Presented at
DEF CON 26 (2018),
Aug. 11, 2018, 2 p.m.
(45 minutes).
While most IoT accessory manufacturers have a narrow area of focus, Xiaomi, an Asian based vendor, controls a vast IoT ecosystem, including smart lightbulbs, sensors, cameras, vacuum cleaners, network speakers, electric scooters and even washing machines. In addition, Xiaomi also manufactures smartphones. Their products are sold not only in Asia, but also in Europe and North America. The company claims to have the biggest IoT platform worldwide.
In my talk, I will give a brief overview of the most common, Wi-Fi based, Xiaomi IoT devices. Their devices may have a deep integration in the daily life (like vacuum cleaners, smart toilet seats, cameras, sensors, lights).
I will focus on the features, computational power, sensors, security and ability to root the devices. Let's explore how you can have fun with the devices or use them for something useful, like mapping Wi-Fi signal strength while vacuuming your house. I will also cover some interesting things I discovered while reverse engineering Xiaomi's devices and discuss which protections were deployed by the developers (and which not).
Be prepared to see the guts of many of these devices. We will exploit them and use them to exploit other devices.
Presenters:
-
Dennis Giese
- Hacker
Dennis is a grad student at TU Darmstadt and a researcher at Northeastern University. He was a member of one european ISP's CERT for several years.
While being interested in physical security and lockpicking, he enjoys applied research and reverse engineering malware and all kind of devices.
His latest victim is the Xiaomi IoT cloud. Hehas presented at the Chaos Communication Congress and the REcon BRX.
Links:
Similar Presentations: