Skip to content

DEF CON 34 talks are here: 354 talks, summarized and searchable.

Browse DEF CON 34

EOL... RLY? Ending The Epidemic of Bricked and Abandoned Stuff

Paul RobertsLodrina CherneJohn BumsteadLucas Gutterman

PolicyTalks51 minBeginnerOpen on YouTube ↗

Where

Talks
HOPE XV

Duration

51 min

A panel examines why connected devices get abandoned or bricked at end of life, and what could change that.

Summary

Paul Roberts moderates a panel with a security reporter, a device refurbisher, a public-interest campaigner and a digital forensics instructor. The starting point is the gap between hardware that can last decades and vendor software support that often ends after a few years, leaving owners to either keep unpatched devices online or send working hardware to landfill. The discussion turns to concrete cases: Google's Chromebook support window, which was extended to ten years after a public campaign, and a refurbisher's account of Apple activation lock and remote management blocking reuse of institutional devices, including parts from locked machines.

Panelists also point out that abandoned devices become botnet material, citing end-of-life routers used to hide malicious traffic, and raise concerns about industrial and medical equipment. Proposed remedies include minimum support periods such as the EU proposal, clear labeling of support lifetimes, escrowed firmware or source code released when a product is discontinued, and rules that let owners install their own software. Some lock-outs are described as possibly deceptive marketing under existing consumer law, and the panel encourages attendees to report affected devices to regulators.

For practitioners, the session frames end-of-life planning as both a security and a sustainability problem. The practical takeaways are to track support dates before buying, document how devices are retired, and treat regulatory complaints as a route to change.

Related talks

Talks·51 min

  • ShmooCon
  • Policy
  • Date: Jan 2024
  • Location: DC

Liz Wharton · Danette Edwards · Cyndi Gula

Explores how SEC enforcement, cyber disclosure rules and personal liability are reshaping the role of CISOs after recent breaches.

panelriskincident-response+1