Skip to content

IoT Village Keynote The Road To SOHOpelessly Broken

Ramgattie and Holcomb

The origins of the SOHOpelessly broken research and some of the new research from our new research lab.

Summary

### The Road to SOHOpelessly Broken: IoT Village Keynote At 00:00, Jacob Holcomb and Wick Ramgattie open the DEF CON 26 IoT Village with a keynote retrospective recounting the evolution of SOHOpelessly Broken, a landmark router hacking contest and consumer device security research initiative.

### Evolution of the IoT Village Platform At 05:00 and 10:01, the speakers chronicle the village's rapid growth from a modest hardware hacking experiment into an internationally recognized hub for embedded systems security. They detail the systematic testing methodology developed by Independent Security Evaluators (ISE) to assess small office and home office (SOHO) network hardware.

### Vendor Collaboration and Live Exploitation At 15:00 and 20:01, the presenters discuss bridging the gap between independent security researchers and commercial hardware manufacturers. By inviting prominent router and storage vendors (including Seagate) directly into the village, organizers created a collaborative environment where vendors could observe zero-day vulnerabilities demonstrated in real time.

### SOHOpelessly Broken 2.0: Persistent Software Flaws At 25:10, Holcomb and Ramgattie analyze recurring architectural flaws uncovered during contest iterations. Despite years of disclosure, commercial SOHO routers and network-attached storage (NAS) devices continue to suffer from elementary programming bugs, including unauthenticated command injection, hardcoded backdoors, and broken authentication handshakes.

### Promoting Mandatory Secure Development Lifecycles Concluding the keynote, the authors urge consumer electronics vendors to integrate automated static analysis, comprehensive third-party firmware auditing, and rapid vulnerability patching into their product lifecycles to protect consumers from widespread exploitation.

(AI summary — Gemini Flash)

Related talks

IoT Village·37 min

  • DEF CON
  • Policy
  • Date: Aug 2019
  • Location: Las Vegas

Elvis Collado

This talk is about how an unauthenticated heap-based buffer overflow vulnerability was discovered and exploited within a router distributed by a market-leading ISP. Despite the targeted process utilizing mitigations s...

iotexploitationdevice-hacking+2