thought was "sounds like some commercial HOWTO-vertisement".
- mancerayder 10y agoI see complaints about compatibility with Zigbee, and security holes like this. What's the right protocol to use that doesn't have horrible vendor lock-in? ZWave has some chip licensing requirement, doesn't it?