DEF CON 33 - Gateways to Chaos - How We Proved Modems Are a Ticking Time Bomb - Chiao-Lin Yu
Source: YouTube · DEFCONConference · published Oct 10, 2025 · 39:44
Home modems and routers are "ticking time bombs" with numerous security vulnerabilities that hackers can exploit globally. Research uncovered multiple CVEs in devices from major manufacturers, with vendors often refusing to patch end-of-life products still widely deployed.
Key Takeaways:
• Vendors and ISPs frequently refuse to patch or replace vulnerable devices, leaving thousands exposed
• Critical infrastructure including water plants, smart grids, and government systems use these vulnerable devices
• Researchers discovered predictable passwords based on MAC addresses, allowing easy authentication bypass
• Unauthenticated configuration dumps revealed hardcoded backdoors that could control devices worldwide
• Many devices have UPnP enabled by default without authentication, allowing attackers to change settings remotely
The researcher developed a modem vulnerability scanner and emphasizes that users should treat their modems/routers as critical security devices.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Imagine you have a gun and your home modem loaded and facing global security. Gateways to chaos, Steven MW. Give him a big hand everybody. Good to see you. >> Yeah. >> Hello everyone. I'm very excited to share this topic with you today. Gateway to chaos. How we prove that the model are the ticking time bomb that hacker can assess everywhere. In this talk, we will share about many real world vulnerability and cases. This weakness could be happen in your own home. Let me quick introduce myself. My name is Yoing, but you can call me Steven Mao. I'm currently as a senior researcher at Ticoretting in Taiwan. I have several certifications including OSC3. I have also received several CVE from a big company like the VMware and Dink and Zel. I have given talk at event like the Bside Tokyo, Hik Hous…