AI
IoT at Scale: 21 Billion Devices and One Terabit of Warning
21.1 billion connected IoT devices were online at the end of 2025, per IoT Analytics. That number is expected to nearly double by 2030. Mirai, a self-propagating worm from 2016, compromised over 600,000 routers and DVRs using just 64 default credentials and carried out the largest DDoS ever recorded at one terabit per second. A newer variant, Isuru, shattered that record with 29.6 terabits per second. Much of that traffic came from US-based ISPs. The 2019 iBaby camera breach showed the privacy dimension: one user’s credentials unlocked any other user’s live feed.
The Serial Protocols That Give Root Access
Three debug interfaces appear most often in IoT hardware. UART communicates over TX, RX, and a common ground at a fixed baud rate. If exposed on the board, it typically gives root shell access or a full firmware dump. JTAG was built for chip-to-chip boundary scan testing but also exposes CPU registers and memory, enabling GDB attachment to a live device. SPI connects microcontrollers to flash chips storing firmware and configuration data. An SOIC clip clamped to the chip’s legs reads that data without desoldering anything. Any one of these interfaces left exposed is a path to full compromise.
Building a Lab and Reading FCC Filings
The hardware list totals under $100. A multimeter identifies pins through voltage and continuity readings. A $15 logic analyzer decodes serial signals including UART and SPI captured directly from the board. A soldering iron taps into pads that aren’t otherwise accessible. FCC filings do much of the pre-work: any device sold in the US must disclose internal photos and RF test reports publicly. For the smart lock Cerne researched, the FCC filing showed the LoRaWAN antenna already labeled in the internal photos before any physical teardown.
Getting Firmware Off the Board
Getting firmware is the central goal. For the Yosmart hub, Cerne soldered to UART pins on the ESP32 using sewing needles as probes, then ran Picocom to read bootloader and application logs off the wire. A second path, off-chip extraction, uses a heat gun to desolder the flash chip and a universal programmer to read it directly. Once extracted, the image goes into Ghidra. ESP32 firmware runs on Xtensa processors, so the decompiler settings must match. String extraction first, then tracing logging functions through the binary, shows how the device constructs MQTT topics and handles credentials.
A Static Secret Baked into Every Firmware Image
The Yosmart hub used unencrypted MQTT for cloud traffic despite using an encrypted RF protocol for local device communication. UART application logs revealed a REST endpoint that returned the device’s MQTT credentials with no authentication, protected only by an MD5 hash. Ghidra showed that hash was computed from the device ID (derived from its MAC address) concatenated with a static secret hardcoded in the firmware. Every Yosmart hub shared the same secret. Anyone who knew another device’s ID could compute its hash, call the endpoint, and retrieve that device’s MQTT credentials.
An MQTT Broker with No Authorization
The credential endpoint was the lesser problem. The MQTT broker enforced no authorization controls for mobile application sessions. Any attacker with a valid login could send commands to any other Yosmart device, including smart locks protecting front doors. Device IDs were predictable: vendor OUI in the first three bytes, a fixed model code (1603 for the hub) in the middle, and sequential final bytes. Cerne disclosed mid-year, sent a physical letter when email went unanswered, then called. Yosmart eventually rotated the static firmware secret, added MQTT broker authorization, and moved cloud traffic to encrypted transport.
Q&A
How much hands-on hardware experience does IoT research require? None. Cerne started with no electrical engineering background, learned protocols from online documentation, and made his first physical connections without prior experience. ▶ 43:04
What hardware does someone need to get started? Under $100 covers the basics, including a multimeter, debug adapters, and a soldering iron. ▶ 44:18
Once firmware is extracted, how do you start the analysis? Load it into Ghidra or Binary Ninja, set the correct CPU architecture, start with strings, and find a logging function called throughout the binary to back-trace other functions from there. ▶ 45:46
Notable Quotes
kind of the crown jewel of IoT hacking. Nicholas Cerne · ▶ 8:53
Um, but don’t worry, it gets worse. Nicholas Cerne · ▶ 36:07
Um so it was it was pretty eye opening. Nicholas Cerne · ▶ 37:19
Key Takeaways
- FCC filings reveal internal component layouts and RF test reports publicly before you buy the device.
- A static secret baked into firmware means one reverse-engineering effort exposes every device of that model.
- An MQTT broker without per-session authorization lets any authenticated mobile client command any other user’s device.
- Under $100 in hardware and no electrical engineering background is enough to start finding real IoT vulnerabilities.
About the Speaker(s)
Nicholas Cerne is a Security Consultant at Bishop Fox, where he works on application penetration testing, hybrid application assessments, and cloud penetration testing. He also conducts IoT security research as a hobby and holds the Offensive Security Certified Professional (OSCP) certification.