Hell-0_World | Making Weather Cry

The speakers open with a survey of consumer Internet of Things devices, covering their radios, cloud back ends, mobile apps and remote configuration paths. They recall a casino breach that started with a connected fish tank on a flat network. Their case study is an unreviewed weather station bought online, with an undocumented Bluetooth setup, a 433 MHz sensor radio, and a display that mishandled sub-zero temperatures.

Opening the unit revealed a Tuya-based wireless module, and its published serial documentation helped them reach debug output on a UART port. Firmware dumped with an open-source tool was unpacked with binwalk and studied in Ghidra. It exposed Wi-Fi credentials stored in base64 and cloud keys. A hidden service on TCP port 6668 carried encrypted messages; the key turned out to be an eight-byte local key expanded per character into AES-128 in ECB mode. With that, they wrote a console tool that sends commands over the local network, changes display units, triggers alerts and supports fuzzing.

Their recommendations include segregating IoT devices on physically separate networks, using strong passwords, securely disposing of old hardware, and keeping an asset inventory with a documented incident response plan. After disclosure, the vendor supplied OEM samples, and a later board revision had fixed the temperature bug, so comparing firmware versions became the next step. Code is published on GitHub.