Octavio Gianatempo & Octavio Galland: Hidden Vulnerabilities in IoT Devices
A DEF CON 30 talk about the hidden attack surface in consumer routers and other IoT devices. The researchers analyzed a popular home router and discovered a critical vulnerability — unauthenticated remote code execution requiring no user interaction.
The issue stemmed from a network feature in the Realtek SDK used in devices running eCos. The speakers show how they identified the root cause, built a method to automatically scan firmware for similar flaws, and explain why such vulnerabilities persist unnoticed across the supply chain.
The issue stemmed from a network feature in the Realtek SDK used in devices running eCos. The speakers show how they identified the root cause, built a method to automatically scan firmware for similar flaws, and explain why such vulnerabilities persist unnoticed across the supply chain.