Real-World Cases of IoT Device Vulnerabilities and Attacks

In this blog post, I will explore several real-world cases of IoT device vulnerabilities and attacks, and discuss the main vulnerabilities and attack vectors that were exploited.

At the end, please share if you think that these hacks were made possible through sloppy programming practices, poor standards, ignorance of risk… or something else?

Video Cameras

One example of an IoT device vulnerability was the incident involving Internet-connected video cameras made by Xiongmai Technology. In 2016, researchers discovered that the firmware of these cameras contained a vulnerability caused by the use of hard-coded login credentials.

This vulnerability was exploited in the Mirai botnet attack, which used a network of compromised IoT devices to launch distributed denial of service (DDoS) attacks.

Smart Locks

Another example of an IoT device vulnerability was the incident involving Internet-connected smart locks made by LockState. In 2018, researchers discovered that the firmware of these locks contained a vulnerability caused by the use of weak passwords and a lack of input validation. This vulnerability was exploited in a real-world attack, in which a hacker was able to remotely unlock the doors of a vacation rental property, potentially allowing unauthorized access.

Other examples of IoT device vulnerabilities include:

1. Internet-connected home routers made by Zyxel, which contained a vulnerability caused by a lack of authentication and input validation that was exploited in a series of attacks (2019)
2. Internet-connected smart plugs made by Gosund, which contained a vulnerability caused by a lack of authentication and input validation that was exploited in a real-world attack to remotely turn off the power to a home (2020)
   

Internet-connected security cameras made by Amcrest, which contained a vulnerability caused by a lack of authentication and input validation that was exploited in a real-world attack to remotely access the cameras and watch the live feeds (2020).

Other Attacks

1. Internet-connected smart thermostats made by Nest, which contained a vulnerability caused by a lack of input validation that was exploited in a real-world attack to remotely turn off the heating and cooling in a home (2021)
2. Internet-connected smart TV’s made by Samsung, which contained a vulnerability caused by a lack of input validation that was exploited in a real-world attack to remotely access the TV and use it to spy on the users (2021).

These cases demonstrate the importance of properly securing IoT devices to prevent unauthorized access and exploitation of vulnerabilities.

The main vulnerabilities that were exploited in these cases were a lack of authentication and input validation and the use of hard-coded login credentials and weak passwords.