Embedded Linux device bughunting

This talk follows the path from a Uniview IP camera on the desk to a shell on the device. The speaker argues that the workflow applies to most IoT hardware, and that on-premises cameras are a useful target because they sit inside a building's trust boundary. Work starts with a teardown and a serial console on the board, then firmware from third-party collections is unpacked to find startup scripts and a large monolithic binary. A wrapper around system calls there exposed command injection in the web interface.

Attack surface mapping compared a running device's listeners with an external scan and found more UDP services than expected. An SNMP service exposed a credential through its object tree, and a discovery feature let a temporary password be derived locally from the serial number and date. A small custom protocol service was reversed by renaming variables in a decompiler until a length field was seen feeding a stack copy. Protocol-aware fuzzing and an ARM exploit that used a fixed binary address got past the stack randomisation.

The speaker closes with an internet survey that found roughly 3,300 reachable devices, and notes that the bugs were reported through a bounty platform and the vendor. Takeaways include testing current firmware rather than old releases, scanning fragile devices carefully, verifying bundled open-source components, and finding custom protocols more rewarding than common web flaws.