CommSec D1 - Attacking IoT Speakers
summary
Analysis of Sonos and Bose shows unauthenticated HTTP APIs (notably port 1400 /status) leaking topology, accounts and current track info; over 5,000+ Sonos and ~1,500 Bose were internet-exposed. Scan results reveal nearby BSSIDs that are geolocated via Wigle to cluster device locations and one Colorado device is positively identified by email and address. Remote controls let attackers play arbitrary MP3s (ghostly script) and a malformed UUID crashes devices requiring reboot. Sonos patches remove some endpoints and hide emails but many devices remain exposed.
AI-written summary · about
chapters (12)
- 0:00Introduction and motivation
- 1:16Device discovery and initial scans
- 4:47Mapping exposed IoT speakers globally
- 9:14Geolocating devices via Wi-Fi scans
- 14:21Privacy risks and account data exposure
- 16:11Open APIs and security implications
- 18:37Demo of remote audio playback
- 21:15Exploiting API vulnerabilities
- 23:44Attack scenarios and phishing risks
- 25:11Hardware teardown and reverse engineering
- 28:12Vendor response and fixes
- 30:24Current exposure levels and Q&A
related talks
43mA 3-Year Tale of Hacking a Pwn2Own Target: The Attacks, Vendor Evolution, and Lesson Learneds
59mThe Internet of Pwned Things
30mVulnerabilities in the Internet of Things
39mVulnerabilities in Old Third-Party Software Components- Importance of Having SBoM for IoT/OT Devices
26mHacking buildings: Security flaws in embedded building control systems
01h 01mThe Internet of Pwned Things
40mWarezTheRemote? Under the Couch, and Listening to You
41mA Worm in the Apple: Wormable Zero-Click RCE in AirPlay... (Avi Lumelsky, Uri Katz)