Next-Gen IoT Botnets 3: Bad Implementations of Good Cloud Platforms
summary
Covers security flaws in cloud-based IoT platforms—specifically authentication bypasses, device tampering, and remote code execution—demonstrating how bad implementations let attackers control all vendor devices without scanning IP space. Discusses vulnerabilities in APIs, MQTT usage, and AWS S3 integration, with RCE demos that reference buffer overflows, ROP and command injection techniques.
AI-written summary · about
chapters (12)
- 0:00Start
- 0:52About us
- 2:51IoT from a penter's perspective
- 6:35A few words on 53 buckets
- 13:25Guardilla - Smart Security Camera
- 15:55Mobile app behavior
- 17:04Accessing the audio/vide
- 17:55Access to the audio/video feed the easy way
- 20:11Buffer overflow in the cloud agent-RCE
- 20:26More RCE: command injection
- 22:56iBaby Monitor
- 26:49End notes
related talks
31mNext-Gen IoT Botnets 3: Bad Implementations of Good Cloud Platforms
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions
25mTrust in the edge, trouble in the cloud
23mSmart Devices Gone Rogue: IOT Vulnerabilities and Designing For Security
32mCommon Attacks on IoT Devices
55mthe current problems with IoT security
49mxIoT Hacking Demonstrations & Strategies to Disappoint Bad Actors
37mSecurity Holes in the Integration and Management of Messaging Protocols on Commercial IoT Clouds