Privacy leaks Extracting data from used smart home devices

In this comprehensive hardware security talk at the DEF CON 27 IoT Village, Dennis Giese reveals how second-hand smart home devices purchased from online auction sites and thrift stores frequently leak extensive personal and sensitive user data. He begins at 07:00 by exploring why standard "factory reset" functions often fail to sanitize flash storage, leaving gigabytes of residual user data intact across discarded smart vacuum cleaners, smart speakers, Wi-Fi cameras, and IoT hubs.

At 14:00, Dennis breaks down the internal storage architectures of smart devices, explaining the differences between SPI NOR flash, raw NAND flash managed by the Linux Memory Technology Devices (MTD) subsystem, and integrated eMMC chips. He demonstrates physical hardware extraction techniques at 21:00, showing how to attach debug probes to UART serial consoles, solder onto JTAG pins, or read eMMC chips directly using SD card adapters. He also reviews low-cost hardware tools for dumping SPI flash chips at 28:00.

At 35:00, Dennis demonstrates parsing extracted flash file systems (such as SquashFS and UBIFS) to recover original factory credentials, Wi-Fi SSIDs, WPA2 pre-shared keys, and cloud OAuth authentication tokens. In the session's climax at 42:00, he displays sensitive recovered artifacts—including indoor LiDAR floor plans from robot vacuums, camera snapshots, audio recordings, and associated personal identities. He concludes with recommendations for both manufacturers and consumers on how to securely sanitize embedded IoT storage. (AI summary — Gemini Flash)