3 ms·

I was skeptical at first, but did some superficial scouting.. it's trivial for a malicious website to do nasty things to any internal resource which doesn't hav

I was skeptical at first, but did some superficial scouting.. it's trivial for a malicious website to do nasty things to any internal resource which doesn't have a strict CORS policy. https://security.stackexchange.com/questions/177486/can-websites-access-computers-in-lan-localhost-through-browser-how-to-block-th https://security.stackexchange.com/questions/177486/can-webs... As the adage goes, the "S" in IOT stands for "Security".

Retr0id 3y ago
Yes, I have (non-public) variations of the https://rootmy.tv/ https://rootmy.tv/ exploit that can fully compromise an LG smart TV from the browser session of any other LAN-adjacent device.
mewpmewp2 3y ago
But CORS is strict by default. They must specially add headers to allow such requests.