How and Why Do the Bad Guys Attack Embedded Products?
summary
Embedded devices are attacked via concrete, repeatable paths: a vacuum cleaner with the vacuum cleaner camera pin validated only in app exposes its video stream over a simple HTTP request and is shown used in real attacks; home routers get hijacked to exfiltrate credentials; ATMs are infected by booting malware from USB or CD and triggered by keypad sequences; nation-state wipes target flash on satellite modems. Attack motivations include cheap botnets and DDoS for €10, crypto mining, espionage and theft. Risk analysis steps: define scope and assets, map attack surface and data flows, score likelihood and impact, then prioritize fixes (disable interfaces, encrypt, code review).
AI-written summary · about
chapters (15)
- 0:00Welcome
- 1:04Real-world attacks
- 4:46Motivations behind attacks
- 8:08Targeted vs untargeted
- 11:02Evolution of threats
- 13:14How attackers compromise
- 14:22Risk analysis under CRA
- 15:48Product scope and assets
- 18:23Threat analysis review
- 22:34Risk likelihood and impact
- 25:45Mitigating top risks
- 27:51Documenting risk assessments
- 29:16Resources for risk management
- 31:25Summary
- 33:11Q&A
related talks
32mCommon Attacks on IoT Devices
23mYour xIoT Devices Are Under Attack: Why everything connected is now a target
23mSmart Devices Gone Rogue: IOT Vulnerabilities and Designing For Security
29mSecuring IoT/OT Against Modern Threats
41mPanel: Tackling Automotive Hardware Vulnerabilities
21mIndustrial IoT security issues and countermeasures
27mProtecting Data In-Use from Firmware and Physical Attacks
20mHacking Exposed -- Embedded