Using Drone, Researchers Demonstrate IoT Worm For Smart Lightbulbs

Researchers from the Weizmann Institute and Dalhousie University developed a proof-of-concept worm that spreads between Philips Hue smart lightbulbs by bypassing ZigBee Light Link (Touchlink) protections and extracting the vendor's global firmware encryption key via a side-channel; they demonstrated remote over-the-air malicious firmware flashing from a drone up to ~400 meters, forcing affected bulbs to disconnect and respond to attacker commands. While the technique could scale to large geographic areas given sufficient device density, the work is presented as a research demonstration with no reported active exploitation.