Deral Heiland, Research Lead at Rapid7, is disclosing a vulnerability that reveals how popular home lighting system, Osram Lightify leaves users vulnerable to attack. A link to the blog post with additional details can be found here.
Specifically, a malicious actor can:
- Execute commands to change lighting, and also execute commands to reconfigure the devices
- Inject code which could modify the system configuration, exfiltrate or alter stored data, or take control of the product in order to launch browser-based attacks against the authenticated user’s workstation. Deral commented below.
Deral Heiland, Research Lead at Rapid7:
“As consumer based IoT solutions find their way into our enterprise networks, we must continue to be diligent. Simple IoT technology solutions, such as lighting automation, can easily be overlooked as a risk. But as shown in my recent IoT research project even enterprise IoT lighting solution can suffer from a number of vulnerabilities. If these issues go unchecked they can lead to increased risk for any organisations that deploy them such as unauthorised access to a corporate and home network when technology is compromised, and the extraction of data that can further compromise IoT systems, internal networks and authenticated user host systems attached to the IoT solutions.
That does not mean we should avoid leveraging these new automation technologies, but does show that we need to build better policy around managing the risk and develop processes on how to deploy these technologies in a manner that does not add any unnecessary risk.”
Most Commented Posts
2020 Cybersecurity Landscape: 100+ Experts’ Predictions
Cyber Security Predictions 2021: Experts’ Responses
Experts’ Responses: Cyber Security Predictions 2023
Celebrating Data Privacy Day – 28th January 2023
Data Privacy Protection Day (Thursday 28th) – Experts Comments
Most Active Commenters
Meta’s fine over data privacy breaches underscores the critical challenges…
Hi, Thanks, that is really useful information. I do have…
“This is a very worrying attack that hit T-Mobile and…
“This latest cyberattack against T-Mobile may be smaller than previous…
“Genesis Market is a complex global criminal access marketplace. Buyers…