The Internet of Pwned Things

on YouTube ↗59m

" summary

Shows concrete breaches: a stuffed toy maker leaves a open MongoDB no password and voice files in an unencrypted S3 bucket, exposing >800,000 accounts and recoverable recordings; attackers use Shodan to drop ransom messages and swap Bitcoin addresses. A Bluetooth pairing on toys has no PIN, letting strangers stream audio or push messages. A child-tracking watch exposes enumerable family IDs so anyone can pull locations, spoof a child’s position or call them. Demonstrates VLAN isolation and firewall rules as effective mitigations.

AI-written summary · about

" chapters (11)

1. 0:00Start
2. 6:22Cloud Pets
3. 20:49Cloud Key
4. 26:46Firewall Rules
5. 29:23Deep Packet Inspection
6. 32:36How To Remove a Single Network from an Ios Device
7. 33:02Washing Machines
8. 33:47Helicopter Parent
9. 52:52How Do You Remove Yourself from the Database
10. 53:37Ashley Madison Data Breach
11. 54:17Adult Friend Finder

" related talks

• 01h 01mThe Internet of Pwned ThingsTroy Hunt · NDC Security Oslo 2020
• 30mVulnerabilities in the Internet of ThingsKen Munro · IoTSF Conference 2015
• 47mLessons From Billions of Breached RecordsTroy Hunt · Security Visionaries 2022
• 48mLessons From Billions of Breached RecordsTroy Hunt · GOTO Copenhagen 2022
• 37mLocknote: The Internet of Pwned ThingsTroy Hunt · NDC TechTown 2019
• 46mKeynote: Lessons From 11 Billion Breached RecordsTroy Hunt · Black Hat Asia 2021
• 59m50 Shades of AppSecTroy Hunt · NDC Sydney 2016
• 01h 02mI’m Pwned. You’re Pwned. We’re All PwnedTroy Hunt · NDC Sydney 2018