Disclaimer: some of the content is conjecture
A summary of the experiment is described in the introduction (page 2). The claim is in bold:
Our initial discovery was that the Atmel stack has a major bug in its proximity test, which enables any standard ZigBee transmitter (which can be bought for a few dollars in the form of an tiny evaluation board) to initiate a factory reset procedure which will dissociate lamps from their current controllers, up to a range of 400 meters. Once this is achieved, the transmitter can issue additional instructions which will take full control of all those lamps. We demonstrated this with a real war-driving experiment in which we drove around our university campus and took full control of all the Hue smart lamps installed in buildings along the car’s path. Due to the small size, low weight, and minimal power consumption of the required equipment, and the fact that the attack can be automated, we managed to tie a fully autonomous attack kit below a standard drone,
and performed war-flying in which we flew hundreds of meters away from office buildings, forcing all the Hue lamps installed in them to disconnect from their current controllers and to blink SOS in morse code.
The researchers provide empirical evidence of this in their demonstration that a signal can be sent from a transmitter to a vulnerable device from a distance of up to 400 meters away. The researchers sent signals from transmitters 50, 150, and 350 meters away in their wardriving and warflying tests.(See sections 8.1.1 "Wardriving" and 8.1.2 "Warflying"). The maximum theoretical effective range of 400 meters is derived from the outdoor Zigbee wireless range:
Our novel takeover attack uses a bug in Atmel’s implementationof the ZLL Touchlink protocol state machine (used in Philips Hue lamps) to take over lamps from large distances (up to ZigBee wireless range that can be as far as 70 meters indoors or 400 meters outdoors [14]), using only
standard Philips Hue lamps.
This is quite different from the rather more sensational claim that it is theoretically feasible to seize control of all such Philips lamps by infecting an exploitable lamp with a program that self-propagates directly from lamp to lamp via Zigbee (the claim is in bold):
Our new attack differs from previous attacks on IoT systems in several crucial ways. First of all, previous attacks used TCP/IP packets to scan the internet for vulnerable IoT devices and to force them to participate in internet-based activities such as a massive DDOS attack. Since internet
communication is heavily monitored and can be protected by a large variety of security tools, such attacks can be discovered and stopped at an early stage, at least in principle. Our attack does not use any internet communication at all, and the infections jump directly from lamp to lamp using only unmonitored and unprotected ZigBee communication. Consequently, it will be very difficult to detect that an attack is taking place and to locate its source after the whole lighting system is disabled.
Another major difference is that our attack spreads via physical proximity alone, disregarding the established networking structures of lamps and controllers. As a result, such an attack cannot be stopped by isolating various subnetworks from each other, as system administrators often do when they are under attack. In this sense the attack is similar to air-borne biological infections such as influenza, which spread almost exclusively via physical proximity.
Finally, previously reported attacks are carried out via linear scans and infections which are all carried out in a star-shaped structure with a centrally located attacker, whereas our chain reaction attack spreads much faster by making each infected lamp the new source of infection for all its adjacent lamps; the attacker only has to initiate the infecting with a single bad lamp, and can then retire and watch the whole city going dark automatically.
The researchers support this claim using a mathematical model in which the effective range of the lamps is assumed to be 50 meters:
Consider a city whose area is A, and assume that its shape is roughly circular (i.e., it is flat, convex, not too elongated, and without holes). We place N smart lamps at random locations within the city, and define an infection graph by connecting any two lamps whose distance is smaller than D by an edge. The connected components in this graph define the possible infection patterns which can be started by plugging in a single infected light. For a small N all the components are likely to consist of just
a few vertices, but as N increases, the graph goes through a sudden phase change in which a single giant connected component (that contains most of the vertices) is created. This is the critical mass at which the infection is likely to spread everywhere in the city instead of remaining isolated
in a small neighborhood.
The mathematical field dealing with such problems is called Percolation Theory, and the critical N is called the Percolation Threshold. A good survey of many variants of this problem can be found in [15], and the particular version we are interested in appears in the section on thresholds for 2D continuum models, which deals with long range
connectivity via overlapping two dimensional disks of radius R, as described in Fig 1. Since two points are within a distance D from each other if and only if the two disks of radius R = D/2 around them intersect, we can directly use that model to find the critical mass in our model: It is the value N for which the total area of all the randomly placed disks (i.e., πR2N) is about 1.128 times larger than the total
area A of the city. In other words, N = 1.128A/π(D/2)2.
To get a feeling for how large this N can be, consider a typical city like Paris, which is fairly flat, circular in shape, and with few skyscrapers that can block the available lines of sight. Its total area is about 105 square kilometers [16]. According to the official ZigBee Light Link website [14],the range of ZigBee communication is between 70 meters
indoors and 400 meters outdoors1. There is probably no single number that works in all situations, but to estimate N it is reasonable to assume that one lamp can infect other lamps if they are within a distance of D = 100 meters, and thus the disks we draw around each lamp has a radius of R = 50 meters. By plugging in these values into the formula, we get that the critical mass of installed lamps in the whole city of Paris is only about N = 15, 000. Since the Philips Hue smart lamps are very popular in Europe and especially in affluent areas such as Paris, there is a very good chance that this threshold had in fact been exceeded, and thus the city is already vulnerable to massive infections via the ZigBee chain reaction described in this paper.
- The Philips engineers we talk with stated that in a dense urban
environment, the effective range can be less than 30 meters
Argument
The researchers claim that the exploit vector and propagation technique employed in their experiment makes it possible to infect all vulnerable devices in an urban environment can be framed as an argument, which goes something like this:
the Atmel stack has a major bug in its proximity test, which enables any standard ZigBee transmitter (which can be bought for a few dollars in the form of an tiny evaluation board) to initiate a factory reset procedure which will dissociate lamps from their current controllers, up to a range of 400 meters. Once this is achieved, the transmitter can issue additional instructions which will take full control of all those lamps.
and
Our novel takeover attack uses a bug in Atmel’s implementationof the ZLL Touchlink protocol state machine (used in Philips Hue lamps) to take over lamps from large distances (up to ZigBee wireless range that can be as far as 70 meters indoors or 400 meters outdoors [14]), using only standard Philips Hue lamps.
Premise 1: Philips Hue lamps have a vulnerability that allows them to be exploited over ZigBee.
Our attack does not use any internet communication at all, and the infections jump directly from lamp to lamp using only unmonitored and unprotected ZigBee communication.
and
According to the official ZigBee Light Link website [14],
the range of ZigBee communication is between 70 meters
indoors and 400 meters outdoors1
and
There is probably no single number that works in all situations, but to estimate N it is reasonable to assume that one lamp can infect other lamps if they are within a distance of D = 100 meters, and thus the disks we draw around each lamp has a radius of R = 50 meters.
Premise 2: In an urban environment, Philips Hue lamps have an effective range of 50 meters on average.
Consider a city whose area is A, and assume that its shape is roughly circular (i.e., it is flat, convex, not too elongated, and without holes). We place N smart lamps at random locations within the city, and define an infection graph by connecting any two lamps whose distance is smaller than D by an edge. The connected components in this graph define the possible infection patterns which can be started by plugging in a single infected light. For a small N all the components are likely to consist of just a few vertices, but as N increases, the graph goes through a sudden phase change in which a single giant connected component (that contains most of the vertices) is created. This is the critical mass at which the infection is likely to spread everywhere in the city instead of remaining isolated in a small neighborhood.
and
the critical N is called the Percolation Threshold
and
Since two points are within a distance D from each other if and only if the two disks of radius R = D/2 around them intersect, we can directly use that model to find the critical mass in our model: It is the value N for which the total area of all the randomly placed disks (i.e., πR2N) is about 1.128 times larger than the total area A of the city. In other words, N = 1.128A/π(D/2)2.
To get a feeling for how large this N can be, consider a typical city like Paris, which is fairly flat, circular in shape, and with few skyscrapers that can block the available lines of sight. Its total area is about 105 square kilometers [16].
and
to estimate N it is reasonable to assume that one lamp can infect other lamps if they are within a distance of D = 100 meters, and thus the disks we draw around each lamp has a radius of R = 50 meters. (Premise 2)
Premise 3:
By plugging in these values into the formula, we get that the critical mass of installed lamps in the whole city of Paris is only about N = 15, 000.
the Philips Hue smart lamps are very popular in Europe and especially in affluent areas such as Paris
Premise 4: Popularity of the Philips Hue lamp is indicative of its prevalence in Paris
Conclusion:
there is a very good chance that this threshold had in fact been exceeded, and thus the city is already vulnerable to massive infections
via the ZigBee chain reaction described in this paper
Analysis (with conjecture)
This is a weak argument, since only premise 1 is supported by empirical evidence from reproducible experiments.
Challenges to the arguments
While it has been demonstrated in the experiment that a vulnerability in the lamps can be exploited over ZigBee at distances of 50, 150 and 300 meters, and the program that exploited the vulnerability successfully propagated itself over ZigBee to the other lamps within range, it was never demonstrated that this propagation would take place outside of the controlled environment in the experiment on the scale claimed by the researchers (that is, city-wide propagation).
In the mathematical model based on percolation theory used by the researcher to model a "typical" urban environment, the average effective range between lamps was given to be 50 meters. Use of this value as the average effective range can be easily challenged by information readily provided by the manufacturer.
The model also relies on a random distribution of lamps throughout the city, but this seems unlikely, since consumers of this product typically have a higher disposable income, and this type of consumer is probably not randomly distributed throughout the city of Paris, the city used for the model.
Here is their characterization of a typical city:
To get a feeling for how large this N can be, consider a typical city like Paris, which is fairly flat, circular in shape, and with few skyscrapers that can block the available lines of sight. Its total area is about 105 square kilometers [16].
The choice of using Paris as model for what it means to be a typical can be challenged easily as well. I'm no expert, but a city with few skyscrapers does not seem to be typical.
The problems with the claim are more easily recognized when the claim is examined in terms of conditions required for city-wide propagation of a program that infects Philips Hue lamps over ZigBee.
Given that
- the city is approximately round AND
- the city city is flat AND
- the city has few skyscrapers AND
- the distribution of Philips Hue lamps across the city is random
then the distribution of lamps can be modeled using percolation theory, and if, in addition to this,
- there are enough Philips Hue lamps in the city to reach the percolation threshold AND
- the average effective range of the lamps in this environment is 50 meters
then, according to the model, everyone will die
our chain reaction attack spreads much faster by making each infected lamp the new source of infection for all its adjacent lamps; the attacker only has to initiate the infecting with a single bad lamp, and can then retire and watch the whole city going dark automatically.
and
the city is already vulnerable to massive infections via the ZigBee chain reaction described in this paper
Unless these conditions are fulfilled, the model does not work. This is probably part of the reason why Paris was chosen as an exemplar for this paper, even though the research was conducted on the campus of Dalhousie University, Halifax, Canada.
To answer the question directly
Is a 'chain reaction' of ZigBee bulbs being hacked feasible?
In an ideal setting, namely a hypothetical city that conforms to the favorable parameters in the model, a city-wide "chain-reaction" is feasible according to percolation theory.
The researchers demonstrated that their program automatically self-propagates over ZigBee and infects vulnerable lamps within the range of any one of the previously infected lamps. Everything beyond that is hypothetical.
When the researchers say that this would enable them to "watch the whole city going dark automatically", this would only be the case if the above conditions were met plus the majority the lights in the city were Philips Hue lamps, which seems to be...unrealistic.
