I have this old TP-Link smart lightbulb, it’s the only thing that’s IoT and on WiFi in my house.
Looking through pfBlocker logs for fun, and noticed it’s been trying to connect to the Tor network.
Oh! Also, it’s been uploading and downloading 100+ MB of data a day.
It’s definitely been popped. Rip.
No doubt.
deleted by creator
It’s been hacked, the light bulb is likely part of some botnet or under an attacker’s control directly. Which is why it’s sending that much data continuously. IoT/smart devices don’t send a lot of data in this sort of volume as most of the time they’re idle and maybe send a heartbeat or status update every once in a while to prove they’re alive.
This is what is called an indicator of compromise or IoC, it’s some behavior or pattern that can be used to determine what is happening or who is the one doing the attacking.
Likely OP would need to do some analysis to be able to get attribution unless it’s a very well known botnet actor in which case attribution is fairly straightforward.
TP-Link is trash. Avoid at all costs.
That’s really odd. For what it’s worth though, the company I work for does firmware updates over a Tor hidden service for customer privacy. We don’t send any data though (as that would defeat the purpose entirely), just poll for updates then download and install if there are any.
Fwiw the TP link bulbs usually have a local API that Home Assistant has an integration for. You can use that and block their internet access - unless they’ve removed that feature. I only used one of these briefly because someone gave it to me. Usually just use cheap ZigBee bulbs. I would throw that one out though as someone else said it’s likely been compromised already…
I’m all in on ZigBee and z-wave. The bulb is isolated, don’t even know my app login.
Do you mind sharing what ZigBee lightbulbs you recommend?
The zigbee bulbs I’ve had the best luck with are Innr, although they are kind of pricy. Ikea bulbs are good for the price, but every one I have, has very loud coil whine when off. I had some on bedside stands and had to move them to other rooms. Sengled are nice when they work, I’ve had issues with them dropping off my network.
Both Ikea and Innr are also repeaters, Sengled does not do repeaters in their bulbs. Neither Ikea or Innr are exactly cheap, but they’ve been the most solid for me.
Thats why my Smart Home is build on Zigbee. (Yeah VLANs and so on, but so many clients still makes your wifi worse)
