Unveiling IoT Vulns: From Backdoors to Bureaucracy
Examines over 50 real-world IoT vulnerability cases featuring hardcoded backdoors and discusses systemic barriers in reporting flaws to vendors and CERTs.
Summary
Widespread Vulnerabilities in the IoT Ecosystem
Analyzing over 50 real-world IoT vulnerability disclosures reveals persistent systemic security flaws across commercial routers, industrial cameras, and environmental monitoring devices.
Hardcoded Backdoors and Predictable Credentials
Critical vulnerabilities, including CVE-2024-48271 (CVSS 9.8) and CVE-2025-1143, demonstrate vendor-embedded backdoors, hardcoded root credentials, and unauthenticated management consoles that grant remote attackers global device control.
Risks to Critical Infrastructure
Poorly secured commercial IoT devices deployed in municipal water plants, ATM networks, and transportation systems provide direct pivot points for criminal scammers and nation-state threat actors.
Bureaucratic Barriers in Responsible Disclosure
Kai-Ching Wang and Chiao-Lin Yu share the challenges of navigating vendor denials, unresponsive CNAs, and multi-year reporting delays, advocating for reforms in international vulnerability coordination.
Related talks
Creator Stage·43 min
Zoltan Balazs
Surveys pervasive architectural and implementation failures in consumer IoT gadgets, highlighting cleartext credentials, command injections, and insecure defaults.
Creator Stage·40 min
Mager · Forte
Uncovers zero-day vulnerabilities in cloud-connected Wi-Fi cameras and baby monitors, demonstrating remote code execution via flawed P2P protocols.
Creator Stage·42 min
Dennis Giese · Braelynn Hacker
Reveals critical security flaws in Ecovacs smart home robots including broken crypto, missing TLS validation, remote code execution, and camera eavesdropping.