As desktop and server security keeps raising the baseline for successful exploitation, IOT devices are still stuck in the 1990’s, despite their ubiquity in every home network. This, coupled with the trend of “monitor your devices from anywhere!”, is creating a time-bomb situation, in which millions of households are left vulnerable, regardless of any network security posture.
These topics will be examined using the “Circle with Disney” and Foscam devices as case studies. During the course of the vulnerabilty testing of these devices, over 50 CVEs were discovered, out of which, discussion will focus on the more novel attack techniques seen, including:
Finally, there will be discussion IOT device’s use of traditionally offensive tools (arp-poisoning, backdoors, and payload beaconing) for central functionality.