9 ms·

The first two points are unreasonable. If someone gets into your house to steal your lighbulb and cut it open, you probably have bigger problems than your wifi

The first two points are unreasonable. If someone gets into your house to steal your lighbulb and cut it open, you probably have bigger problems than your wifi password being stolen. Realistically you probably had it written on a post-it note on the router or your fridge. The second is the same, if someone not only steals the bulb, but also writes a replacement firmware, flashes it, glues it together well enough for you to not notice, and then breaks into your house again to replace it without you noticing, sure they can inject packets into your home wifi, but they already have access to your house, why not just mess with your router directly? The third is inexcusable, yes

fyfy18 8y ago
> The third is inexcusable, yes It depends what exactly the keys are used for. If it's just for secure communication between the app and the bulb, and the keys are different for each bulb, I don't see any issue with this.
- dmitrygr 8y ago
  Including private keys of any sort in the firmware is kind of a no no
  - alanfranzoni 8y ago
    Not necessarily, if the private key is different for every device. What would you have done instead?
    - dmitrygr 8y ago
      seems to be the same in all bulbs :(
  - jon-wood 8y ago
    You need some way for the device to communicate with your backend, and private keys work pretty well. For the devices I work on these keys are unique for each device, and transferred over to it during the setup process.
  - stefan_ 8y ago
    Provisioning each device with a unique certificate signed by a vendor CA is what I would call absolute best practice. It's possible this certificate isn't that and is instead reused across all bulbs. We don't know that. And even if that is the case, there are no details on what this certificate is even used for that would allow us to determine if this is any sort of security problem.
achamayou 8y ago
But if someone gets a bulb from your bins that you’ve thrown away because it was defective in some way, and gets access to your WiFi that way, it’s a bit annoying.
- ce4 8y ago
  It's the same with used hard drives: It's your fault if you throw away unshredded/unwiped disks.
  - PinguTS 8y ago
    Explain that to Average Joe.
  - newaccoutnas 8y ago
    Indeed, but will a non-tecnical user know that. It's been of increasing frequency non-technical users ask for disks to be wiped though, they are aware it contains sensitive information... but a light bulb? Maybe no lightbulb moment for them.
    - ce4 8y ago
      I don't know how to properly address this without wiping. Maybe not use wifi for the bulbs in the first place or not use IoT at all? Consumers will not care about that. Either you trust the lightbulb provider to protect your creds better or don't use it. In my opinion the lifx is reasonably protected and far from being the worst offender here: the attack doesnt work over the air, and depends on physical access to a pre-setup bulb and involves physical labour to access the credentials (needs cutting out the board, removing protecting glue from the board, dumping firmware). This is not really mass-exploitable. Services like wigle will allow to see where the wifi is located though, but the bar for attacking is pretty high. Have a look here for really awfull IoT sec: https://mjg59.dreamwidth.org/40397.html https://mjg59.dreamwidth.org/40397.html
      - newaccoutnas 8y ago
onion2k 8y ago
If someone gets into your house to steal your lighbulb and cut it open, you probably have bigger problems than your wifi password being stolen. No house-breaking is necessary. I could just go and buy a super fancy smart bulb and give it to you. You don't need your old insecure smart bulb any more so you put it in the bin. I take it from your bin. Now I have access to your network. Your tech-savvy neighbour is the threat 99.99% of people should worry about, not a nation-state funded intelligence agency.
- brohee 8y ago
  The WiFi password will be there in any case, obfuscating it is not a big hurdle, and asking a secure element in a $30 lightbulb is unreasonable in a world where many PC still ship without a TPM chip. People sure should have a dedicated IoT network, but in the grand scheme of things, home networks are not usually that sensitive, as in no important yet unencrypted service will be exposed internally as it is typically the case in enterprise networks.
- kortilla 8y ago
  Why would I throw away a perfectly good led smart bulb just because I got another one? That’s a pretty far fetched social engineering scheme if you ask me.
  - nkozyra 8y ago
    Yeah, I don't find it particularly compelling. To me the most compelling vector is actually selling compromised smart bulbs online that phone home and do more malicious stuff. In which case, the internal security of the device is irrelevant.
    - general8bitso 8y ago
      This would be trivial with Amazon comingling inventory.
- 8fingerlouie 8y ago
  Or i could just dump a Raspberry Pi Zero W attached to a 10000 mAh power bank in your garden, and wait for it to capture a 4 way handshake. Retrieve the data from the Pi, and throw some serious cloud computing power at it while bruteforcing the password. Granted, it's going to take longer (perhaps), but chances are you'll never notice until it is too late. Of course, most users won't notice new devices on their Wifi anyway. People keep forgetting that Wifi is per definition insecure. It's not a point to point technology, and every single packet you send is broadcast in a wide area around you. Furthermore, all current authentication methods, WEP/WPA/WPA2 (excluding WPA3 for now, as it has yet to see wide adoption), have all been cracked in one way or another.
general8bitso 8y ago
So, if you had such a lightbulb, and it stopped working, and you put it in your garbage, could somebody not take it, find your pw, and the access your wifi network? Maybe even some ARP poisoning or change your dns servers?
_pmf_ 8y ago
> The third is inexcusable, yes Depending on what it's used for, it's not worse than the second, or am I missing something? I assume it's just for checking the signature of uploaded firmware.
- dmitrygr 8y ago
  to check sigs you need public key, not private
donatj 8y ago
A friends ISP provided router literally has it written on the back. Also don’t forget WPS Push Button access.

fyfy18 8y ago

> The third is inexcusable, yes It depends what exactly the keys are used for. If it's just for secure communication between the app and the bulb, and the keys are different for each bulb, I don't see any issue with this.

dmitrygr 8y ago
Including private keys of any sort in the firmware is kind of a no no
- alanfranzoni 8y ago
  Not necessarily, if the private key is different for every device. What would you have done instead?
  - dmitrygr 8y ago
    seems to be the same in all bulbs :(
- jon-wood 8y ago
  You need some way for the device to communicate with your backend, and private keys work pretty well. For the devices I work on these keys are unique for each device, and transferred over to it during the setup process.
- stefan_ 8y ago
  Provisioning each device with a unique certificate signed by a vendor CA is what I would call absolute best practice. It's possible this certificate isn't that and is instead reused across all bulbs. We don't know that. And even if that is the case, there are no details on what this certificate is even used for that would allow us to determine if this is any sort of security problem.

achamayou 8y ago

But if someone gets a bulb from your bins that you’ve thrown away because it was defective in some way, and gets access to your WiFi that way, it’s a bit annoying.

ce4 8y ago
It's the same with used hard drives: It's your fault if you throw away unshredded/unwiped disks.
- PinguTS 8y ago
  Explain that to Average Joe.
- newaccoutnas 8y ago
  Indeed, but will a non-tecnical user know that. It's been of increasing frequency non-technical users ask for disks to be wiped though, they are aware it contains sensitive information... but a light bulb? Maybe no lightbulb moment for them.
  - ce4 8y ago
    I don't know how to properly address this without wiping. Maybe not use wifi for the bulbs in the first place or not use IoT at all? Consumers will not care about that. Either you trust the lightbulb provider to protect your creds better or don't use it. In my opinion the lifx is reasonably protected and far from being the worst offender here: the attack doesnt work over the air, and depends on physical access to a pre-setup bulb and involves physical labour to access the credentials (needs cutting out the board, removing protecting glue from the board, dumping firmware). This is not really mass-exploitable. Services like wigle will allow to see where the wifi is located though, but the bar for attacking is pretty high. Have a look here for really awfull IoT sec: https://mjg59.dreamwidth.org/40397.html https://mjg59.dreamwidth.org/40397.html
    - newaccoutnas 8y ago

onion2k 8y ago

If someone gets into your house to steal your lighbulb and cut it open, you probably have bigger problems than your wifi password being stolen. No house-breaking is necessary. I could just go and buy a super fancy smart bulb and give it to you. You don't need your old insecure smart bulb any more so you put it in the bin. I take it from your bin. Now I have access to your network. Your tech-savvy neighbour is the threat 99.99% of people should worry about, not a nation-state funded intelligence agency.

brohee 8y ago
The WiFi password will be there in any case, obfuscating it is not a big hurdle, and asking a secure element in a $30 lightbulb is unreasonable in a world where many PC still ship without a TPM chip. People sure should have a dedicated IoT network, but in the grand scheme of things, home networks are not usually that sensitive, as in no important yet unencrypted service will be exposed internally as it is typically the case in enterprise networks.
kortilla 8y ago
Why would I throw away a perfectly good led smart bulb just because I got another one? That’s a pretty far fetched social engineering scheme if you ask me.
- nkozyra 8y ago
  Yeah, I don't find it particularly compelling. To me the most compelling vector is actually selling compromised smart bulbs online that phone home and do more malicious stuff. In which case, the internal security of the device is irrelevant.
  - general8bitso 8y ago
    This would be trivial with Amazon comingling inventory.
8fingerlouie 8y ago
Or i could just dump a Raspberry Pi Zero W attached to a 10000 mAh power bank in your garden, and wait for it to capture a 4 way handshake. Retrieve the data from the Pi, and throw some serious cloud computing power at it while bruteforcing the password. Granted, it's going to take longer (perhaps), but chances are you'll never notice until it is too late. Of course, most users won't notice new devices on their Wifi anyway. People keep forgetting that Wifi is per definition insecure. It's not a point to point technology, and every single packet you send is broadcast in a wide area around you. Furthermore, all current authentication methods, WEP/WPA/WPA2 (excluding WPA3 for now, as it has yet to see wide adoption), have all been cracked in one way or another.

general8bitso 8y ago

So, if you had such a lightbulb, and it stopped working, and you put it in your garbage, could somebody not take it, find your pw, and the access your wifi network? Maybe even some ARP poisoning or change your dns servers?

_pmf_ 8y ago

> The third is inexcusable, yes Depending on what it's used for, it's not worse than the second, or am I missing something? I assume it's just for checking the signature of uploaded firmware.

dmitrygr 8y ago
to check sigs you need public key, not private

donatj 8y ago

A friends ISP provided router literally has it written on the back. Also don’t forget WPS Push Button access.