You Don't Own What You Buy Episode 9,000: Philips' Light Bulbs Lose Functionality

from the I'm-sorry-I-can't-do-that,-Dave dept

One of the common themes here at Techdirt over the last decade is how in the digital and internet-connected era, the very meaning of "ownership" and "property" has changed -- often for the worse. In the broadband-connected era, firmware updates can often eliminate functionality promised to you at launch, as we saw with the Sony Playstation 3. And with everything now relying on internet-connectivity, companies can often give up on supporting devices entirely, often leaving users with very expensive paperweights as we saw after Google acquired Revolv.

The latest example of this phenomenon comes courtesy of Philips, who this week announced it would be discontinuing its support of the first generation of its Hue Bridge on April 29. The Bridge is the heart of Philips' internet-connected lighting system, helping you manage all of the fancy new "smart" light bulbs you've installed around the house. And while the decision won't "brick" the hardware as we've seen from other companies, it will erode overall functionality of the platform, preventing them from connecting to the internet (the entire point):

"Philips won’t brick the original Hue Bridges, but it will stop updating their software. That means the Bridges, and the lights they’re connected to, will no longer be able to use any of Philips’ online services, which is, of course, one of the whole purposes of buying the lights in the first place.

When users began asking why this was necessary, Philips flatly indicated that the company wanted to focus on supporting newer models of the same platform:

The company also insisted this new version of the bridge would be "future proof":

Which of course isn't true. In a few years the company will move on from that product as well, leaving many users with "smart" hardware that slowly bleeds functionality until it's a shadow of its original marketing promises. Worse, as these products fall out of support, they often stop receiving essential security updates, putting users, and the internet in general, at risk.

Filed Under: end of life, hue, hue bridge, iot, ownership, property rights, smart homes, smart lightbulbs
Companies: philips

Not Even Your Light Bulbs Are Safe From Shitty Internet Of Things Security

from the apocalypse-in-a-box dept

We've discussed at length how the rush to market by Internet of Things companies and evangelists with nary a thought toward security has left us all immeasurably less safe. Whether it's smart door locks that are easily bypassed, smart vehicles that can be remotely controlled, or smart electrical outlets being used as the cornerstone of nasty new botnets, we're effectively all living in a barely-believable dystopian novel at this point. And as we've noted repeatedly, this would all be kind of funny if it weren't for the fact that inevitably, these vulnerabilities are going to result in very real, and potentially massive human deaths.

And each week it seems like we're bearing witness to a new, deeper and uglier chapter in the saga of the internet of not-remotely-secure things. This week, it's the revelation by hackers that they've found another way to exploit a weakness in the Touchlink aspect of the ZigBee Light Link system at the heart of Phillips' Hue "smart" light bulbs. More specifically, hackers have demonstrated a way to control every smart bulb in your home by pushing malicious firmware updates, without setting a foot inside of the residence:

"The researchers focused on the Philips Hue smart light bulb and found that the wireless flaw could allow hackers to take control of the light bulbs, according to researchers at the Weizmann Institute of Science near Tel Aviv and Dalhousie University in Halifax, Canada. That may not sound like a big deal. But imagine thousands or even hundreds of thousands of internet-connected devices in close proximity. Malware created by hackers could be spread like a pathogen among the devices by compromising just one of them."

As we've been noting, these compromised devices are then being used in some of the biggest and most potent denial-of-service attacks we've ever seen. According to the full research paper (pdf), the attack can be launched either via war driving (sitting in a vehicle) or by drone (in their test demonstration they were 70 meters, or 229.7 feet, away). More frighteningly, perhaps, the researchers posit that they could damage entire cities via this method using "readily available equipment costing a few hundred dollars" to forge "lightbulb worms":

"In this paper we describe a new type of threat in which adjacent IoT devices will infect each other with a worm that will spread explosively over large areas in a kind of nuclear chain reaction, provided that the density of compatible IoT devices exceeds a certain critical mass. In particular, we developed and verified such an infection using the popular Philips Hue smart lamps as a platform. The worm spreads by jumping directly from one lamp to its neighbors, using only their built-in ZigBee wireless connectivity and their physical proximity. The attack can start by plugging in a single infected bulb anywhere in the city, and then catastrophically spread everywhere within minutes, enabling the attacker to turn all the city lights on or off, permanently brick them, or exploit them in a massive DDOS attack"

Comforting. The report notes that the attack is thanks, in part, to the fact that while the ZLL Touchlink Commission protocol does use encryption to encode the "Master ZLL Key" sent to new devices joining the network, this key is shared among all devices and was leaked online last year. They're also quick to note that once a lightbulb has been infected with the worm, there's no way to reverse this short of replacing the light bulb:

"An important observation is that unlike computers or smart phones, this kind of attack is irreversible. There is no way to re-flash the Philips Hue lights firmware to get rid of our worm, and the only possible solution is to replace the lightbulb with a new one. Note that in order to prevent the new lightbulb from being infected in the same manner, the user must wait for a software patch to be available from the manufacturer before installing it."

So yes, you left the store with a "smart" lightbulb thinking you'd just have some sexy mood lighting, but were shocked to find a mini-apocalypse in a box once you got your purchase home. Thanks, internet of broken things!

Filed Under: hue, iot, lightbulbs, security, smart lightbulbs
Companies: phillips

Light Bulb DRM: Philips Locks Purchasers Out Of Third-Party Bulbs With Firmware Update

from the Patch-notes:-Adds-'buyer's-remorse' dept

The world of connected devices is upon us and things have never been better. Criminals can access your email account by breaking into your fridge. Your child's toys and your television record your conversations and send them to manufacturers' servers, where criminals are (again) able to access them. Your home thermostat goes HAL 9000 and attempts to set your house on fire. And, now, your light bulbs won't do the one thing you expect them to do: produce light.

Purchasers of the Philips Hue "smart" ambient lighting system are finding out that the new firmware pushed out by the manufacturer has cut off access to previously-supported light bulbs. (h/t William Neilson Jr.)

Philips just released firmware for the Philips Hue bridge that may permanently sever access to any “non-approved” ZigBee bulbs.

[...]

The recent change seems to suggest any non-Philips bulbs from manufacturers such as Cree, GE, and Osram will not be supported in many situations, whereas “Friends of Hue” branded product are. At the time of publication, it’s unclear whether 3rd party bulbs will stop working immediately after the firmware update or if they may only become inaccessible after the bridge is reset. We’re also not sure if being “reset” means rebooted or factory reset. This appears to apply to both the round v1 bridge and square v2 HomeKit-compatible bridge after the latest firmware update is applied.

ZigBee is the underlying standard that controls these smart lighting systems.

ZigBee is the open, global standard of choice for connected lighting applications providing ease-of-use and low-cost installation and maintenance for both consumers and business.

Philips uses ZigBee, which should mean any bulbs compatible with this standard will work with its Hue fixtures. Not anymore. The firmware update removes this support, limiting this "open, global" standard to Philips' own bulbs and those it has designated as "Friends of Hue."

Needless to say, purchasers aren't happy.

Literally. Philips has just slapped fans like us in the face and kicked interoperability out the door. Without any communication they delivered a new firmware to the system that disables adding products that they don't approve of. Basically they are banning other Zigbee Light Link products despite the fact that they are a Connected Lighting Alliance member whose mission is to promote interoperability.

As it seems (and unless this is just a huge mistake on Philips' side), they have without a warning turned their open product into a walled garden. They have also destroyed the value of the solutions that the customers have set up based on Philips' promises.

And the worst thing is that Philips has done this to their most enthusiastic fans. To the early adopters. To those who enthusiastically recommended the system to their friends.

Philips only began delivering nonsensical statements about its removal of previously-existent functionality after the complaints began to roll in. And like so many other companies that have wielded this DRM-esque tactic against their own customers, the excuses offered may as well just read "because this makes us more money." Seriously, are any of Philips' pissed off purchasers really going to believe this excuse?

While the Philips Hue system is based on open technologies we are not able to ensure all products from other brands are tested and fully interoperable with all of our software updates. For guaranteed compatibility you need to use Philips Hue or certified Friends of Hue products.

TL;DR: While technically an open system, we've closed it because $$$. These early adopters have already performed the heavy lifting on the compatibility end. They're the ones who have road-tested ZigBee-compliant bulbs and reported their findings to others. So, when a company removes support (by pushing a firmware update without prior warning) for compatible bulbs and claims the issue is "compatibility," it's so blatantly false as to be laughable. Unless you can't laugh, because you already bought one.

And Philips is apparently incredibly socially awkward. Trying to find which other bulbs are supported as "Friends of Hue" via Philips' websites is pointless. One just leads you to a page informing you that you can use Siri to control your lights. Searching for "Friends of Hue" brings you to another Philips website… which only lists products sold by Philips. In fact, while the "program" appears to allow third parties to sell products for its Hue line, it appears that every new development is sold under the Philips brand, which means that the competitiveness the phrase "Friends of Hue" implies is, in reality, no competition at all.

A walled garden is still a walled garden, no matter how beautifully lit it is. Philips has chosen to screw paying customers by locking them out of their choice of bulbs in pursuit of maximum profitability. There's nothing smart about that decision.

Filed Under: drm, hue, iot, lightbulbs, smart lightbulbs, standards, zigbee
Companies: philips