by in
of security.
Security is like a light bulb: you can trust it to light your way, but you must be careful to ensure that it is not tampered with by malicious forces.
• Fixed keys in keyed hashes can be cracked with a brute force attack
• Session keys must be verified to prevent spoofing
• Initialization vectors must be unique for each encryption to prevent predictable encryption
• Sequence numbers and timestamps must be included to prevent replay attacks
Jeremy Clarkson’s opinionated summary: The TP-Link Tapo L530E smart light bulb, which is currently the best seller on Amazon Italy, has several cryptographic insecurities that could be exploited by an attacker to steal a user’s Wi-Fi and TP-Link account passwords. The researchers found that the app and bulb firmware have a basic safety check to help the app and bulb find each other reliably, but it was clearly designed to avoid mistakes rather than to prevent attacks. In addition, the session key agreement and initialization vector protocol are poorly designed and can be easily cracked. Programmers and users should take heed of the research and be aware of the rules for secure network traffic and product setups.
Source: https://nakedsecurity.sophos.com/2023/08/22/smart-light-bulbs-could-give-away-your-password-secrets/
