Security Flaw in Philips Lighting System Lets Hackers Keep You in the Dark

A misfortunate implementation of the security token in the Hue intelligent lighting system from Phillips could allow an attacker to control the lights in your home and turn them on or off as they wish.

According to a paper by security researcher Nitesh Dhanjani, the problem arises from the fact that mobile devices or PCs used to control the lighting system are authorized with a token (a unique identifier) derived from the device`s MAC address.

“The secret whitelist token was not random but the MD5 hash of the MAC address of the desktop or laptop or the iPhone or iPad. This leaves open a vulnerability whereby malware on the internal network can capture the MAC address active on the wire (using the ARP cache of the infected machine),” wrote Dhanjani in his research paper.

Of course, to control the lights inside the house, the attacker needs access to the Wi-Fi router on the premises and to know the MAC address of the device used to control the Hue system. However, if all these prerequisites are met, the attacker gets full and almost irrevocable access to the Hue bridge ” the device that bridges the Internet with the bulbs.

“It is important that Philips and other consumer IoT organizations take issues like these seriously. In the age of malware and powerful botnets, it is vital that people`s homes be secure from vulnerabilities like these that can cause physical consequences,” the researcher concluded.