DEF CON 33 - How Not to IoT:Lessons in Security Failures - Zoltan "zh4ck" Balazs
Source: YouTube · DEFCONConference · published Oct 10, 2025 · 43:29
The video examines critical IoT security vulnerabilities through real device testing, emphasizing the need for better security practices in the industry 0:20-0:24.
Key Takeaways:
• A cheap doorbell sends home Wi-Fi passwords through HTTP to unknown cloud servers 4:33-5:05
• The Echoax vacuum transmits Wi-Fi passwords via HTTP over open Wi-Fi during pairing 8:05-8:39
• An Android smart TV box falsely claims version 11.1 (which doesn't exist) and installs malware 10:58-12:04
• IP cameras remain vulnerable after a decade with unpatched authentication bypass and command injection issues 13:22-17:11
• A network storage device had basic command injection in its login page 28:14-29:18
The presenter advocates for better IoT security through Matter protocol, Zafir RTOS, Thread, Home Assistant, and RISC-V architecture rather than current vulnerable devices 36:57-39:03.
Sources:
- 0:20-0:24 Introduction to IoT security topics
- 4:33-5:05 Doorbell sending Wi-Fi passwords
- 8:05-8:39 Vacuum cleaner pairing vulnerabilities
- 10:58-12:04 Android TV box deception and malware
- 13:22-17:11 IP camera security issues
- 28:14-29:18 Network storage authentication flaw
- 36:57-39:03 Vision for better IoT security
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
All right. Are you guys ready? How was party last night? Did anyone party? Anyone hang over? Anyone still drunk? No. Okay. All right. Um, so today I'm going to talk about a cheap doorbell device I tested recently. uh an Echoax vacuum robot cleaner, a cheap Android smart TV box, uh a Zel Ness vulnerability, and uh how I believe IoT should work. So why did I create this talk? I think it's important to learn from the past mistakes. Uh you you are all aware of IoT devices, so I should not tell this to you. But uh still I think it's an important message. And uh beware of IoT developers if you are an IoT developer. Sorry. And know your IoT devices if you have at home. Uh who here does not have any smart device at home. Hands up. Okay. Okay. You are getting fewer and fewer every year. So this is …