Privacy News Hackers found 47 new vulnerabilities in 23 IoT devices at DEF CON

[Terry Ganzi]

The results from this year's IoT hacking contest are in and it's not a pretty picture

Smart door locks, padlocks, thermostats, refrigerators, wheelchairs and even solar panel arrays were among the internet-of-things devices that fell to hackers during the IoT Village held at the DEF CON security conference in August.

A month after the conference ended, the results are in: 47 new vulnerabilities affecting 23 devices from 21 manufacturers were disclosed during the IoT security talks, workshops and onsite hacking contests.

The types of vulnerabilities found ranged from poor design decisions like the use of plaintext and hard-coded passwords to coding flaws like buffer overflows and command injection.

Door locks and padlocks from vendors like Quicklock, iBlulock, Plantraco, Ceomate, Elecycle, Vians, Lagute, Okidokeys, Danalock were found to be vulnerable to password sniffing and replay attacks, where a captured command can be replayed later to open the locks.

A wheelchair from an unknown vendor had a vulnerability that could be exploited to disable a safety feature and take control of the device. A thermostat from Trane used a weak plain text protocol potentially allowing attackers to cause excessive heating, furnace failures or frozen water pipes by manipulating thermostat functionality.

Several security issues, including a hard-coded password, a command injection flaw, an open access point connection and a lack of network segmentation were found in a solar array management device from Tigro Energy.

You can catch the rest of this news here: Hackers found 47 new vulnerabilities in 23 IoT devices at DEF CON

 

[TheJokerz]

Wow whats next?

 

[Solarquest]

..even a wheelchair is/can be connected and can be hacked ???

 

[LabZero]

You can be skeptical or unaware about IoT security problems, but the reality is that it is necessary to intervene, starting from the security at the application level.

 

[Solarquest]

The security of IOT is a huge problem and security risk...I think it's only question of time till some big infection wave get them.
The real problem?
The real problem are companies that produce these devices without good, not even decent security.
I repeat since some time that these companies have to be FINED, with real fines, not simbolic ones every time devices are sold without or with insufficient security mechamism (e.g. with useless password e.g"password", no encryption, unpatched old bugs...).
In my opinion users have the right to get products that work AND that are secure AND kept secure.
Users need to "help" too.....they should change default passwords where possible (try to change it in your dryer, tv..) and probably to use "security boxes " as Bitdefender's and F-Secure's ones that should protect all devices behind a router.