We already tested the Philips Hue as well as the IKEA TRADFRI Lighting system. Now, let’s see, if the third big player in the “league of light” will beat them. Osram Lightify (aka Sylvania Smart+) also comes with a Gateway as well as several bulbs, garden lights and so on.
Initial setup / Device pairing
In contrast to Hue and TRADFRI, Lightify users have to create an Osram Lightify account in order to use their solution. The initial setup of the Gateway doesn’t pair it with the App – it is being paired with the Osram Lightify account. Pairing of additional phones also only requires the Lightify account to login. For pairing additional lights, they only have to be switched on. The device search can be initiated by the App.
For our app analysis, we downloaded and installed “Lightify” from the Google Play Store (https://play.google.com/store/apps/details?id=com.osram.lightify). As with the other tested smart home lighting systems in this blog, we would have been pleased if we had an overview of the registered devices in the app. The decompiled source code of the app is partially obfuscated: The class names all look like they had their original names, but all methods were obfuscated. The app does not implement security features like certificate pinning. The storage of the users shared preferences (like password and username) is also pseudo secure at max. Although the xml files are located in the private app storage (and cannot be accessed by other apps per default), mobile malware might root your smartphone and read the settings. The decryption is fairly easy as Osram uses a “Crypto” implementation from Arrayent (see later). This code however just uses a basic password based encryption with DES and could be easily reconstructed, as seen in the following image.
For the online communication, Osram uses the Arrayent Connect platform. The whole communication via this platform is encrypted. QUIC is being used – an experimental protocol which is based on UDP and TLS1.3-encrypted per default.
Also, we tested Osram’s Lightify-Skill for the Amazon Echo. The registration process isn’t really comfortable: Not only the Lightify login is required – also the serial number of the Lightify Gateway. The communication between Alexa and the Lightify Gateway is identically to the App’s Cloud communication and therefore also secure.
Like Philips Hue, the Lightify Gateway communicates completely unencrypted locally, but via a binary protocol. Details about the used protocol can be found here.
Via port 4000/TCP, a service is waiting for commands by the App. We wonder, why Osram didn’t implement any authentication for the local access – the Python plugin python-lightify let us control the lights without logging in.
- Camera (optional, scanning the Lightify Gateway’s QR code)
- Location (optional, enabling the geofencing feature, not being saved in the Cloud)
- Wi-Fi (required to communicate with the Gateway)
Lightify is the Smart Lighting solution of the multinational lighting manufacturer Osram. In difference to its competitors, an account is needed to control the lights. Therefore, secure remote controlling is available without any additional configuration. Communication in the local network is completely unencrypted, which (like mentioned in our Philips Hue test) should be a No-go these days. Once, Osram improved their solution at this point, the rating will also improve to three stars.