Next-Gen IoT Botnets 3: Bad Implementations of Good Cloud Platforms
summary
Examines insecure implementations of IoT cloud platforms (including APIs, MQTT and AWS S3) that enable large-scale compromises such as authentication bypasses, device tampering and remote code execution. Describes how flaws in cloud integrations let attackers reach all vendor devices without scanning IPs, and includes demos of RCE and tampering techniques; assumes familiarity with networking, API/MQTT/S3 interactions and optional exploit concepts (buffer overflows, ROP, command injection).
AI-written summary · about
chapters (12)
- 0:00Start
- 0:52About us
- 2:51IoT from a penter's perspective
- 6:35A few words on 53 buckets
- 13:25Guardilla - Smart Security Camera
- 15:55Mobile app behavior
- 17:04Accessing the audio/vide
- 17:55Access to the audio/video feed the easy way
- 20:11Buffer overflow in the cloud agent-RCE
- 20:26More RCE: command injection
- 22:56iBaby Monitor
- 26:49End notes
related talks
31mNext-Gen IoT Botnets 3: Bad Implementations of Good Cloud Platforms
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions
25mTrust in the edge, trouble in the cloud
23mSmart Devices Gone Rogue: IOT Vulnerabilities and Designing For Security
37mSecurity Holes in the Integration and Management of Messaging Protocols on Commercial IoT Clouds
32mCommon Attacks on IoT Devices
55mthe current problems with IoT security
49mxIoT Hacking Demonstrations & Strategies to Disappoint Bad Actors