Looking at the product again, I don't think this even has built in Wi-Fi (it uses bluetooth for the connection).

I don't know what I am looking for here in Wireshark, but I added the host and ran it for about 15 seconds and there was a constant packet that was captured, maybe a ping?

enter image description here

enter image description here

I was going through my connected client list trying to add some alias names to my devices to help keep track of what is connected to my network.

I noticed one device that I didn't have a name for, and had trouble trying to track down what it was.

Checked the MAC address to try and find the vendor and got some basic details, enough to recall what this was.

I have a "Smart Wifi Lightbulb" which comes with an app to change its colors etc.

When I ran NMAP on the IP, it said that service=IRC was running on port 6668. I know that there are only a limited number of ports so there are bound to be devices that share ports that might not be what they are actually for.

As a test, I pulled up an IRC client and put in the IP and the PORT and it connected. It stays open for about 30 seconds and then disconnects.

Anything I should be worried about here or further things I should check into?

Product: https://www.amazon.com/gp/product/B07CL2RMR7/

MAC: 68:57:2d:12:bf:d2  
Main Products: Smart LED Light Bulb, Smart Plug, Smart Switch, Smart Module

Mac-mini:~ $ sudo nmap -sS
Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-21 10:01 MST
Nmap scan report for
Host is up (0.076s latency).
Not shown: 999 closed ports
6668/tcp open  irc

Nmap done: 1 IP address (1 host up) scanned in 1.12 seconds][1]][1]

enter image description here

  • The worst would be an attacker in your network might change light colors. – yeah_well Jan 21 '20 at 17:24

Nothing serious to worry about from the data provided. It might be how it talks to a control station or receives commands. I'd run a packet capture on it to investigate further. I'd also want to run some IRC commands.

It does appear that it's unencrypted. But the risks on an unencrypted line of commands to a light bulb might be very low.

Is it "face-palm-worthy"? Oh yes. Is it a major security issue? Not from the data you provided, but I'd still want to see that packet capture to know more.

There is a possibility that IRC functionality means that there is a Linux server in the bulb, which means that an attacker might be able to log in, install things, and keep connection to the network in your home. But these things would have to be confirmed.

This is a reason why it is recommended that you place IoT devices on their own network. It segments off weird stuff like this away from your user computer devices.

  • Thanks for the info. I do have my IoT devices on their own VLAN for reasons like this. I did some more research on the product, and it doesn't even look like it has WiFi built in, it uses bluetooth. This could be another device on the network perhaps. I updated the post with two wireshark screenshots from the packet capture. – SBB Jan 21 '20 at 17:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.