Abusing the Internet of Things

FIGURE 4-16. SmartThings app locateing the hue bridge

The values for devicetype and username are the same and seem random enough in
nature. Recall (from “Controlling Lights Using the iOS App” on page 16) that the user will
have to prove physical ownership of the bridge by pressing the button on it within 30 seconds.
When this happens, the hue bridge will accept the value of username, and it can subsequently
be used by the SmartThings Hub to connect to the hue bridge on the local network and issue
commands.
Assuming the user presses the button on the hue bridge, the following response is
returned to the SmartThings Hub:

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

CHAPTER 4: BLURRED LINES—WHEN THE PHYSICAL SPACE MEETS THE VIRTUAL

(^110) SPACE