Watch this drone hack a room of smart bulbs from outside the window

In these past few years, the Internet of Things (IoT) has introduced us to easy-to-use technology and more smart devices than we can imagine. But as anyone would suspect, when this technology falls into the wrong hands, it can unfold into a security nightmare.

On top of recent stories such as the internet’s massive DDoS attack, here’s more proof of the faulty IoT world we live in: a drone was able to hack smart lightbulbs from outside of a building.

In a report titled “IoT Goes Nuclear” outlined from The New York Times , researchers detailed a scenario where connected devices are infected by a worm that sets off a chain reaction, creating a doomsday-like scenario for smart cities. The threat is demonstrated by an infected Hue lamp with a virus that's spread by jumping from one lamp to its neighbors, whether the lights were on the same private network or not.

The worst part is that the researchers didn’t need physical access to the lights, since they were infected wirelessly by a drone or car while still a few hundred feet away. In the video below you can see the lights being hacked to signal SOS repeatedly in Morse Code, and as the drone comes closer, you can see more lights blinking as the worm spreads across the devices.

Researchers from the Weizmann Institute of Science and Dalhousie University executed the chain-reaction attack by exploiting a vulnerability in the ZigBee wireless communications protocol, a widely used home automation protocol found at the center of millions of smart home devices.

Philips Hue lighting is just one example. Other notable ZigBee devices include the Nest thermostat and Logitech Harmony Ultimate home control hub. The infected payload was delivered by exploiting a weakness in Philips’ encryption to force an over-the-air firmware update using an autonomous attack kit built from equipment costing a few hundred dollars. Basically, anyone with the knowledge could execute a similar attack.

Of course, Philips was notified about the vulnerability and a patch was immediately issued.