IoT From DVRs to Dildos

### Expanding IoT Vulnerabilities Beyond Mirai At 00:00, Andrew Tierney and Ken Munro of Pen Test Partners open with a critique of post-Mirai security discussions. While the industry became fixated on simple default Telnet credentials, the speakers emphasize that commercial IoT security remains fundamentally broken across much deeper architectural layers: insecure Bluetooth Low Energy (BLE) implementations, unprotected local API endpoints, unencrypted mobile app telemetry, and flawed cloud backend integrations.

### Reverse Engineering Smart Adult Devices At 06:12 and 12:40, the speakers explore their vulnerability research into internet-connected and Bluetooth-controlled adult novelty devices (including smart vibrators and remote chastity cages). They demonstrate that consumer products handling exceptionally intimate personal data frequently feature negligible security engineering. Teardowns revealed that many devices broadcast predictable BLE advertisements without pairing authentication, allowing anyone within radio range to intercept telemetry, hijack motor controls, or track device usage patterns.

### Eavesdropping on Intimate Sensor Telemetry At 18:05, Tierney shares case studies where adult toys incorporated integrated temperature sensors, accelerometers, and live audio chat features. Due to lack of Transport Layer Security (TLS) and insecure cloud storage buckets, live audio streams, usage timestamps, and battery telemetry were transmitted unencrypted across the Internet. An eavesdropper on the same Wi-Fi network could intercept private audio recordings and reconstruct intimate personal habits in real time.

### Insecure Cloud APIs and Account Takeover At 24:50 and 30:15, Munro dissects the web APIs that support mobile companion applications. The team identified pervasive Insecure Direct Object Reference (IDOR) vulnerabilities, missing rate limits, and unauthenticated API endpoints that allowed researchers to enumerate user accounts, access registered email addresses and location logs, and send remote control commands to arbitrary devices worldwide without authorization.

### Ethics, Intimate Privacy, and Responsible Disclosure Concluding from 33:10 to 36:19, the presenters discuss the complex ethical and privacy considerations unique to adult IoT technology. They recount the frustrating experience of attempting responsible vulnerability disclosures to vendors who lack security contact channels or deny liability. Munro and Tierney argue that because intimate IoT devices present genuine physical, emotional, and privacy risks, researchers must aggressively hold manufacturers accountable to baseline data protection standards.

(AI summary — Gemini 3.8 Flash)