3 ms·

I think it's safe to consider routers IoT devices, but I would suggest that basically any independent embedded device is an IoT device. Literally any "smart hom

• luckylion 5y ago
  They typically need exposure to the internet though, right? Or are they taking over e.g. update-delivery servers for IoT stuff and delivering their software that way?
  • beckler 5y ago
    That is one way. Generally there are several vectors when it comes to exploits. Like, is the git repo secure? Can we add code that allows a backdoor or reaches out to a command-and-control server? Or how are their packages secured? Can we upload a malicious one to their package repo? Is the distribution server secure? Are the devices exposed directly to a WAN? Can we sell knock-off devices or modify legit devices before we resell them? Can we design them from the beginning to be exploitable? Were the engineers lazy and implement zero security controls? etc, etc... This is why defensive security is rather difficult. You have to get everything right, but attackers only have to be right one time. Then when you get consumers involved, it becomes significantly more complicated and difficult. Some of these devices can stay active for years, and the owners realize no difference as long as it still works as expected.