Night of the living vulnerabilities
summary
A security review of dozens of IoT products finds textbook bugs reappearing: format string bugs, plain buffer overflows and hardcoded credentials like default user: default_user / robotics, plus an FTP updater that disables authentication for five minutes. An industrial robot running VxWorks exposes symbols and lacks ASLR/stack protections so a working exploit is developed. Internet scanning finds 85,000 devices exposed with ~5,000 lacking passwords. Tooling gaps appear too: GCC on ARM disabled canaries until recently and sanitizers/fuzzers are often hard to run on embedded targets.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 1:00Smart devices
- 2:07Other devices
- 3:10Robots
- 4:39University examples
- 5:08Remote code execution
- 5:57Post device buffer overflow
- 6:25What not to do
- 6:54B1F
- 7:48Manual
- 13:12Vixx
- 15:09The good
- 18:48Brainstorming
- 19:21How will you fix it
- 22:16Countermeasures
- 23:45Security features
- 25:27The IOT community
- 28:51Texas Instruments ID
- 31:20Buffer Overflow
- 31:37JSON Parser
- 32:35Tools
- 33:55Solution
- 35:08Why are you so compiler
- 37:15Solutions
- 39:59Documentation
- 40:58Books
- 41:11Conclusion
related talks
39mNight of the living vulnerabilities
39mVulnerabilities in Old Third-Party Software Components- Importance of Having SBoM for IoT/OT Devices
23mSmart Devices Gone Rogue: IOT Vulnerabilities and Designing For Security
49mxIoT Hacking Demonstrations & Strategies to Disappoint Bad Actors
45mOutside the box: pwning IoT devices through their applications
43m50 Shades of AppSec
17mEmbedded Security's Weakest Link: Lessons From Simple Mistakes
35mPatterns and Anti-Patterns in Embedded Development: What Security Incidents...