Abusing the Internet of Things

</service>

<service>

<serviceType>urn:Belkin:service:firmwareupdate:1</serviceType>

<serviceId>urn:Belkin:serviceId:firmwareupdate1</serviceId>

<controlURL>/upnp/control/firmwareupdate1</controlURL>

<eventSubURL>/upnp/event/firmwareupdate1</eventSubURL>

<SCPDURL>/firmwareupdate.xml</SCPDURL>

</service>

<service>

<serviceType>urn:Belkin:service:rules:1</serviceType>

<serviceId>urn:Belkin:serviceId:rules1</serviceId>

<controlURL>/upnp/control/rules1</controlURL>

<eventSubURL>/upnp/event/rules1</eventSubURL>

<SCPDURL>/rulesservice.xml</SCPDURL>

</service>

.

<service>

<serviceType>urn:Belkin:service:metainfo:1</serviceType>

<serviceId>urn:Belkin:serviceId:metainfo1</serviceId>

<controlURL>/upnp/control/metainfo1</controlURL>

<eventSubURL>/upnp/event/metainfo1</eventSubURL>

<SCPDURL>/metainfoservice.xml</SCPDURL>

</service>

<service>

<serviceType>urn:Belkin:service:remoteaccess:1</serviceType>

<serviceId>urn:Belkin:serviceId:remoteaccess1</serviceId>

<controlURL>/upnp/control/remoteaccess1</controlURL>

<eventSubURL>/upnp/event/remoteaccess1</eventSubURL>

<SCPDURL>/remoteaccess.xml</SCPDURL>

</service>

.

</serviceList>

<presentationURL>/pluginpres.html</presentationURL>

</device>

</root>

Note that the WeMo device returns the value for the serialNumber again, which is the
same as in the response to the SSDP query. The response also includes various additional
services, the most interesting of which is /upnp/control/remoteaccess1. The iOS app sends
the following POST request to this service to obtain authorization to connect to the WeMo and
listen in to the audio:

POST /upnp/control/remoteaccess1 HTTP/1.1

Content-Type: text/xml; charset="utf-8"

SOAPACTION: "urn:Belkin:service:remoteaccess:1#RemoteAccess"

Content-Length: 589

HOST: 10.0.1.2:49153

User-Agent: CyberGarage-HTTP/1.0

CHAPTER 3: ASSAULTING THE RADIO NURSE—BREACHING BABY MONITORS AND

(^72) ONE OTHER THING