IoT Village Keynote The Road To SOHOpelessly Broken
The origins of the SOHOpelessly broken research and some of the new research from our new research lab.
Summary
### The Road to SOHOpelessly Broken: IoT Village Keynote At 00:00, Jacob Holcomb and Wick Ramgattie open the DEF CON 26 IoT Village with a keynote retrospective recounting the evolution of SOHOpelessly Broken, a landmark router hacking contest and consumer device security research initiative.
### Evolution of the IoT Village Platform At 05:00 and 10:01, the speakers chronicle the village's rapid growth from a modest hardware hacking experiment into an internationally recognized hub for embedded systems security. They detail the systematic testing methodology developed by Independent Security Evaluators (ISE) to assess small office and home office (SOHO) network hardware.
### Vendor Collaboration and Live Exploitation At 15:00 and 20:01, the presenters discuss bridging the gap between independent security researchers and commercial hardware manufacturers. By inviting prominent router and storage vendors (including Seagate) directly into the village, organizers created a collaborative environment where vendors could observe zero-day vulnerabilities demonstrated in real time.
### SOHOpelessly Broken 2.0: Persistent Software Flaws At 25:10, Holcomb and Ramgattie analyze recurring architectural flaws uncovered during contest iterations. Despite years of disclosure, commercial SOHO routers and network-attached storage (NAS) devices continue to suffer from elementary programming bugs, including unauthenticated command injection, hardcoded backdoors, and broken authentication handshakes.
### Promoting Mandatory Secure Development Lifecycles Concluding the keynote, the authors urge consumer electronics vendors to integrate automated static analysis, comprehensive third-party firmware auditing, and rapid vulnerability patching into their product lifecycles to protect consumers from widespread exploitation.
(AI summary — Gemini Flash)
Related talks
IoT Village·31 min
Erez Yalon
Cheaper devices that consume less power - What more can you ask for? SECURITY!. Based on multiple tests we have done across a variety of devices, we can conclude that there are still many vendors who lack the security...
IoT Village·38 min
David Tomaschik
In 2017, I discovered that a popular IP-based door access control system (badge reader and door lock controller) used poorly-implemented cryptography. Through binary analysis and live testing against a functional devi...
IoT Village·37 min
Elvis Collado
This talk is about how an unauthenticated heap-based buffer overflow vulnerability was discovered and exploited within a router distributed by a market-leading ISP. Despite the targeted process utilizing mitigations s...


