State of Union

The talk tests upcoming European regulation for connected consumer devices against real products instead of only reading the regulatory text. It starts from the Radio Equipment Directive's cybersecurity requirements and the forthcoming Cyber Resilience Act. The research collected 22 best-selling devices in Finland across healthcare, home automation and IP camera categories. Each was dismantled, its firmware dumped and its network behaviour observed. A child-monitoring camera with a companion sensor serves as a detailed case study.

The case study failed several requirements: firmware stored in clear text, a fixed default password, known vulnerabilities, and personal data that remained after the device was wiped through the app. Across the full set, communication encryption was surprisingly strong, with most devices using TLS and certificate pinning and many running without an operating system. The weaker areas were data handling and maintenance. Many products shared data with third parties without an opt-out, many did not delete data on reset, and software updates were rarely enforced for always-connected cameras and home automation gear. Nearly half relied on outsourced development, which made reporting vulnerabilities to engineers difficult.

The main takeaway is that the supply chain, data deletion and update practices need attention beyond transport encryption. The speaker plans to repeat the measurements in a year or two to see whether the regulation changes these results.