Student Team Wins Embedded Security Challenge

Engineers figure out how to hack into smart light bulbs

Smart light bulbs—the kind you can turn on and turn up from an app on your phone—can be convenient and energy-saving. They can also be hacked, a team of engineers from the University of Delaware recently proved.

Three UD graduate students in computer engineering — Patrick Cronin, Charles Gouert, and Fateme Hosseini  — took first place in the Embedded Security Challenge at the finals of CSAW (once called Cyber Security Awareness Week), the world’s largest student-led hacking and protection competition. The team was advised by associate professor Chengmo Yang and assistant professor Nektarios Tsoutsos, both of the Department of Electrical and Computer Engineering.

The finals of CSAW, now celebrating its 15th anniversary, were held from November 8 to November 10 at universities across four continents. The finals for the United States and Canada were held in Brooklyn and hosted by the New York University Tandon School of Engineering, the founder of CSAW. There, 130 student finalists competed in seven separate competitions, while another 267 competed in the final rounds hosted by schools in France, India, Israel, and Mexico.  To earn spots in the finals, this year’s contestants bested nearly 20,000 competitors worldwide.

The Embedded Security Challenge is a hardware security competition that focuses on hacking the Internet of Things (IoT) and embedded devices. Security experts from NYU Tandon competed with finalists from seven universities to mimic the real-world attacks and defenses of the connected devices that comprise the IoT. Teams were challenged to exploit weaknesses of smart light bulbs to grab data from a nearby network.

“Our team developed robust covert channels for exfiltrating sensitive data from IoT smart bulbs at distances of 75 feet using a telescope and a luminosity/color sensor, which received the highest score from an independent panel of eight industry-expert judges,” said Tsoutsos.

This challenge was led by NYU Abu Dhabi Modern Microprocessors Architecture Lab (MoMA) and the U.S. Office of Naval Research. The winning team from UD received a $1,000 prize.