Abusing the Internet of Things

that the device is connected to the Internet, anyone in the world with access to a computer can potentially launch a targeted ea ...

FIGURE 3-1. Foscam baby monitor According to the researchers, an attacker who is able to determine the IP address of the baby mo ...

variety of filters. Shodan continuously locates and queries devices all over the Internet to index the services running on them. ...

FIGURE 3-3. Shodan query to locate Foscam devices on the Internet Exploiting Default Credentials Foscam devices were known to be ...

FIGURE 3-4. Foscam releases a firmware update that requires manual processes Exploiting Dynamic DNS In addition to the issues ar ...

This feature essentially allows every camera to update its IP address to point to a host- name of xx####.myfoscam.org (valid hos ...

The Foscam Saga Continues The Gilbert incident occurred in August 2013. In April 2014, another such incident occurred in the hom ...

FIGURE 3-5. Authentication bypass vulnerability posted on Foscam’s discussion forum The Belkin WeMo Baby Monitor The WeMo Baby m ...

FIGURE 3-6. The Belkin WeMo Baby FIGURE 3-7. The WeMo Baby iOS app THE BELKIN WEMO BABY MONITOR 69 ...

TIP The WeMo Baby has been discontinued by the manufacturer. However, it is used in many homes. Also, because the design and arc ...

To which the WeMo monitor responds: 1 0 urn:Belkin:device:wemo_baby:1 WeMo Baby Belkin International Inc. http://www.belkin. ...

</service> <service> <serviceType>urn:Belkin:service:firmwareupdate:1</serviceType> <serviceId>urn ...

<?xml version="1.0" encoding="utf-8"?> <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle= ...

SIP/2.0 100 Trying Via: SIP/2.0/TCP 10.0.0.2:59662;rport=4096;received=10.0.0.115; Record-Route: <sip:k2.k.belkin.evodevices. ...

a=rtpmap:3 GSM/8000 a=rtpmap:96 telephone-event/8000 a=fmtp:96 0-15 a=candidate:Ha000102 1 UDP 2130706431 10.0.1.2 3106 typ host ...

Hello Lon, Thanks for taking the time to review the WeMo Audio Baby monitor. We appreciate your security concerns and would like ...

4.Transmit the serialNumber and DeviceID to the malware author. As shown in the SIP requests discussed previously, this is the s ...

So how does this apply in the case of Belkin? Since we have studied the Belkin WeMo Baby in detail, let us look at another produ ...

FIGURE 3-9. The WeMo Switch app To locate the Switch, the app broadcasts the following SSDP request: M-SEARCH * HTTP/1.1 HOST:23 ...

LOCATION: http://10.0.1.8:49153/setup.xml OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01 SERVER: Unspecified, UPnP/1.0, Unspeci ...