• by Chase Martin , November 7, 2016

IoT security remains an issue, with new attacks and vulnerabilities uncovered.

In addition to recent IoT-device driven cyberattacks in Liberia, smart lights from Philips Lighting were recently hacked by drone.

Researchers from the Weizmann Institute of Science and Dalhousie University successfully hacked Philips Hue smart light bulbs remotely by flying a drone near the building in which the lights were housed. The team also did so without needing to connect their drone-mounted hacking device to the network that the lights were connected to.

Along with loading malware onto the connected light bulbs remotely, the researchers found a vulnerability that could enable that malware to spread from one bulb to the next wirelessly, based on physical proximity and without the need to be connected to the same network.

The researchers caution that a cybercriminal could gain control over an entire city's worth of connected lights by simply plugging in one light bulb that is physically close enough to communicate with another lightbulb, which is close enough to communicate with another light bulb, and so on.

For this to work effectively, a certain critical mass of installed connected light bulbs would need to be in place, which the researchers estimate is already the case in some cities.

The findings of the study have since been communicated to Philips Lighting and an update has been developed to mitigate some of these risks. However, the largest security issues remain in the connectivity standards, not the manufacturer-specific designs, according to the researchers.

Smart lights aren’t the only IoT devices with potential security flaws, however.

After recent cyberattacks that took control of more than a million IoT devices and turned them to attack major servers in the U.S., the same hacker appears to be testing similar attacks on the country of Liberia.

The new attacks used the same large-scale ‘botnet’ of compromised IoT devices, such as network-connected cameras and DVRs, to attack the two major telecommunications companies that provide internet in Liberia and other African nations, according to a report by cybersecurity professional Kevin Beaumont.

Throughout the course of a few days, the attacker targeted and disrupted the internet in Liberia for short periods of time.

BuzzFeed News reports that the attack did not fully stop the internet connectivity across the entire country of Liberia, citing that Dyn (the target of the U.S. attack) has monitored internet traffic in Liberia and did not see any sustained interruptions.

Unlike the attacks in the U.S., the nature of these attacks appear to be to test the capabilities of this type of IoT-driven cyberattack, according to Beaumont.

“The attacks are extremely worrying because they suggest a Mirai operator who has enough capacity to seriously impact systems in a nation state,” Beaumont reported.