Hacking Smart Devices for Fun and Profit

Barak Sternberg presents research into smart building automation ecosystems, focusing on devices manufactured by HDL Automation and their cloud control platform, HDL On Pro [08:52]. While smart buildings often isolate physical controller hardware on local serial buses like RS-485 and Dynet [04:20], modern deployments increasingly rely on cloud-connected bridge controllers to allow remote management via mobile applications [12:57]. Sternberg demonstrates that rather than spending weeks reverse engineering local hardware, auditing cloud APIs and web services often reveals severe vulnerabilities that expose thousands of physical buildings globally [17:12].

The talk details multiple critical vulnerabilities uncovered across the HDL cloud infrastructure. Sternberg explains a broken authentication flaw in the password reset endpoint where tampering with the email parameter allowed an attacker to reset any registered user's credentials and take over their account [21:26]. Additionally, he highlights SQL injection vulnerabilities within public API endpoints—specifically the `device by region list` endpoint—that allowed exfiltration of sensitive database records, user profiles, and device registration tokens [25:44]. Insecure direct object references (IDOR) further permitted attackers to scrape customer records and link users directly to their physical devices [34:32].

Sternberg shows how these vulnerabilities can be weaponized into physical attacks against smart facilities, demonstrating how an attacker can hijack smart home configurations, link lighting switches to blast HVAC heating up to 45°C, and disable intrusion sensors [38:44]. The presentation concludes with a review of the responsible disclosure process conducted with HDL Automation, outlining the remediation steps implemented to secure the cloud platform and offering defense strategies for IoT cloud architectures.

(AI summary — Gemini Flash)