iot goes nuclear: creating a zigbee chain reactioneyalro/pdf/iotsp17.pdf · creating a lightbulb...
TRANSCRIPT
![Page 1: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/1.jpg)
IoT Goes Nuclear:Creating a ZigBee Chain Reaction
Eyal Ronen, Colin O’Flynn, Adi Shamir, Achi-Or Weingarten
![Page 2: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/2.jpg)
![Page 3: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/3.jpg)
Typical IoT devices: Philips Hue Smart Lights
![Page 4: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/4.jpg)
Typical IoT devices: Philips Hue Smart Lights
• Mature technology and standards, a relatively simple system
![Page 5: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/5.jpg)
Typical IoT devices: Philips Hue Smart Lights
• Mature technology and standards, a relatively simple system
• A high end product with high end security, but…
![Page 6: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/6.jpg)
The underlying ZLL protocol
![Page 7: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/7.jpg)
The underlying ZLL protocol
• Each installed light is connected to a central controller using the ZigBee Light Link (ZLL) wireless protocol in a Personal Area Network (PAN)
ZigbeePersonal Area Network
![Page 8: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/8.jpg)
The underlying ZLL protocol
• Each installed light is connected to a central controller using the ZigBee Light Link (ZLL) wireless protocol in a Personal Area Network (PAN)
• The bridge is connected to a secure home/ office network, and is controlled by a smartphone app via IP
IP
![Page 9: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/9.jpg)
The underlying ZLL protocol
• Each installed light is connected to a central controller using the ZigBee Light Link (ZLL) wireless protocol in a Personal Area Network (PAN)
• The bridge is connected to a secure home/ office network, and is controlled by a smartphone app via IP
• It enables each authorized user to turn each light on or off, to change the light intensity, and to set its color
![Page 10: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/10.jpg)
Creating a lightbulb worm
• A question: Can hackers create a worm which spreads using only the standard ZigBee wireless interface?
![Page 11: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/11.jpg)
Creating a lightbulb worm
• A question: Can hackers create a worm which spreads using only the standard ZigBee wireless interface?
• Two main obstacles:
![Page 12: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/12.jpg)
Creating a lightbulb worm
• A question: Can hackers create a worm which spreads using only the standard ZigBee wireless interface?
• Two main obstacles:• Taking over a preinstalled smart light
![Page 13: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/13.jpg)
Creating a lightbulb worm
• A question: Can hackers create a worm which spreads using only the standard ZigBee wireless interface?
• Two main obstacles:• Taking over a preinstalled smart light• Spreading everywhere – finding a method for one smart light
to infect nearby smart lights
![Page 14: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/14.jpg)
![Page 15: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/15.jpg)
Taking over a preinstalled smart light
![Page 16: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/16.jpg)
Taking over a preinstalled smart light
• ZigBee Light Link standard uses multiple cryptographic and security protocols to prevent misuse
![Page 17: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/17.jpg)
Taking over a preinstalled smart light
• ZigBee Light Link standard uses multiple cryptographic and security protocols to prevent misuse
• In particular, uses a proximity test to make sure that the only way to take control of an already installed Hue lamp is by operating it within 10-20 cm from its new controller
![Page 18: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/18.jpg)
Protocol Outline
Controller Lamp
Scan Request(Transaction ID)
Scan Response
Network Start (Transaction ID)
Reset to Factory New (Transaction ID)
Proximity Test
![Page 19: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/19.jpg)
Protocol Outline
Controller Lamp
Scan Request(Transaction ID)
Scan Response
Network Start (Transaction ID)
Reset to Factory New (Transaction ID)
Proximity Test
![Page 20: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/20.jpg)
Protocol Outline
Controller Lamp
Scan Request(Transaction ID)
Scan Response
Network Start (Transaction ID)
Reset to Factory New (Transaction ID)
Proximity Test
![Page 21: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/21.jpg)
Protocol Implementation Bug
![Page 22: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/22.jpg)
Protocol Implementation Bug• We want to cause the light to Reset to Factory New
![Page 23: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/23.jpg)
Protocol Implementation Bug• We want to cause the light to Reset to Factory New
![Page 24: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/24.jpg)
Protocol Implementation Bug• We want to cause the light to Reset to Factory New
• Can’t set a valid Transaction ID due to proximity test
![Page 25: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/25.jpg)
Protocol Implementation Bug• We want to cause the light to Reset to Factory New
• Can’t set a valid Transaction ID due to proximity test
Non-Zero
![Page 26: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/26.jpg)
Protocol Attack Outline
Controller LampFactory Reset (Transaction ID=0)
![Page 28: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/28.jpg)
We then decided to take full control of all the smart lights in the same office building we attacked before
By launching a drone carrying a fully automated attack equipment 400 meters away
![Page 29: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/29.jpg)
second warflying video here
![Page 30: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/30.jpg)
Spreading everywhere
![Page 31: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/31.jpg)
CPA for RE
![Page 32: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/32.jpg)
Block Cipher Encryption
Ciphertext (CTM)
Nonce (unknown) Counter (m)
CBC State m -1 (CBCM-1)
Block Cipher Encryption
Plaintext (PTM)
CBC State m (CBCM)
Block Cipher Encryption
Ciphertext (CTM+1)
Nonce (unknown) Counter (m+1)
Block Cipher Encryption
Plaintext (PTM+1)
CBC State m (CBCM+1)
New CPA attack on CCM
![Page 33: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/33.jpg)
Block Cipher Encryption
Ciphertext (CTM)
Nonce (unknown) Counter (m)
CBC State m -1 (CBCM-1)
Block Cipher Encryption
Plaintext (PTM)
CBC State m (CBCM)
Block Cipher Encryption
Ciphertext (CTM+1)
Nonce (unknown) Counter (m+1)
Block Cipher Encryption
Plaintext (PTM+1)
CBC State m (CBCM+1)
New CPA attack on CCMJaffe 07Requires 2^16 blocks
![Page 34: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/34.jpg)
Block Cipher Encryption
Ciphertext (CTM)
Nonce (unknown) Counter (m)
CBC State m -1 (CBCM-1)
Block Cipher Encryption
Plaintext (PTM)
CBC State m (CBCM)
Block Cipher Encryption
Ciphertext (CTM+1)
Nonce (unknown) Counter (m+1)
Block Cipher Encryption
Plaintext (PTM+1)
CBC State m (CBCM+1)
New CPA attack on CCMO’Flynn & ChenChosen Nonce
![Page 35: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/35.jpg)
Block Cipher Encryption
Ciphertext (CTM)
Nonce (unknown) Counter (m)
CBC State m -1 (CBCM-1)
Block Cipher Encryption
Plaintext (PTM)
CBC State m (CBCM)
Block Cipher Encryption
Ciphertext (CTM+1)
Nonce (unknown) Counter (m+1)
Block Cipher Encryption
Plaintext (PTM+1)
CBC State m (CBCM+1)
New CPA attack on CCM
ECB - modified key
![Page 36: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/36.jpg)
Block Cipher Encryption
Ciphertext (CTM)
Nonce (unknown) Counter (m)
CBC State m -1 (CBCM-1)
Block Cipher Encryption
CBC State m (CBCM)
New CPA attack on CCM
![Page 37: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/37.jpg)
Block m Const
Block Cipher Encryption
Ciphertext (CTM)
CBC State m (CBCM)
New CPA attack on CCM
![Page 38: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/38.jpg)
Modified Key Block Cipher Encryption
Ciphertext (CTM)
CBC State m (CBCM)
New CPA attack on CCM
![Page 39: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/39.jpg)
Creating An Explosive Infection:
![Page 40: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/40.jpg)
A New Type of Attack:
![Page 41: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/41.jpg)
A New Type of Attack:
• A hacker can infect all the smart lights in the whole city, provided that the density of smart lights is above a certain critical mass, which can be calculated with percolation theory techniques
![Page 42: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/42.jpg)
A New Type of Attack:
• A hacker can infect all the smart lights in the whole city, provided that the density of smart lights is above a certain critical mass, which can be calculated with percolation theory techniques
• For a city such as Paris whose area is 105 square km, the critical mass is about 15,000 randomly located smart lights, which is surprisingly low
![Page 43: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/43.jpg)
A New Type of Attack:
• The attacker can start the attack by just plugging in a single infected lightbulb anywhere in the city
![Page 44: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/44.jpg)
A New Type of Attack:
• The attacker can start the attack by just plugging in a single infected lightbulb anywhere in the city
• The attack proceeds entirely via the ZigBee radio frequencies and protocols, which are not currently monitored, so its hard to locate the infection source
![Page 45: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/45.jpg)
A New Type of Attack:
• The attacker can start the attack by just plugging in a single infected lightbulb anywhere in the city
• The attack proceeds entirely via the ZigBee radio frequencies and protocols, which are not currently monitored, so its hard to locate the infection source
• It does not use any TCP/IP packets, and thus cannot be stopped by standard internet security tools
![Page 46: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/46.jpg)
What the Attacker Can Actually Achieve:
![Page 47: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/47.jpg)
What the Attacker Can Actually Achieve:
• Widespread Blackout
![Page 48: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/48.jpg)
What the Attacker Can Actually Achieve:
• Widespread Blackout • The attacker can permanently brick all the smart lights
![Page 49: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/49.jpg)
What the Attacker Can Actually Achieve:
• Widespread Blackout • The attacker can permanently brick all the smart lights• The attack can simultaneously turn all the city’s smart
lights on or off, possibly affecting the electricity grid
![Page 50: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/50.jpg)
What the Attacker Can Actually Achieve:
• Widespread Blackout • The attacker can permanently brick all the smart lights• The attack can simultaneously turn all the city’s smart
lights on or off, possibly affecting the electricity grid• Cause epileptic seizures in photosensitive people
![Page 51: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/51.jpg)
What the Attacker Can Actually Achieve:
• Widespread Blackout • The attacker can permanently brick all the smart lights• The attack can simultaneously turn all the city’s smart
lights on or off, possibly affecting the electricity grid• Cause epileptic seizures in photosensitive people• The attacker can disrupt WiFi communication since
WiFi and ZigBee share the same frequencies
![Page 52: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/52.jpg)
Responsible disclousre
![Page 53: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/53.jpg)
Responsible disclousre
• We contacted Philips and disclosed the vulnerabilities prior to publication
![Page 54: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/54.jpg)
Responsible disclousre
• We contacted Philips and disclosed the vulnerabilities prior to publication• The protocol implantation bug was fixed and an
update was rolled out
![Page 55: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/55.jpg)
Responsible disclousre
• We contacted Philips and disclosed the vulnerabilities prior to publication• The protocol implantation bug was fixed and an
update was rolled out • The software update process remains vulnerable
![Page 56: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/56.jpg)
What went wrong?
![Page 57: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/57.jpg)
What went wrong?
• Without really thinking about it, we are going to populate our homes, offices and neighborhoods with billions of tiny transmitters/receivers
![Page 58: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/58.jpg)
What went wrong?
• Without really thinking about it, we are going to populate our homes, offices and neighborhoods with billions of tiny transmitters/receivers
• These new IoT devices have ad-hoc networking capabilities built in, which has the potential to create a new communication medium, in addition to the traditional mediums of telephony and the internet
![Page 59: IoT Goes Nuclear: Creating a ZigBee Chain Reactioneyalro/pdf/IoTSP17.pdf · Creating a lightbulb worm •A question: Can hackers create a worm which spreads using only the standard](https://reader036.vdocuments.site/reader036/viewer/2022070720/5ee1007bad6a402d666c0aea/html5/thumbnails/59.jpg)
More information and videos
Paper site - iotworm.eyalro.net
Eyal Ronen - eyalro.netColin O’Flynn - colinoflynn.com