1.1M Cameras, One Wildcard - Architectural Surveillance in an IoT Cloud

The talk begins with a simple question from a colleague: is a store-bought baby monitor safe? The speaker found that many camera brands sold on retail sites shared one manufacturer's backend, then reverse engineered the companion Android app. Decompiling it exposed hard-coded peer-to-peer material, a request-signing scheme, a list of device commands and the addresses of the MQTT brokers and a configuration server.

The middle of the talk covers the exposed services. Several EMQX brokers accepted default credentials or anonymous clients, so a wildcard subscription streamed messages from roughly 1.1 million devices in 118 countries. The messages carried motion alerts with image links, device bindings, user email addresses and MAC addresses. An unauthenticated Apollo configuration server returned hundreds of production secrets, including database credentials and a key that allowed rebinding devices to other accounts. Images were stored in shared buckets with no per-customer isolation, and the image encryption was trivially reversible. The speaker also described a back-office portal reachable through employee single sign-on, and a vulnerable job scheduler.

The disclosure process was slow and difficult. The vendor was silent for days, later proposed restrictive terms, and backdated its advisories. Five CVEs were assigned, but the fix mainly moved services behind a firewall, and default credentials still worked on some brokers. The main takeaway is that access was built into the architecture, so patching one component left the attack chain intact.