Begin forwarded message:

From: RISKS List Owner <risko@csl.sri.com> Subject: [RISKS] Risks Digest 29.91 Date: 14 November 2016 at 07:26:43 GMT+1 To: risks-resend@csl.sri.com

RISKS-LIST: Risks-Forum Digest Sunday 13 November 2016 Volume 29 : Issue 91

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks) Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. ***** This issue is archived at <http://www.risks.org> as <http://catless.ncl.ac.uk/Risks/29.91> The current issue can also be found at <http://www.csl.sri.com/users/risko/risks.txt>

Contents: Why Light Bulbs May Be the Next Hacker Target (John Markoff)

[ … OMISSIS …]

Abridged info on RISKS (comp.risks)

----------------------------------------------------------------------

Date: Sat, 5 Nov 2016 11:33:48 -0500 From: "Alister Wm Macintyre \(Wow\)" <macwheel99@wowway.com> Subject: Why Light Bulbs May Be the Next Hacker Target (John Markoff)

John Markoff, *The New York Times*, 3 Nov 2016

Researchers report in a paper <http://iotworm.eyalro.net/> that they have uncovered a flaw in a wireless technology that is often included in smart home devices like lights, switches, locks, thermostats and many of the components of the much-ballyhooed "smart home" of the future. The researchers focused on the Philips Hue smart light bulb and found that the wireless flaw could allow hackers to take control of the light bulbs, according to researchers at the Weizmann Institute of Science near Tel Aviv and Dalhousie University in Halifax, Canada. <http://www.nytimes.com/topic/company/koninklijke-philips-electronics-nv?inli...>

[I wonder how many other brand names are at similar risk.]

Imagine thousands or even hundreds of thousands of Internet-connected devices in close proximity. Malware created by hackers could be spread like a pathogen among the devices by compromising just one of them. [There is video, in the research paper, showing tests. For example, a drone hovers next to a high rise building, and you see it taking over control of all the lights of the building. Before the test, they had switched one light bulb on ground floor, with one they already could hack.]

The new risk comes from a little-known radio protocol called ZigBee. <http://www.zigbee.org/what-is-zigbee/> <http://www.zigbee.org/what-is-zigbee/> <http://www.zigbee.org/what-is-zigbee/>

The researcher said they had notified Philips of the potential vulnerability and the company had asked the researchers not to go public with the research paper until it had been corrected. Philips fixed the vulnerability in a patch issued on 4 Oct and recommended that customers install it through a smart phone application. Still, it played down the significance of the problem.

[I wonder how many customers learned about this, and implemented the patch.]

http://www.nytimes.com/2016/11/03/technology/why-light-bulbs-may-be-the-next... http://iotworm.eyalro.net/

The full results technical paper can be downloaded from this link: IoT Goes Nuclear: Creating a ZigBee Chain Reaction [PDF, 6.7MB] <http://iotworm.eyalro.net/iotworm.pdf>

Risks identified by the research: * Brick the lights so they cannot be fixed vs. whatever nuisance the malware has inflicted. * City-wide wireless jamming. * Attack electric grid via manipulating power consumption demands. * Induce epileptic seizures in photosensitive people on a large scale.

[Risks thought about by Al Mac:

* Kill street lights, and stairwell lights, after dark, then set off fire alarms, sirens, so people can have a hard time exiting safely. * Airport runway lights go out, when most needed for safe landing.] * You know those highway signs, using letters spelling out key words for warnings to drivers, where each letter is combination of lights on & off? The phrases could be altered. * Do emergency responders use the same radio frequencies that can be jammed by this hack?]

———————————————

[ … OMISSIS …]

----------------------------

Date: Wed, 17 Aug 2016 11:11:11 -0800 From: RISKS-request@csl.sri.com Subject: Abridged info on RISKS (comp.risks)

The ACM RISKS Forum is a MODERATED digest. Its Usenet manifestation is comp.risks, the feed for which is donated by panix.com as of June 2011. => SUBSCRIPTIONS: The mailman Web interface can be used directly to subscribe and unsubscribe: http://mls.csl.sri.com/mailman/listinfo/risks

=> SUBMISSIONS: to risks@CSL.sri.com with meaningful SUBJECT: line that includes the string `notsp'. Otherwise your message may not be read. *** This attention-string has never changed, but might if spammers use it. => SPAM challenge-responses will not be honored. Instead, use an alternative address from which you never send mail where the address becomes public! => The complete INFO file (submissions, default disclaimers, archive sites, copyright policy, etc.) is online. <http://www.CSL.sri.com/risksinfo.html> *** Contributors are assumed to have read the full info file for guidelines!

=> OFFICIAL ARCHIVES: http://www.risks.org takes you to Lindsay Marshall's searchable html archive at newcastle: http://catless.ncl.ac.uk/Risks/VL.IS --> VoLume, ISsue. Also, ftp://ftp.sri.com/risks for the current volume or ftp://ftp.sri.com/VL/risks-VL.IS for previous VoLume Lindsay has also added to the Newcastle catless site a palmtop version of the most recent RISKS issue and a WAP version that works for many but not all telephones: http://catless.ncl.ac.uk/w/r ALTERNATIVE ARCHIVES: http://seclists.org/risks/ (only since mid-2001) <http://the.wiretapped.net/security/info/textfiles/risks-digest/> *** NOTE: If a cited URL fails, we do not try to update them. Try browsing on the keywords in the subject line or cited article leads. ==> Special Offer to Join ACM for readers of the ACM RISKS Forum: <http://www.acm.org/joinacm1>

------------------------------

End of RISKS-FORUM Digest 29.91 ************************

Dott. Diego Latella - Senior Researcher CNR-ISTI, Via Moruzzi 1, 56124 Pisa, Italy (http:www.isti.cnr.it) FM&&T Lab. (http://fmt.isti.cnr.it) http://www.isti.cnr.it/People/D.Latella - ph: +390506212982, mob: +39 348 8283101, fax: +390506212040 =================== The quest for a war-free world has a basic purpose: survival. But if in the process we learn how to achieve it by love rather than by fear, by kindness rather than compulsion; if in the process we learn how to combine the essential with the enjoyable, the expedient with the benevolent, the practical with the beautiful, this will be an extra incentive to embark on this great task. Above all, remember your humanity. -- Sir Joseph Rotblat