What is Dead May Never Die: The Immortality of SDK Bugs
Explores how unpatched software development kits from major chipset vendors perpetuate persistent vulnerabilities across millions of consumer IoT devices.
Summary
The Ubiquity of Vendor Chipset SDKs
Chipset manufacturers provide Software Development Kits (SDKs) containing reference drivers, pre-compiled binaries, and web management services to help device vendors quickly bring smart hardware to market.
Flaws Frozen in Upstream Codebases
When vulnerabilities exist within reference SDK code, those flaws are bundled into dozens of commercial product lines across multiple vendors. Once hardware is deployed in the field, upstream SDK patches rarely propagate down to end-user devices.
Botnet Exploitation of Zombie SDK Vulnerabilities
Richard Lawshae demonstrates old-day and zero-day vulnerabilities in major chipset SDKs that have been continuously exploited by IoT botnet operators across millions of connected cameras, routers, and smart plugs.
Cleaning the Zombie SDK Ecosystem
Mitigating systemic SDK vulnerabilities requires chipset vendors to adopt transparent patch management, device manufacturers to maintain active firmware update pipelines, and automated SBOM tracking across embedded software.
Related talks
IoT Village·44 min
Parker Wiksell
Examines recurring vulnerability patterns, outdated third-party SDKs, and component reuse across IoT supply chains.
Creator Stage·43 min
Zoltan Balazs
Surveys pervasive architectural and implementation failures in consumer IoT gadgets, highlighting cleartext credentials, command injections, and insecure defaults.
Creator Stage·21 min
Larry Pesce
Demonstrates hardware disassembly, SPI flash extraction, and JTAG interfacing to build an accurate Software Bill of Materials for an IoT Wi-Fi router.