LED Light Lunacy: Hacking Connected Smart Lights

Victor Hanna (glyph) details an entertaining and technically illuminating security research journey into cloud-connected IoT devices, demonstrating how a lockdown project investigating smart LED strip lights exposed systemic authorization flaws across millions of connected lights worldwide.

[06:40] Hanna analyzes the architecture of inexpensive Wi-Fi LED controllers (such as Magic Home / Flux LED devices), examining the communications between local microcontrollers, mobile companion apps, and central cloud infrastructure. He walks through reverse engineering the Android application, analyzing local UDP broadcast discovery packets, and proxying HTTP/REST API traffic through Burp Suite.

[13:48] The presentation reveals severe cloud-side security vulnerabilities, specifically broken object-level authorization (BOLA) and insecure direct object references (IDOR). By inspecting authentication tokens and account identifiers, Hanna discovered that the cloud API failed to validate device ownership. He demonstrates forging API requests [21:14] to enumerate device IDs globally, allowing him to query device statuses, leak user registration details, and remotely turn off or manipulate the lighting colors of smart bulbs and LED strips across the world. The talk concludes with disclosure challenges and guidance on securing IoT APIs.

(AI summary — Gemini Flash)