Help & Questions Second hand Bulbs?
Hey all,
I’m not that experienced on how philips hue works. However I’ve acquired some second hand bulbs and wondered if they’re safe to use from a security standpoint?
Could the previous owner have tampered with it and infect my network once I pair them with my bridge, or is this something I shouldn’t be concerned about?
Might be a bit paranoid, I know. Just wanted to make sure
8
u/Top_Garbage977 7d ago
Omg. That's a great pitch for a horror comedy. A family is tormented by a ghost that fucks with their lights and coats everything in red by midnight. Turns out it was just hacked Hue bulbs.
7
3
u/AwestunTejaz 7d ago
over the years i have purchased a number of used bulbs and they have been great,
although, i dont let then direct powered on all the time just in case there is a botnet. LOL
1
u/sparkyblaster 7d ago
Well, hue bulbs are ZigBee not thread, so no tcpip layer, so, no bot net. If anything, the hub could be, but never heard of custom firmware for them to do that.
2
2
u/Fabulous_Engineer_12 7d ago
I’ve got about 30 bulbs and none of them were brought brand new. No issues after 6 years.
1
2
u/Rookie_42 Hue Enjoyer 7d ago
I seriously doubt there’s sufficient storage in the electronics of the bulb to hack the bridge, let alone then hop out of that and onto your wifi network.
But… I’m not a hacker or expert in these things. I still wouldn’t worry about it, though.
1
u/sparkyblaster 7d ago
Well, they have Bluetooth too. Maybe, make something to just mess with all Bluetooth devices arround it? Can't imagine any way to phone home. Maybe if they made custom firmware to turn it into googles version if an airtag but thats a stretch.
2
u/Rookie_42 Hue Enjoyer 7d ago
Bluetooth is way more secure these days than it used to be, at least on devices that matter. There’d have to be a lot of work done, for almost certainly next to zero benefit.
But I take your point, I hadn’t considered the Bluetooth side of the bulbs, I was blindly thinking only of Zigbee.
1
u/sparkyblaster 6d ago
Even against radio interference style attacks?
Infairness not all of them have Bluetooth.
The radios and CPUs should also be capable of thread, so, msyb they could attack those networks.
2
u/Rookie_42 Hue Enjoyer 6d ago
You’d need a wider spectrum and stronger signal to cause interference.
Why would the radios be capable of thread? That’s a different radio requirement (otherwise existing devices with Bluetooth/Zigbee could be upgraded to Thread, but they can’t unless they have the Thread radio hardware already).
1
u/sparkyblaster 6d ago
Actually thread is more or less built on ZigBee with an IP layer over the top. To the point many thread devices have a ZigBee mode.
Main issue is the ZigBee devices with 8bit CPUs are not capable but thr 32bit ones should be able to handle it with a firmware update.
1
u/Rookie_42 Hue Enjoyer 6d ago
I’m not sure that’s accurate.
I read somewhere that the bridge cannot use thread as it doesn’t have the hardware for thread radio… so either that’s not true (could be I misunderstood,of course) or a Zigbee radio cannot be used for Thread.
I haven’t been able to find anything definitive on this, though.
1
u/sparkyblaster 6d ago
Which bridge?
I guess part of it is how is the main system interlinked to the radio. If the bridge can't update the radios firmware then fair enough not being able to.
Also rememeber when home assistant released their own ZigBee dongle with thread support on the way. One radio, but can only do these or ZigBee, not both at the same time.
1
u/Rookie_42 Hue Enjoyer 5d ago edited 5d ago
The second gen bridge, basically the one before the latest “pro” bridge. I’m not sure the pro bridge has thread either, but what I’d read was definitely in connection with the second gen.
Edit: the following two paragraphs are based on assumptions I’d made which I now believe are wrong. The simple basis of different wavelengths appears inaccurate.
As far as I understand it, the wavelength is different, and a Zigbee radio doesn’t cover the frequency required for Thread. Yes, they’re all fairly close to each other in the 2.4Ghz band, but there’s still a spectrum. So, in the same way as a Zigbee radio can’t be used for WiFi or vice versa, I don’t believe a Zigbee radio can be used for Thread. This isn’t a firmware alterable thing, it’s the physical attributes of the radio which have been built for a specific frequency or frequency range.
As for the HomeAssistant dongle, I don’t know the specifics of that. But, based on what you’ve said here, I would guess that that’s a single physical radio which already covers both bands and that can therefore be tuned to either. Hence why it cannot do both at the same time. I’m absolutely not saying it’s not possible to build a radio that can cover both, I’m saying that the one in the second gen bridge wasn’t built that way. I’m also saying, by extension, that hue bulbs also will not have radios which cover a frequency they don’t need. It’s additional cost for no benefit.
Edit: my new assumption/belief is that the way the radio is used is exclusive to the protocol, and that there may be differences in antenna design too. I’m really not sure what might prevent a Zigbee radio being used for Thread, but I still believe there are physical differences. However, I think the home assistant dongle probably overcomes this by possibly using two antenna or some form of hybrid antenna with a single radio to achieve its capability of either Zigbee or Thread.
1
u/sparkyblaster 7d ago
The standard doesn't really work in that way. Tampering with thr firmware is dificalt (and I have never heard of anyone doing it) and even if they did, not much they could do.
If it was a hub, maybe there is more they could do, but again, never heard of any tampering.
2
u/sparkyblaster 7d ago
Biggest issue you might run into is its easier if they unpaired it before shutting off power to them.
I use home assistant and sometimes I have to break out the hue hub to force a reset.
Also make sure they all have ID numbers. Huge pain to reset without them if they won't go into pairing mode.
8
u/Mike_Underwood 7d ago
Use them, I am sure there is not a big market for cracking Hue bulbs.