Smart Home Invasion: Exploiting Home Automation IoT Devices
Tripwire VERT researcher Craig Young exposes zero-day vulnerabilities across consumer smart home automation hubs, door locks, and wireless power outlets.
Summary
The Insecure Foundation of the Modern Smart Home
Connected IoT appliances, smart thermostats, and wireless door locks create pervasive physical attack surfaces within residential networks.
Dissecting Smart Home Hub Vulnerabilities
Craig Young audits popular commercial smart home hubs, discovering unauthenticated local API endpoints, CSRF execution, and flawed cloud authentication.
Chaining Flaws to Control Physical Actuators
Young demonstrates exploiting network vulnerabilities to remotely unlock front doors, disable security cameras, and control high-draw electrical outlets.
Guidelines for Consumers and IoT Manufacturers
The author provides recommendations on network segmentation, firewalling IoT VLANs, and enforcing mutual TLS in connected home products.
Related talks
Creator Stage·43 min
Zoltan Balazs
Surveys pervasive architectural and implementation failures in consumer IoT gadgets, highlighting cleartext credentials, command injections, and insecure defaults.
Creator Stage·22 min
Dr Katie Paxton Fear
Demonstrates using AI-assisted coding to reverse engineer conventional hardware and integrate legacy sensors into Home Assistant.
Main Stage·40 min
Reynaldo · nyx
Reverse engineers commercial vape and sound monitoring sensors installed in school restrooms, uncovering unauthenticated telemetry feeds and cloud vulnerabilities.