Finding Vulnerabilities in IoT Embedded Devices Using Linux OS and Open Source Tools
summary
A reproducible method for finding Z‑Wave flaws using only Linux, Python and a Yardstick USB dongle that fuzzes protocol fields rather than random bytes, producing V‑Fuzz artifacts available on iotcube.net and yielding 18 CVEs coordinated with CERT/MITRE and vendors. Demonstrated results include remote DoS of hubs, injecting rogue devices to steal or delete keys and properties, crashing PC controller software via the USB stick, and practical mitigation paths (IDS anomaly detection, vendor patches).
AI-written summary · about
chapters (16)
- 0:00Smart home security research intro
- 1:03Z-Wave security context
- 3:53Why Z-Wave replaced others
- 9:10Smart home device security challenges
- 14:08Finding Z-Wave vulnerabilities
- 15:53Introducing V-Fuzz fuzzer
- 17:16Tools for vulnerability testing
- 19:03Denial-of-service demo
- 20:48IoT attacks on IT systems
- 22:13Malicious payload injection test
- 26:08Injecting fake devices and stealing keys
- 28:53Memory overwrite and reset flaws
- 30:39Countermeasures and vendor work
- 32:25Lessons for IoT manufacturers
- 33:29Open-source tools and research
- 34:32Question and answer session
related talks
44mNight of the living vulnerabilities
27mWIFI-Important Remote Attack Surface: Threat is Expanding
31mIoT Bug Hunting: From Shells to Responsible Disclosure
39mVulnerabilities in Old Third-Party Software Components- Importance of Having SBoM for IoT/OT Devices
30mCommSec D1 - How to Find and Exploit Bugs in IoT Devices
32mCommon Attacks on IoT Devices
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions
39mNight of the living vulnerabilities