Abusing the Internet of Things

Lights Out—Hacking Wireless Lightbulbs to Cause Sustained Blackouts The Northeast Blackout of 2003 was widespread and affected p ...

tems are interconnected by communication between utilities and their transmission systems to share the benefits of building larg ...

FIGURE 1-1. The hue starter pack, containing a bridge and three wireless bulbs The bridge connects to the user’s router using an ...

Controlling Lights via the Website Interface A good way to uncover security vulnerabilities is to understand the underlying tech ...

FIGURE 1-3. Associating the bridge with the website The website knows that it has located the bridge because the bridge routinel ...

TIP HTTP/1.0 200 OK WWW-Authenticate : CBAuth Nonce="[DELETED]" Connection : close Content-Type : application/CB-MessageStream; ...

GET /en-US/user/isbuttonpressed HTTP/1.1 Host: http://www.meethue.com User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) ...

The server responds to the GET request with various types of details: HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8; ch ...

,"2":"none","1":"none","7":"none","6":"none","5":"none","4":"none","8":"non e"},"type":"Extended color light"},"10":{"name":"Bed ...

TIP Notice the whitelist elements in the response. The strings associated with this element represent authorized tokens that can ...

(KHTML, like Gecko) Version/6.0.3 Safari/536.28.10 Accept: */* Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: ...

Date: Sun, 05 May 2013 23:04:19 GMT Server: Google Frontend Content-Length: 41 {"code":200,"message":"ok","result":"ok"} The ok ...

address is '+ obj.macaddress + '</H3><BR>'); }; xhr.send(); } find_hue(); </SCRIPT> </HTML> Assume the H ...

xhr.open('PUT', 'http://'+obj.internalipaddress+'/api/[whitelist DELETED]/groups/ 0/action', true); and then sending the body of ...

FIGURE 1-7. A password requirement of at least six characters FIGURE 1-8. Accounts are locked for one minute after two failed lo ...

This scenario is high risk, because all the attacker needs to do is go through usernames (when they are in the form of email add ...

button on the bridge. At this point, the iOS app instructs the user to do so, as shown in Figure 1-9. FIGURE 1-9. iOS app instru ...

Assuming that the user does press the button on the bridge, the bridge sends the follow- ing response to the iOS app: HTTP/1.1 2 ...

FIGURE 1-10. User tapping “ALL OFF” button in iOS app And the bridge responds: HTTP/1.1 200 OK Cache-Control: no-store, no-cache ...

[{"success":{"/groups/0/action/on":false}}] The success attribute with the false value indicates that the command executed succe ...