If I find bank statements or other correspondence containing personal information, all of that gets added to the "dossier." If I find a hard drive, I'd plug it in and poke around. If I found a birthday card, I'd check the date it was mailed and have a good idea of when you were born. If I found a smart bulb... well, now this is just one more small extension of your personal attack surface.
Take this a bit further - what happens when the healthcare startup with 50 or so employees installs smart bulbs? Let's say the bulbs last on average five years, and they have 50 bulbs in their offices. That's ten bulbs failing per annum, giving a ~80% chance of finding a smart bulb in their trash in a given month. An attacker gets one of those, and is able to connect to their internal network over WiFi. From there they can poke around on internal machines, and would probably even have access to a whitelisted origin IP for SSHing into production machines.
I think they have bigger issues than whether the bulbs themselves are secure (even if they are the manufacturer).
It's still one more vector that doesn't need to exist, because there is no reason what-so-ever that you need a Wi-Fi chip inside your light blub!
… at which point they need to break SSH/TLS after getting off the IoT sandbox network. I’d worry more about phishing and malware, and focus on deploying things like MFA first.
If they aren’t doing any of those things (or, in your example, not using a paper shredder) PCI & HIPAA are going to be a lot more of an existential threat than someone dumpster diving.
The electronics bin in my building's basement is emptied around every 8 weeks, so there's more chance for someone to find them. (I know several people who search through these bins and repair electronics with only minor faults, which is excellent for reducing waste etc.)
[1] That's what this symbol means, on most electronics you buy: https://en.wikipedia.org/wiki/Waste_Electrical_and_Electroni...
I feel like I might be one of those people if this excellent service was available in the US!
It wouldn't be super helpful if I was trying to target a singular person but if I was just going to look for a bulb to use this exploit on, similar to how ATM hackers look for the models they know how to crack, I'd probably be able to find one eventually SOMEWHERE.
So you are going to have to dig through my trash (assuming curbside (it isn't) two to three times to find a blub.
My door lock is easier to compromise. Just walk in and walk out with my server.
Fact of the matter is, if you are the target of someone, there are better ways... and if this is just an opportunistic guy that got some lightbulbs off the back of an e-cycler truck and one of them happens to be mine. He can have whatever he can find on my network.
TL;DR: The lock on your front door is easier to exploit, and the lock on your back door is probably even worse.
They could collect the trash every week, obtain wifi passwords, and obtain a warrant to perform eavesdropping on the network.
[0]https://criminal-law.freeadvice.com/criminal-law/arrests_and...
1) $BADGUY (say, a business competitor) occasionally visits your office (for meetings or whatever).
2) $BADGUY notices that you use CrapSecurity lightbulbs, and brings along a dead CrapSecurity bulb in his backpack.
3) $BADGUY goes to bathroom, replaces the CrapSecurity bulb in your bathroom with his dead bulb (so you think it just burned out or something) and takes your bulb along to read the password at his leisure.
How much would your building's janitor have to be bribed to give someone a dead bulb? Replacing bulbs is one of the things that janitors do, so there'd be virtually no risk to him. The new bulb would have to be added to the network by the sysadmin, but is he gonna ask the janitor for the old one?
Colour me surprised.
The light would store the (B)SSID of your network, so you could just use something like wigle.net to go from that to a lat/lon coordinate.