Our Time in a Product Review Cabal

The speakers explain how a postcard offering a free product, reimbursed after a purchase and review, grew into a large circle of friends receiving free smart-home gear from many sellers. Once the hardware was in hand, they set out to determine whether these cloud-connected devices were safe to run on a home network. Many products were white-label units built on a shared cloud platform, and several exposed far more than expected through serial debug ports, forced firmware updates, or video copies sent to third-party cloud hosts.

They described their assessment approach, starting with UART serial access, which often needs only a cheap adapter and pogo pins, and then packet capture to see where each device connected. Findings included an old RTSP media server with a well-known remote code execution flaw, a peer-to-peer relay design that let other users reach a camera using a guessable identifier, and a camera whose destinations shifted after an automatic update. For defense, they recommended DHCP reservations without a gateway, layer three access controls, flashing open-source firmware over serial or JTAG, or swapping a microcontroller. Devices that cannot be controlled should be discarded.

They also covered spotting fake reviews, such as uniform five-star praise, generic wording, and reviews describing a different product. A vendor that paid for product research offered a contrasting example. The main takeaways were to test devices before trusting them, check where they connect, and approach cheap cloud-tied gear with skepticism.