Smart Bulbs Can Be Hacked to Hack into Your Household

Davide Bonaventura, Sergio Esposito, Giampaolo Bella

2023

Abstract

The IoT is getting more and more pervasive. Even the simplest devices, such as a light bulb or an electrical plug, are made “smart” and controllable by our smartphone. This paper describes the findings obtained by applying the PETIoT kill chain to conduct a Vulnerability Assessment and Penetration Testing session on a smart bulb, the Tapo L530E by Tp-Link, currently best seller on Amazon Italy. We found that four vulnerabilities affect the bulb, two of High severity and two of Medium severity according to the CVSS v3.1 scoring system. In short, authentication is not well accounted for and confidentiality is insufficiently achieved by the implemented cryptographic measures. In consequence, an attacker who is nearby the bulb can operate at will not just the bulb but all devices of the Tapo family that the user may have on her Tapo account. Moreover, the attacker can learn the victim’s Wi-Fi password, thereby escalating his malicious potential considerably. The paper terminates with an outline of possible fixes.

Paper Citation

in Harvard Style

Bonaventura D., Esposito S. and Bella G. (2023). Smart Bulbs Can Be Hacked to Hack into Your Household. In Proceedings of the 20th International Conference on Security and Cryptography - Volume 1: SECRYPT; ISBN 978-989-758-666-8, SciTePress, pages 218-229. DOI: 10.5220/0012092900003555

in Bibtex Style

@conference{secrypt23,
author={Davide Bonaventura and Sergio Esposito and Giampaolo Bella},
title={Smart Bulbs Can Be Hacked to Hack into Your Household},
booktitle={Proceedings of the 20th International Conference on Security and Cryptography - Volume 1: SECRYPT},
year={2023},
pages={218-229},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0012092900003555},
isbn={978-989-758-666-8},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 20th International Conference on Security and Cryptography - Volume 1: SECRYPT
TI - Smart Bulbs Can Be Hacked to Hack into Your Household
SN - 978-989-758-666-8
AU - Bonaventura D.
AU - Esposito S.
AU - Bella G.
PY - 2023
SP - 218
EP - 229
DO - 10.5220/0012092900003555
PB - SciTePress