TORCHLIGHT: Shedding LIGHT on Real-World Attacks on Cloudless IoT Devices
summary
Claim: attackers use Tor to anonymously exploit cloudless IoT devices. Built TORCHLIGHT—three low-cost VPS exit nodes, kernel IP-set filtering, and an ARM-based traffic analyzer that applies a chain-of-thought LLM verification workflow. Over 12 months TORCHLIGHT collects 26 TB, finds 45 vulnerabilities including 29 zero-day exploits (25 CVEs), estimates ~12.71M affected devices across 148 countries, observes >90,000 exploitation attempts, and reports $312k estimated market value; detection accuracy is >93% overall and 99% for injection.
AI-written summary · about
chapters (8)
- 0:00Cloudless IoT attacks intro
- 1:41Hackers use Tor for IoT exploits
- 3:28TorchLight system design
- 8:12TorchLight detection accuracy
- 8:56Most targeted IoT devices
- 10:23Vulnerability severity and prevalence
- 11:25Real-world IoT infiltration case
- 12:28Conclusion
related talks
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions
13mThe dark side of IoT
32mCommon Attacks on IoT Devices
25mTrust in the edge, trouble in the cloud
29mUnderstanding the IoT Threat Landscape
47mTrend Micro's VP of security research reveals the latest IoT threats and how to combat them
23mSmart Devices Gone Rogue: IOT Vulnerabilities and Designing For Security
49mxIoT Hacking Demonstrations & Strategies to Disappoint Bad Actors