Don't Be Silly It's Only a Lightbulb: Hacking Smart Lighting
Eyal Itkin exploits Zigbee radio firmware in Philips Hue smart lightbulbs to trigger a bridge buffer overflow, pivoting from smart lights into internal corporate networks.
Summary
Smart Lightbulbs as Network Infiltration Vectors
While smart lightbulbs are often dismissed as harmless IoT gadgets, their integration into home and corporate Wi-Fi bridges makes them prime initial access targets.
Reverse Engineering the Zigbee Light Link Protocol
Eyal Itkin analyzes the wireless Zigbee protocol stack on Philips Hue hardware, evaluating how lighting bridges discover and control peripheral bulbs.
Triggering a Heap Overflow in the Hue Bridge
By manipulating Zigbee radio packets emitted from a compromised bulb, an attacker triggers a heap buffer overflow in the central Hue Bridge daemon, executing arbitrary code.
Pivoting from Lighting Silicon to Enterprise LANs
Demonstrating a complete lateral movement chain shows how an attacker parked outside a building can compromise a smart bulb and pivot onto internal corporate networks.
Related talks
Main Stage·31 min
Eyal Itkin
Eyal Itkin answers audience questions regarding Zigbee radio packet injection, Philips Hue bridge vulnerabilities, and IoT network isolation.
Village Presentations·22 min
Craig Young
Tripwire VERT researcher Craig Young exposes zero-day vulnerabilities across consumer smart home automation hubs, door locks, and wireless power outlets.
Main Stage·40 min
Reynaldo · nyx
Reverse engineers commercial vape and sound monitoring sensors installed in school restrooms, uncovering unauthenticated telemetry feeds and cloud vulnerabilities.