Главная
Study mode:
on
1
Intro
2
Infrastructure
3
Firmware Updates
4
Firmware Update Process
5
Serial Debug Port
6
Breaking QNX SDP 6.5 License Management
7
Boot Me If You Can #2
8
Extracting the Neato IFS
9
QNX Boot Process
10
Secure Boot Bypass (CVE-2018-20785)
11
"BlackBox" Logs & Coredumps
12
RC4 For Beginners (CVE-2018-17177)
13
Generating and Interpreting Coredumps
14
Buffer Overflow Vulnerability
15
Controllable Registers
16
Vulnerable Function
17
Vulnerability Root Cause
18
Determining Factors for the Exploit
19
Our Exploit
20
Implications
21
Root Remote Code Execution via Cloud (CVE-2018-19442)
Description:
Explore the security vulnerabilities of smart vacuum cleaners in this conference talk from Easterhegg 2019. Dive into the process of exploiting Neato Botvac Connected firmware to control high-end vacuum cleaners. Learn about firmware extraction techniques, including overcoming proprietary chip layouts and QNX systems. Discover how buffer overflow vulnerabilities can lead to remote command execution with root privileges. Understand the implications of these security flaws on user privacy and home security. Follow the speakers' journey through firmware analysis, vulnerability identification, and exploit development, including their methods for overcoming obstacles in proof-of-concept creation. Gain insights into the potential risks associated with cloud-connected smart home devices and the importance of robust security measures in IoT products.

Smart Vacuum Cleaners as Remote Wiretapping Devices - Easterhegg - 2019

media.ccc.de
Add to list
0:00 / 0:00