Skip to main content
SpringerLink
Log in

Assessing Vulnerabilities and IoT-Enabled Attacks on Smart Lighting Systems

  • Conference paper
  • First Online:
Computer Security. ESORICS 2021 International Workshops (ESORICS 2021)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 13106))

Included in the following conference series:

Abstract

The rapid evolution of the Internet-of-Things (IoT) introduces innovative services that span across various application domains. As a result, smart automation systems primarily designed for non-critical environments may also be installed in premises of critical sectors, without proper risk assessment. In this paper we focus on IoT-enabled attacks, that utilize components of the smart lighting ecosystem in popular installation domains. In particular, we present a holistic security evaluation on a popular smart lighting device (The specific model is not referred in this paper, since we are currently in the process of a responsible disclosure procedure with the vendor.), that is focused on vulnerabilities and misconfigurations found on hardware, embedded software, cloud services and mobile applications. In addition, we construct a Common Vulnerability Scoring System (CVSS) like vector for each attack scenario, in order to define the required capabilities and potential impact of these attack scenarios and examine their potential exploitability and impact.

This research has been co-financed by the European Union and Greek national funds through the Operational Program Competitiveness, Entrepreneurship and Innovation, under the call RESEARCH - CREATE - INNOVATE (project code: T1EDK-01958).

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 59.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 79.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    https://www.enisa.europa.eu/topics/iot-and-smart-infrastructures/iot/good-practices-for-iot-and-smart-infrastructures-tool/.

  2. 2.

    https://www.congress.gov/bill/115th-congress/senate-bill/1691.

  3. 3.

    https://flashrom.org/Flashrom.

  4. 4.

    https://github.com/ReFirmLabs/binwalk.

  5. 5.

    https://github.com/skylot/jadx.

  6. 6.

    https://downloads.openwrt.org/releases/.

  7. 7.

    https://owasp.org/www-pdf-archive/OWASP__TLS_Renegotiation-_Vulnerability.pdf.

  8. 8.

    https://jwt.io/.

  9. 9.

    https://osmocom.org/.

  10. 10.

    https://github.com/bastibl/gr-foo.

  11. 11.

    https://rftap.github.io/.

  12. 12.

    https://research.checkpoint.com/2020/dont-be-silly-its-only-a-lightbulb/.

  13. 13.

    https://www.checkpoint.com/defense/advisories/public/2020/cpai-2019-1605.html/.

  14. 14.

    https://nvd.nist.gov/vuln/detail/CVE-2020-12695.

  15. 15.

    https://www.shodan.io/.

  16. 16.

    https://www.exploit-db.com/exploits/47073.

  17. 17.

    https://www.bbc.com/news/technology-12110892.

References

  1. Apthorpe, N., Reisman, D., Feamster, N.: A smart home is no castle: Privacy vulnerabilities of encrypted iot traffic. arXiv preprint arXiv:1705.06805 (2017)

  2. Bakhshi, Z., Balador, A., Mustafa, J.: Industrial IoT security threats and concerns by considering cisco and microsoft IoT reference models. In: 2018 IEEE Wireless Communications and Networking Conference Workshops (WCNCW), pp. 173–178. IEEE (2018)

    Google Scholar 

  3. Herzberg, B., Igal Zeifman, D.B.: Breaking down Mirai: an IoT DDoS botnet analysis. https://www.imperva.com/blog/malware-analysis-mirai-ddos-botnet/

  4. Cerrudo, C.: An emerging us (and world) threat: cities wide open to cyber attacks. Secur. Smart Cities 17, 137–151 (2015)

    Google Scholar 

  5. Colin, O.: A lightbulb worm? Details of the Philips Hue smart lighting design (Black Hat USA 2016 White Paper) (2016)

    Google Scholar 

  6. Costin, A.: Security of CCTV and video surveillance systems: threats. vulnerabilities, attacks, and mitigations. In: TrustED, vol. 16, pp. 45–54

    Google Scholar 

  7. Dhanjani, N.: Hacking lightbulbs: security evaluation of the Philips hue personal wireless lighting system. In: Internet of Things Security Evaluation Series (2013)

    Google Scholar 

  8. Do, Q., Martini, B., Choo, K.K.R.: Cyber-physical systems information gathering: a smart home case study. Comput. Netw. 138, 1–12 (2018)

    Article  Google Scholar 

  9. Dubrova, E.: Anti-tamper Techniques. KTH Royal Institute of Technology, Sweden (2018)

    Google Scholar 

  10. ENISA: Baseline security recommendations for IoT in the context of critical information infrastructures, November 2017

    Google Scholar 

  11. Fagan, M., Fagan, M., Megas, K.N., Scarfone, K., Smith, M.: Foundational cybersecurity activities for IoT device manufacturers. US Department of Commerce, National Institute of Standards and Technology (2020)

    Google Scholar 

  12. Fagan, M., Fagan, M., Megas, K.N., Scarfone, K., Smith, M.: IoT Device Cybersecurity Capability Core Baseline. US Department of Commerce, National Institute of Standards and Technology (2020)

    Google Scholar 

  13. Fagan, M., Marron, J., Brady, K., Cuthill, B., Megas, K., Herold, R.: IoT device cybersecurity guidance for the federal government: Establishing IoT device cybersecurity requirements. Technical report, National Institute of Standards and Technology (2020)

    Google Scholar 

  14. Fakhri, D., Mutijarsa, K.: Secure IoT communication using blockchain technology. In: 2018 International Symposium on Electronics and Smart Devices (ISESD), pp. 1–6. IEEE (2018)

    Google Scholar 

  15. Ferrigno, J., Hlaváč, M.: When AES blinks: introducing optical side channel. IET Inf. Secur. 2(3), 94–98 (2008)

    Article  Google Scholar 

  16. Goodin, D.: Hackers trigger yet another power outage in Ukraine (2017). https://arstechnica.com/security/2017/01/the-new-normal-yet-another-hacker-caused-power-outage-hits-ukraine/

  17. Guri, M., Bykhovsky, D.: aIR-jumper: covert air-gap exfiltration/infiltration via security cameras & infrared (IR). Comput. Secur. 82, 15–29 (2019)

    Article  Google Scholar 

  18. Guri, M., Hasson, O., Kedma, G., Elovici, Y.: An optical covert-channel to leak data through an air-gap. In: 2016 14th Annual Conference on Privacy, Security and Trust (PST), pp. 642–649. IEEE (2016)

    Google Scholar 

  19. Kayas, G., Hossain, M., Payton, J., Islam, S.R.: An overview of UPnP-based IoT security: threats, vulnerabilities, and prospective solutions. In: 2020 11th IEEE Annual Information Technology, Electronics and Mobile Communication Conference (IEMCON), pp. 0452–0460. IEEE (2020)

    Google Scholar 

  20. Lee, R.M., Assante, M.J., Conway, T.: Analysis of the cyber attack on the Ukrainian power grid. SANS Industrial Control Systems (2016)

    Google Scholar 

  21. Liu, H., Spink, T., Patras, P.: Uncovering security vulnerabilities in the Belkin Wemo home automation ecosystem. In: 2019 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops), pp. 894–899. IEEE (2019)

    Google Scholar 

  22. Maiti, A., Jadliwala, M.: Light ears: information leakage via smart lights. Proc. ACM Interact. Mob. Wearable Ubiquit. Technol. 3(3), 1–27 (2019)

    Article  Google Scholar 

  23. Maiti, A., Jadliwala, M.: Smart light-based information leakage attacks. GetMobile Mob. Comput. Commun. 24(1), 28–32 (2020)

    Article  Google Scholar 

  24. Mi, X., Qian, F., Zhang, Y., Wang, X.: An empirical characterization of IFTTT: ecosystem, usage, and performance. In: Proceedings of the 2017 Internet Measurement Conference, pp. 398–404 (2017)

    Google Scholar 

  25. Morgner, P., Mattejat, S., Benenson, Z.: All your bulbs are belong to us: Investigating the current state of security in connected lighting systems. arXiv preprint arXiv:1608.03732 (2016)

  26. Notra, S., Siddiqi, M., Gharakheili, H.H., Sivaraman, V., Boreli, R.: An experimental study of security and privacy risks with emerging household appliances. In: 2014 IEEE Conference On Communications and Network Security, pp. 79–84. IEEE (2014)

    Google Scholar 

  27. Rathee, G., Balasaraswathi, M., Chandran, K.P., Gupta, S.D., Boopathi, C.: A secure IoT sensors communication in industry 4.0 using blockchain technology. J. Ambient Intell. Humaniz. Comput. 12(1), 533–545 (2021)

    Article  Google Scholar 

  28. Ronen, E., O’Flynn, C., Shamir, A., Weingarten, A.O.: IoT goes nuclear: Creating a ZigBee chain reaction. IACR Cryptology ePrint Archive 2016, 1047 (2016)

    Google Scholar 

  29. Ronen, E., Shamir, A.: Extended functionality attacks on IoT devices: the case of smart lights. In: 2016 IEEE European Symposium on Security and Privacy (EuroS&P), pp. 3–12. IEEE (2016)

    Google Scholar 

  30. Samaila, M.G., Sequeiros, J.B., Simões, T., Freire, M.M., Inácio, P.R.: IoT-HarPSecA: a framework and roadmap for secure design and development of devices and applications in the IoT space. IEEE Access 8, 16462–16494 (2020)

    Article  Google Scholar 

  31. Schwittmann, L., Boelmann, C., Matkovic, V., Wander, M., Weis, T.: Identifying tv channels and on-demand videos using ambient light sensors. Pervasive Mob. Comput. 38, 363–380 (2017)

    Article  Google Scholar 

  32. Schwittmann, L., Matkovic, V., Weis, T., et al.: Video recognition using ambient light sensors. In: 2016 IEEE International Conference on Pervasive Computing and Communications (PerCom), pp. 1–9. IEEE (2016)

    Google Scholar 

  33. Shah, T., Venkatesan, S.: A method to secure IoT devices against botnet attacks. In: Issarny, V., Palanisamy, B., Zhang, L.-J. (eds.) ICIOT 2019. LNCS, vol. 11519, pp. 28–42. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-23357-0_3

    Chapter  Google Scholar 

  34. Sikder, A.K., Babun, L., Aksu, H., Uluagac, A.S.: Aegis: a context-aware security framework for smart home systems. In: Proceedings of the 35th Annual Computer Security Applications Conference, pp. 28–41 (2019)

    Google Scholar 

  35. Stellios, I., Kotzanikolaou, P., Grigoriadis, C.: Assessing IoT enabled cyber-physical attack paths against critical systems. Comput. Secur. 107, 102316 (2021)

    Article  Google Scholar 

  36. Stellios, I., Kotzanikolaou, P., Psarakis, M., Alcaraz, C., Lopez, J.: A survey of IoT-enabled cyberattacks: assessing attack paths to critical infrastructures and services. IEEE Commun. Surv. Tutor. 20(4), 3453–3495 (2018)

    Article  Google Scholar 

  37. Tanen, J.: Breaking bhad: Getting local root on the Belkin Wemo switch (2016)

    Google Scholar 

  38. Tsiknas, K., Taketzis, D., Demertzis, K., Skianis, C.: Cyber threats to industrial IoT: a survey on attacks and countermeasures. IoT 2(1), 163–188 (2021)

    Article  Google Scholar 

  39. Xiao, L., Wan, X., Lu, X., Zhang, Y., Wu, D.: IoT security techniques based on machine learning: how do IoT devices use AI to enhance security? IEEE Signal Process. Mag. 35(5), 41–49 (2018)

    Article  Google Scholar 

  40. Xu, Y., Frahm, J.M., Monrose, F.: Watching the watchers: automatically inferring tv content from outdoor light effusions. In: Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, pp. 418–428 (2014)

    Google Scholar 

  41. Zandberg, K., Schleiser, K., Acosta, F., Tschofenig, H., Baccelli, E.: Secure firmware updates for constrained IoT devices using open standards: a reality check. IEEE Access 7, 71907–71920 (2019)

    Article  Google Scholar 

  42. Zhou, Z., Zhang, W., Yu, N.: IREXF: data exfiltration from air-gapped networks by infrared remote control signals. arXiv preprint arXiv:1801.03218 (2018)

Download references

Author information

Authors and Affiliations

  1. SecLab, Department of Informatics, University of Piraeus, 85 Karaoli & Dimitriou, 18534, Piraeus, Greece

    Ioannis Stellios, Kostas Mokos & Panayiotis Kotzanikolaou

Authors
  1. Ioannis Stellios
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Kostas Mokos
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Panayiotis Kotzanikolaou
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Ioannis Stellios .

Editor information

Editors and Affiliations

  1. Norwegian University of Science and Technology, Gjøvik, Norway

    Sokratis Katsikas

  2. University of Piraeus, Piraeus, Greece

    Costas Lambrinoudakis

  3. Polytechnique Montréal, Montréal, QC, Canada

    Nora Cuppens

  4. University of Toronto, Toronto, ON, Canada

    John Mylopoulos

  5. University of the Aegean, Mytilene, Greece

    Christos Kalloniatis

  6. Technical University of Denmark, Kongens Lyngby, Denmark

    Weizhi Meng

  7. University of Nottingham, Nottingham, UK

    Steven Furnell

  8. Technische Universität Berlin, Berlin, Germany

    Frank Pallas

  9. Alexander von Humboldt Institut für Internet und Gesellschaft gGmbH, Berlin, Germany

    Jörg Pohle

  10. Ruhr-Universität Bochum, Bochum, Germany

    M. Angela Sasse

  11. Norwegian Computing Center, Oslo, Norway

    Habtamu Abie

  12. University of Trento and Fondazione Bruno Kessler, Trento, Italy

    Silvio Ranise

  13. Università degli Studi di Genova, Genoa, Italy

    Luca Verderame

  14. Consiglio Nazionale delle Ricerche (CNR), Genoa, Italy

    Enrico Cambiaso

  15. Indra, Alcobendas, Spain

    Jorge Maestre Vidal

  16. Indra, Alcobendas, Spain

    Marco Antonio Sotelo Monge

Rights and permissions

Reprints and permissions

Copyright information

© 2022 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Stellios, I., Mokos, K., Kotzanikolaou, P. (2022). Assessing Vulnerabilities and IoT-Enabled Attacks on Smart Lighting Systems. In: Katsikas, S., et al. Computer Security. ESORICS 2021 International Workshops. ESORICS 2021. Lecture Notes in Computer Science(), vol 13106. Springer, Cham. https://doi.org/10.1007/978-3-030-95484-0_13

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-95484-0_13

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-95483-3

  • Online ISBN: 978-3-030-95484-0

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation