Smart lighting systems are supposed to make managing commercial buildings easier and more energy efficient. MaxLite’s c-Max system (as well as others that seem to rebrand the same technology), sell a Bluetooth mesh solution for commerical lighting, lets facility managers control lighting networks using a smartphone app and QR codes. However, a closer look at how these QR codes are generated reveals a security oversight. Below is an exerpt from the setup guide:
The primary issue is when you decode each of these setup keys when generated from the app or even from as listed in documentation the result is the same. The User QR Code when decoded using a QR code reader is 1&%@3&%@AP7SIKUDGElGnIXHB and the Admin QR Code is 0&%@3&%@AP7SIKUDGElGnIXHB such that the only difference is the first digit.
In short: the system’s “restricted control” passes can be easily transformed into “master keys” with a single, simple change.
The Digital “Master Key” Problem
When setting up the c-Max system, administrators generate QR codes to give other people access. There are two main levels:
- Admin: Full control over the entire network (schedules, zones, settings).
- User: Limited control (usually just turning local lights on or off).
Imagine a hotel where a standard room key has a “1” written on it, and the master key for the whole building has a “0.” If an attacker realizes this, they can just cross out the “1,” write a “0,” and suddenly have access to every room.
That is exactly how the c-Max app works.
The QR Code Breakdown
When reviewed the c-Max management app (basic technical breakdown here), it was found that the QR codes are not unique and are deterministic from based on the MeshQRCode structure serialized via Gson in the app, from the following Fields:
index,
meshName,
pinData,
pinName,
lights,
devices,
highPermission
So if you have deployed this system be aware of issuing out “User” level codes or making the code generally available may not be good practice.
.
