VULNtron: 4 CVEs Turn a Teleconference Bot into a Spy

Mark Bereza presents an in-depth vulnerability assessment of the Temi telepresence robot—an autonomous mobile video conferencing robot widely adopted in hospitals, corporate offices, and Southeast Asian enterprise environments [03:53]. Bereza demonstrates how chaining four distinct vulnerabilities across the Temi Android companion application, cloud messaging brokers, and backend REST APIs allows an unauthenticated remote attacker to completely hijack the robot, secretly control its motors, and stream video and audio without alerting occupants [00:17].

The vulnerabilities form an exploit chain that dismantles each security barrier in sequence. First, Bereza analyzes the integrated Agora Video SDK and discovers hardcoded credentials (CVE-2020-14470), specifically an Agora App ID deployed without token authentication [14:06]. Second, he exploits an origin validation weakness in the Temi Android APK, enabling arbitrary modification and repackaging of the application without client integrity checks [18:33]. Third, he identifies missing access controls on the Temi MQTT broker, where user topic identifiers were derived from simple MD5 hashes of user phone numbers, allowing attackers to subscribe to other users' call notification channels [21:39]. Fourth, he uncovers an authentication bypass in the Temi REST API (`syncContacts`), where manipulating owner IDs allowed an attacker to self-authorize as an administrator [26:01].

Bereza concludes with an end-to-end demonstration where a modified client connects to a victim robot, mutes the attacker's own microphone and camera feed, and silently navigates the environment while eavesdropping on confidential meetings [37:08]. The talk highlights the necessity of server-side authorization enforcement, dynamic token validation, and defense-in-depth in enterprise IoT robotics.

(AI summary — Gemini Flash)