Hacking Your Fridge – Internet of Things Security


So one of the latest fads is IoT or the Internet of things phenomena which has been talked about for a while (especially since the discussion of IPv6 started), IoT is connecting physical items to the Internet and giving them some kind of IP (be in NAT or a proper IPv6 address).

This enabled you to control your lights (on/off & dimming) via your phone, or anything else that can be connected (turn on your kettle, check your fridge temperature, warm up your oven etc).

The possibilities are basically endless.

Internet of Things Security

The issues IoT brings is of course a whole new set of security concerns, if everything is Internet connected, it’s also prone to get hacked, spammed, DDoSed and generally fscked up.

Imagine if your house alarm is Internet savvy and someone DDoSed the control box, so you can’t get into your own house, unless you pay some kind of ransom. These things are going to happen.

Those convinced that the emerging Internet of Things (IoT) will become a hackers’ playground were given more grist for their mill with news on Friday that security researchers have discovered a weakness in Wi-Fi/mesh networked lightbulbs.

Researchers at Context Information Security discovered that LED light bulbs from manufacturer LIFX – which are designed to be controlled from a smartphone – have security weaknesses. By gaining access to the master bulb, Context was able to control all connected lightbulbs and expose user network configurations.

Context worked with LIFX to develop a patch for the security bug before releasing a fix in the form of a firmware update. Simon Walker from LIFX stated: “Prior to the patch, no one other than Context had exposed this vulnerability, most likely due to the complexity of the equipment and reverse engineering required.”


Thankfully IoT is a fairly new thing so not many malicious hackers are looking into it, plus for now – there’s no real monetary value when it comes to hacking into a lightbulb. Rather annoying yes? Business critical? No.

That is of course, until the point where your Lightbulb is part of your corporate LAN and hacking the lightbulb gives you access to the internal network..then it becomes a whole different story.

Context’s find is part of its ongoing research into the security of the Internet of Things (IoT) – which includes parking meters, internet-enabled fridges and much more besides. Many of these components are being put together with little thought for basic security precautions, according to Context.

“It is clear that in the dash to get onto the IoT bandwagon, security is not being prioritised as highly as it should be in many connected devices,” said Michael Jordon, research director at Context. “We have also found vulnerabilities in other internet connected devices from home storage systems and printers to baby monitors and children’s toys.”

So yah, as IoT becomes more of a ‘thing’ and adoption goes up, Internet of Things Security is going to become a major issue and it could well become the next hackers playground.

Fortunately this case is more of a research/knowledge share than actually something exposing risk or a published zero-day exploit against an IoT device. I would imagine in the coming year or so we’ll see a lot more similar incidents.

Source: The Register

Posted in: Exploits/Vulnerabilities, Hardware Hacking

, ,


Latest Posts:


tko-subs - Detect & Takeover Subdomains With Dead DNS Records tko-subs – Detect & Takeover Subdomains With Dead DNS Records
tko-subs is a tool that helps you to detect & takeover subdomains with dead DNS records, this could be dangling CNAMEs point to hosting services and more.
Arcane - Tool To Backdoor iOS Packages (iPhone ARM) Arcane – Tool To Backdoor iOS Packages (iPhone ARM)
Arcane is a simple script tool to backdoor iOS packages (iPhone ARM) and create the necessary resources for APT repositories.
SharpHose - Asynchronous Password Spraying Tool SharpHose – Asynchronous Password Spraying Tool
SharpHose is an asynchronous password spraying tool in C# for Windows environments that takes into consideration fine-grained password policies and can be run over Cobalt Strike's execute-assembly.
Axiom - Pen-Testing Server For Collecting Bug Bounties Axiom – Pen-Testing Server For Collecting Bug Bounties
Project Axiom is a set of utilities for managing a small dynamic infrastructure setup for bug bounty, basically a pen-testing server out of the box with 1-line.
Quasar RAT - Windows Remote Administration Tool Quasar RAT – Windows Remote Administration Tool
Quasar is a fast and light-weight Windows remote administration tool coded in C#. Used for user support through day-to-day administrative work to monitoring.
Pingcastle - Active Directory Security Assessment Tool Pingcastle – Active Directory Security Assessment Tool
PingCastle is a Active Directory Security Assessment Tool designed to quickly assess the Active Directory security level based on a risk and maturity framework.


Comments are closed.