IoT Hacking Stories in Real Life
Shares real-world case studies and practical lessons learned from testing and hacking consumer IoT devices.
Summary
In this practical briefing from the DEF CON Safe Mode IoT Village, an embedded security penetration tester shares real-world case studies assessing consumer and enterprise smart devices. Opening at 00:00, the presenter explores the pervasive design shortcuts and security anti-patterns that plague modern IoT products.
At 06:00, the speaker details physical attack surfaces, illustrating how unencrypted UART and JTAG interfaces left enabled on production hardware allow attackers to obtain root interactive shells.
At 12:02 and 16:04, the presentation exposes severe cloud backend vulnerabilities, demonstrating how hardcoded API keys, insecure device pairing routines, and broken object level authorization (BOLA) in cloud management APIs permit unauthorized attackers to remotely hijack smart home devices and access sensitive user profile data. (AI summary — Gemini Flash)
Related talks
IoT Village·1 hr 1 min
Matthew Byrdwell
Presents an embedded hardware research case study dissecting device security architecture and unexpected failure modes.
Village Presentations·22 min
Craig Young
Tripwire VERT researcher Craig Young exposes zero-day vulnerabilities across consumer smart home automation hubs, door locks, and wireless power outlets.
IoT Village·43 min
Jay Balan
Jay Balan shares insights from five years of IoT vulnerability research, demonstrating authentication bypasses, root shells, and practical disclosure lessons.