Pwning Smart Weighing Machines wt API & Hardware Hacking
summary
Analysis shows two distinct failures: the Chinese OEM uses MAC addresses as authentication secrets and an SQLi on the API lets an attacker enumerate >200,000 device MACs and use them to bind devices to an attacker account, while a European Withings WBS06 exposes a UART debug shell (discovered via FCC photos and a pulled firmware) that yields certificates and private keys. Methods include decompiled Android app inspection, Ghidra reverse engineering, firmware download via API, and a FT232 UART probe. One flaw enables takeover of >1,000,000 devices; vendors patch within days.
AI-written summary · about
chapters (11)
- 0:00Introduction to hardware hacking
- 1:48Hardware authentication overview
- 5:07Factory-level authentication
- 8:05User-to-device association
- 10:15Shared vulnerabilities in OEMs
- 11:38Analyzing local attack surfaces
- 18:10Firmware reverse engineering
- 20:06Hardware shell access
- 28:03Authentication logic flaws
- 30:46Impact and disclosure
- 32:27Methodology and takeaways
related talks
45mOutside the box: pwning IoT devices through their applications
01h 01m(In)Security of Medical Devices
58mBreaking Bad: Stealing Patient Data Through Medical Devices
52mIoT Hacking 101: Reverse Engineering The Xiaomi Ecosystem
01h 01mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
01h 06mBackdoors in Back Doors
30mUnfit Story of Fitness Trackers: Hacking BLE Fitness Trackers
30mCommSec D1 - How to Find and Exploit Bugs in IoT Devices