The Internet of Pwned Things
summary
HaveIBeenPwned aggregates 9.3 billion records across ~425 breaches; CloudPets leaves voice files in a public S3 with references in an open MongoDB, exposing ~800,000 accounts and prompting ransom-deletes. Samsung washers broadcast SSIDs with a default password like 1111122222, enabling roaming connections; mitigation uses Ubiquity VLANs (VLAN 2, 192.168.2.x) plus firewall rules to block IoT→private. Kid smartwatches expose enumerable family IDs so attackers can relocate child via familyID and set parent numbers to call or listen. Toilets with Bluetooth lack auth and can trigger bidet/air functions.
AI-written summary · about
chapters (9)
- 0:00Start
- 20:00Ubiquity
- 20:53Security Gateway
- 21:59Wired Backhaul
- 24:26Iot Devices Introducing Vulnerabilities
- 27:12Routing and Firewall
- 31:01Dream Machine
- 34:01How To Remove a Network
- 46:42So They Ended Up Taking the Service Offline As Soon as We Report It to Their Credit They Had To Then Go and Explain to the Public What Had Gone Wrong Obviously no One's Watches Then Worked for a Period of Time and Then They Eventually Came Back Online and Got a Whole Bunch of Tests and Other Things Done for Them but for Me that the Thing That I Always Come Back to Is As Soon as You Connect Anything like this to the Internet You Will Always Have a Risk and Regardless of How Many Assurances You Get about Security
related talks
59mThe Internet of Pwned Things
48mLessons From Billions of Breached Records
47mLessons From Billions of Breached Records
46mKeynote: Lessons From 11 Billion Breached Records
01h 02mI’m Pwned. You’re Pwned. We’re All Pwned
30mVulnerabilities in the Internet of Things
40mSecurity/Privacy in the IoT generation
57mLessons From Billions of Breached Records