Smart Nest Thermostat: A Smart Spy in Your Home
summary
Researchers demonstrate full device compromise by using the TI SoC’s peripheral USB boot to upload a custom x‑loader and u‑boot, mount the filesystem and install a backdoored userland that survives reboots; they get root via USB in 15 seconds and run a dropbear SSH backdoor and custom graphics in the live demo. The exploit bypasses firmware signing by exploiting the boot ROM, exposes Wi‑Fi credentials and presence schedules, and targets the proprietary Nest Weave for later remote exfiltration.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:30IoT Security Landscape
- 5:42Nest Thermostat Analysis
- 7:42Hardware and Architecture
- 12:11Software and Firmware
- 16:07Identifying the Backdoor
- 20:03Attack Methodology
- 23:39Attack Implications
- 27:25Executing the Attack
- 30:10Live Demonstration
- 36:23Conclusion and Q&A
related talks
22mGoogle Nest Wifi Pro Bypassing Android Verified Boot
01h 06mBackdoors in Back Doors
52mIoT Hacking 101: Reverse Engineering The Xiaomi Ecosystem
21mIndustrial IoT security issues and countermeasures
43mThe Tao of Hardware the Te of Implants
30mCommSec D1 - How to Find and Exploit Bugs in IoT Devices
41mJailbreaking an Electric Vehicle in 2023 or What It Means to Hotwire Tesla's x86-Based Seat Heater
49mxIoT Hacking Demonstrations & Strategies to Disappoint Bad Actors