IoT companies lie all the time, and when they don’t lie they fail to implement proper security by some omissions or sloppy engineering. Either way, my opinion

IoT companies lie all the time, and when they don’t lie they fail to implement proper security by some omissions or sloppy engineering. Either way, my opinion is that IoT as the industry is a complete clusterfuck. Just an anecdote. I’ve reverse engineered a cat feeder with a camera some months ago. It did not claim any local storage, but it happily claimed all the standard bullshit about having the “military-grade” secure encryption. As a matter of fact, for whatever reason, they chose to not encrypt P- and B-frames, only I-frames (and audio). I’m not really an expert on video encoding but even I immediately understood that this is absolutely a bad idea, as all the motion vectors are right there in plain for whoever has access to the recording in the cloud (or wherever the appliance is told to upload, any S3-compatible storage works). Still, I don’t think it was malicious, just some engineer somewhere being very ignorant or not caring about the product (or probably both). They’ve been told to throw in encryption, they ticked that box. Now, the thing is, it seems to be based on a couple SDKs (a mix of Tyua and Goke stuff) that’s used by millions of devices - not just pet feeders but security and nanny cameras too. And while I don’t know for sure because it’s the only device with a camera I’ve worked on, I kinda doubt it’s a design error unique to my particular device or vendor. And I’m very sure it’s not an isolated incident. I had RE’d other devices that were using other SDKs and while none of the devices had any PII (like a video feed) because it was mostly lights - I have seen a lot of very sloppy engineering. Just that blast radius of a smart light is smaller so I had cared less. I wouldn’t trust any camera on the market unless it’s either vouched for by some hacker, or if manufacturer would explicitly recommend setting up a dedicated isolated VLAN for it, in a way it is never able to talk to anything outside my LAN.