DEF CON 33 - Smart Devices, Dumb Resets:Testing Firmware Persistence in Commercial IoT - Matei Jose
Source: YouTube · DEFCONConference · published Oct 10, 2025 · 28:57
Researcher demonstrates that retailers fail to implement proper security checks when reselling returned IoT devices, creating significant security risks where modified devices with backdoors can be sold to unsuspecting customers.
Key Takeaways:
• The researcher tested 5 retailers by modifying router firmware with backdoors, returning them, and repurchasing when resold. All retailers failed to detect the modifications, and 13 out of 15 backdoored devices were successfully repurchased.
• The backdoor was designed to make HTTP requests to a server with a 21-day self-destruct mechanism. This vulnerability extends beyond routers to almost any IoT device including vacuums and cameras.
• The most serious threat comes not from retailers but from malicious actors who could create fake online stores selling pre-backdoored devices at scale.
Consumers should avoid buying repackaged devices, and the security community should report firmware vulnerabilities even when physical access is required.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hello everyone. Thanks for being here. It's actually pretty cool because uh Sunday talks are a bit of a catch 22. Uh because on one hand we are not jet-lagged anymore, which is great. On the other hand, we're all exhausted from all the hacking and partying that's been going on these days, which is terrible. But still, I'm very very happy to be here and to see so many of you. This talk is smart devices dumb resets and it'll be a fairly short session about some of my experiments uh with various retailers and how they approach resetting devices before reselling them as repackaged, pre-owned or whatever other term they use uh for labeling stuff that's been well used and returned. The ones that really really makes me giggle is pre-loved. And I really hope that whoever used my robot vacuum befor…