Owning the Smart Home with Logitech Harmony Hub
summary
Reverse engineering the Logitech Harmony Hub finds two vulnerabilities that chain to remote root without authentication or MITM, discovered by extracting firmware via intercepted updates and decompiling Lua with a Lua decompiler. One is an OS command injection in time sync, the other accepts forged WebSocket origins, both letting an attacker run hub commands to add/modify devices. Proof of concept unlocks a smart deadbolt and triggers sirens; app has 1M+ downloads.
AI-written summary · about
chapters (14)
- 0:00Introduction to smart home hubs
- 0:41About the Logitech Harmony Hub
- 2:49Background on the device
- 3:50Smart home future and risks
- 6:41Reversing the Harmony Hub
- 8:25Firmware extraction and analysis
- 10:33Lua decompilation process
- 11:37Vulnerabilities overview
- 13:01Time server command injection
- 13:43Application command injection
- 14:49Capabilities after compromise
- 15:30Impact of remote root access
- 16:18Proof of concept demo
- 17:00Research resources and contact
related talks
26mCodema Attack: Controlling Your Smart Home Through Dangling Management Channels
37mOpen Sesame! The full story behind opening a smart lock
41mPwning Centrally-Controlled Smart Homes
51mSteering Clear of Danger: Decrypting the Realities of Remote Car Hacking
31mHacking Everything – The Dark Side of the Internet of Things
16mReverse Engineering the Eufy Ecosystem: A Deep Dive into Security Vulnerabilities...
35mHow I Can Unlock Your Smart Door: Security Pitfalls in Cross-Vendor IoT Access Control
45mOutside the box: pwning IoT devices through their applications