1 Firmware Flaw, 70 Devices - Lessons in Industrial IoT Disclosure and Mitigation

The talk covers a firmware flaw in industrial LoRaWAN sensors from one vendor, which the speakers say affects more than 70 models. The work began as a student project in which keys were pulled from one device, and later testing found that many sensors output raw NFC memory in readable form. That exposed the network and application session keys used in ABP activation, plus a device-to-device key. An attacker needed only brief physical contact and an NFC-capable phone, and no physical trace was left. The presenters described the impact: decrypting and forging traffic, a targeted denial of service by manipulating frame counters, and unauthorized commands in the vendor's D2D protocol.

The middle of the talk follows the disclosure path. After the January report, the vendor acknowledged it within a day, asked for documentation, and mapped the affected product line. A CVE ID was requested and reserved, but it was not yet published at the time of the talk, while the vendor advisory and firmware rollout were already underway. The speakers stressed that disclosure involves researchers, the vendor, a CNA and operators, each on a different timeline, and that field devices that are hard to reach or replace adopt patches slowly.

For operators, the recommended steps were to move from ABP to OTAA, disable D2D where it is not needed, restrict physical access, and schedule firmware upgrades. The takeaway is that a cooperative vendor makes disclosure smoother, but timing still matters when industrial devices cannot be patched quickly.