Sunday, December 3, 2023

Hackers Can Exfiltrate & Transfer the Sensitive Data using Smart Bulbs Lights

A new research reveals that hackers can exfiltrate the sensitive data from the Smart Bulbs using lights as a channel and transfer the data from the compromised devices.

Smart bulbs are now widely available as home-based appliances that connected to the Internet and allow users to changes the color, remotely control it and users can schedule on and off times.

Few Months before In a similar research that connected smart light can be used as a covert-channel to exfiltrate the user’s private data by taking advantage of light emitted by modern smart bulbs.

Researchers tested the industries leading smart bulbs and take a look on Magic Blue smart bulb that available very less price in the market.

These bulbs are manufacturing by the Chinese company  Zengge and it is connected with a mobile application in order to users control the smart bulb.

In this case, researchers using different types of hardware and the main goal was to sniff the communication in between Bulb and the paired mobile application.

Sniffing & Exfiltrate the Data using Smart bulbs

Initially, Team of researchers paired the mobile phone with the right app and there are 4 hardware involved in this process of sniffing operation including 3 Ubertooth (aka uberteeth), Smart Bulb, Mobile Phone, Laptop.

Later they started changing the colors and meanwhile they also they connected 3 ubertooth dongles to their Linux machine where they getting the traffic and analyze them using Wireshark network analysis tool.

Under the process of reversing the mobile application, researchers used the adb tool to download the Android application and used jadx to analyze it to make sure changing colors are same as they found in sniffing apps.

According to checkmarxm, The main plan for exfiltration was to use light as a channel to transfer information from a compromised device to the attacker. Light can achieve longer distances, which was our goal. Imagine the following attack scenario: a BLE device (smartphone) gets compromised with malware. The malware steals the user’s credentials. The stolen information is sent to an attacker using a BLE light bulb nearby.

In this case, attackers receive an exfiltrated data using a smartphone and it will be connected to telescope in order to visible it widely.

Researchers created two apps, One for sending the exfiltrate the data and another one will receive the data.

Here the first app has 2 modes, normal and stealthy. Normal mode allows smart bulb exfiltration app which is visible to the human eye that helps to App scans for the vulnerable bulbs, sending the Payload and stealthy mode which helps to scan the vulnerable bulbs and Starts the loop of exfiltration data.

Researchers demonstrate the proof-of-concept in below Video:

“These methods will work on every smart bulb that allows control by an attacker. In the future, we would like to create a better proof of concept that allows us to test a database of vulnerable bulbs and even implement AI to learn and implement new bulbs along the way. “Researchers said.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.


Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles