AI
Pairing Vulnerabilities: Wi-Fi Passwords in the Clear
A $30 doorbell sent debug logs over HTTP to an unknown cloud server. The log contained the home Wi-Fi password. The vendor never responded, and no CVE has been issued. An Echoax vacuum cleaner paired by having the phone connect to the device’s open Wi-Fi access point and then send the password over HTTP. Only local attackers can sniff that traffic. Balazs reported the issue to the vendor, who claimed a fix after 5 months. Re-testing showed no fix. CVE-2025-XXXX was assigned.
The Android TV Box That Installed Malware
A cheap Android TV box from AliExpress advertised Android version 11.1. No such version exists. The build.prop file showed a security patch date of 2017, while Android 11 shipped in 2020. After operating for a while, the box downloaded firmware updates that installed malware. The device is always on and rarely monitored, making it a perfect hiding spot for crypto miners or botnet agents. Balazs found no way to opt out of these updates.
The IP Camera That Keeps on Giving
A 10-year-old IP camera runs a GoAhead web server with a known vulnerability published in 2004. The device ships with Telnet enabled on default credentials, a web port exposed via UPnP, and a cloud connection that wraps all local vulnerabilities. An unauthenticated request to /system.ini reveals the admin password and Wi-Fi password in cleartext. Researcher Paul recently counted 2.2 million of these cameras still online. Balazs found source code from a similar doorbell showing a stack overflow in the username field — no length check, just strcpy.
The Login Page Command Injection
A Zyxel NAS authentication library piped /etc/passwd through cut and grep, then concatenated the user-supplied string without sanitization. The result was passed to a shell command. This is pre-authentication command injection. Balazs summed it up: “you only had one job.” The vulnerability was being exploited in the wild before he bought the device. He found the code in the firmware and confirmed it. No patch was available at the time of the talk.
Building a Better IoT
Balazs recommends Zephyr RTOS because it is not Linux — no shell means no command injection. The Matter application layer protocol lets users control devices from any ecosystem without vendor-specific apps. Thread handles battery-powered devices with mesh networking. Home Assistant runs locally, private, with no cloud dependency. RISC-V CPUs are open, cost-effective, and performant. The recent Y Hacker Conference badge includes Thread and Matter support, which Balazs sees as proof these standards are ready for mainstream IoT.
Q&A
Has there been any research into dynamic gadget finding for memory corruption exploits on unknown IoT devices? You need the binary to run a gadget finder, but if the device is unknown you cannot get the binary without first hacking it — a chicken-and-egg problem. ▶ 42:26
Notable Quotes
it was sending my home Wi-Fi password through HTTP to an unknown cloud server Zoltan “zh4ck” Balazs · ▶ 05:01
you only had one job like I understand command injection after authentication … but on the login page please please don’t Zoltan “zh4ck” Balazs · ▶ 29:00
it has all the vulnerabilities what you have to test for if you are looking for IoT vulnerabilities Zoltan “zh4ck” Balazs · ▶ 13:57
there’s no shell which means no command injection. So that’s great. Zoltan “zh4ck” Balazs · ▶ 36:55
Key Takeaways
- Five cheap IoT devices had vulnerabilities exposing Wi-Fi credentials via HTTP or open Wi-Fi.
- IP cameras from 10 years ago still ship with known vulnerabilities and 2.2 million units remain online.
- Pre-auth command injection in a Zyxel NAS login page shows even basic authentication can be broken.
About the Speaker(s)
Zoltan “zh4ck” Balazs is a Principal Vulnerability Researcher at CUJO AI, focusing on smart home security. He previously worked as a CTO, IT security expert, and senior consultant. He developed the Hardware Firewall Bypass Kernel Driver (HWFWBypass), the Encrypted Browser Exploit Delivery tool (#IRONSQUIRREL), and a sandbox tester. His code ended up in a botnet infecting 600,000 IP cameras. He holds OSEP, OSED, OSCE, OSCP, and OSWP certifications.