Hackers Can Exfiltrate & Transfer the Sensitive Data using Smart Bulbs Lights

A new research reveals that hackers can exfiltrate the sensitive data from the Smart Bulbs using lights as a channel and transfer the data from the compromised devices.

Smart bulbs are now widely available as home-based appliances that connected to the Internet and allow users to changes the color, remotely control it and users can schedule on and off times.

Few Months before In a similar research that connected smart light can be used as a covert-channel to exfiltrate the user’s private data by taking advantage of light emitted by modern smart bulbs.

Researchers tested the industries leading smart bulbs and take a look on Magic Blue smart bulb that available very less price in the market.

These bulbs are manufacturing by the Chinese company  Zengge and it is connected with a mobile application in order to users control the smart bulb.

In this case, researchers using different types of hardware and the main goal was to sniff the communication in between Bulb and the paired mobile application.

Sniffing & Exfiltrate the Data using Smart bulbs

Initially, Team of researchers paired the mobile phone with the right app and there are 4 hardware involved in this process of sniffing operation including 3 Ubertooth (aka uberteeth), Smart Bulb, Mobile Phone, Laptop.

Later they started changing the colors and meanwhile they also they connected 3 ubertooth dongles to their Linux machine where they getting the traffic and analyze them using Wireshark network analysis tool.

Under the process of reversing the mobile application, researchers used the adb tool to download the Android application and used jadx to analyze it to make sure changing colors are same as they found in sniffing apps.

According to checkmarxm, The main plan for exfiltration was to use light as a channel to transfer information from a compromised device to the attacker. Light can achieve longer distances, which was our goal. Imagine the following attack scenario: a BLE device (smartphone) gets compromised with malware. The malware steals the user’s credentials. The stolen information is sent to an attacker using a BLE light bulb nearby.

In this case, attackers receive an exfiltrated data using a smartphone and it will be connected to telescope in order to visible it widely.

Researchers created two apps, One for sending the exfiltrate the data and another one will receive the data.

Here the first app has 2 modes, normal and stealthy. Normal mode allows smart bulb exfiltration app which is visible to the human eye that helps to App scans for the vulnerable bulbs, sending the Payload and stealthy mode which helps to scan the vulnerable bulbs and Starts the loop of exfiltration data.

Researchers demonstrate the proof-of-concept in below Video:

“These methods will work on every smart bulb that allows control by an attacker. In the future, we would like to create a better proof of concept that allows us to test a database of vulnerable bulbs and even implement AI to learn and implement new bulbs along the way. “Researchers said.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting victims…

9 hours ago

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ advanced…

9 hours ago

XSS Vulnerability in Bing.com Let Attackers Send Crafted Malicious Requests

A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to execute…

12 hours ago

Meta Removed 2 Million Account Linked to Malicious Activities

 Meta has announced the removal of over 2 million accounts connected to malicious activities, including…

15 hours ago

Veritas Enterprise Vault Vulnerabilities Lets Attackers Execute Arbitrary Code Remotely

Critical security vulnerability has been identified in Veritas Enterprise Vault, a widely-used archiving and content…

16 hours ago

7-Zip RCE Vulnerability Let Attackers Execute Remote Code

A critical security vulnerability has been disclosed in the popular file archiving tool 7-Zip, allowing…

16 hours ago