5 Years of IoT Vulnerability Research and Countless 0-Days
Jay Balan shares insights from five years of IoT vulnerability research, demonstrating authentication bypasses, root shells, and practical disclosure lessons.
Summary
Reflecting on Five Years of IoT Vulnerability Research
Over half a decade of auditing connected consumer and enterprise IoT hardware reveals persistent, repeating classes of security flaws across product generations.
Demonstrating Real-World 0-Day Exploit Chains
Jay Balan walks through multiple live exploit demonstrations—including pre-authentication memory corruption, hidden debug APIs, and cryptographic bypasses.
Why Old Vulnerabilities Refuse to Die in IoT
Balan analyzes the commercial dynamics and supply chain pressures that cause vendors to repeatedly clone unpatched legacy codebases into new device models.
A Roadmap for Getting Started in Hardware Research
The presentation provides aspiring vulnerability researchers with essential lab tooling, static analysis workflows, and coordinated disclosure strategies.
Related talks
IoT Village·52 min
Tranewreck
Analyzing hardware vulnerabilities and firmware flaws discovered in connected smart home thermostats and HVAC controllers.
Creator Stage·43 min
Zoltan Balazs
Surveys pervasive architectural and implementation failures in consumer IoT gadgets, highlighting cleartext credentials, command injections, and insecure defaults.
Village Interviews·< 1 min
A fast-paced look at the IoT Village at DEF CON 33, highlighting router hacking challenges, zero-day labs, and device auditing.