#iot
-
CERT-UA: Attackers Hijack Dahua Cameras in Ukraine via P2P Service and Weak Authentication
Ukraine's computer emergency response team has warned of unauthorized access to Dahua IP cameras and video recorders. The main loophole is the Easy4IP cloud P2P service combined with predictable device serial numbers.
-
France's supermarket fridges sat exposed online for months
On the night of October 12, attackers pushed the refrigeration systems of hundreds of French supermarkets into defrost mode. IPinfo went through its weekly Internet scans and found France had more of these control panels exposed than the rest of the world combined.
-
Anthropic warns small AI models could self-replicate across IoT devices
Anthropic cautions that compact models capable of copying their own weights could give rise to a new generation of computer worms.
-
Three webOS flaws chain into local-network root takeover of LG TVs
A chain of three bugs gives an attacker on the same local network root access to certain LG smart TVs with no PIN and no action from the owner. LG has shipped a fix.
-
Cracking the Eufy Doorbell — From the Front Door to the Home Network
A biologist-turned-hacker from the Adepts of 0xCC collective spent his spare time taking apart the Eufy smart doorbell: jamming its link, reverse-engineering its sound-based pairing protocol, and pulling the hidden network's password straight out of a memory dump.
-
A software update from Samsung froze its own smart fridges
The company halted a SmartThings update in Korea after some owners found their fridges had stopped working entirely, spoiling the food inside.
-
US Justice Department Reworded Its Statement: Agencies Weren't Victims of Chinese Hackers, but Targets
The US Department of Justice has rewritten its press release about the cyber operation by the QTFY group: the agencies are now called “targets” rather than “victims” of the attacks. The change in wording indicates that only some of the organizations were actually breached.
-
Unitree G1 EDU Humanoid: Two RCE Chains to Root, One Over Bluetooth
Researcher Olivier Laflamme has disclosed two independent vulnerabilities in the Unitree G1 EDU robot that grant root privileges on its control computer. One of the attacks begins with ordinary BLE proximity.
-
Two Factory Implants with Root Access Found in ZBT Router Firmware
Researchers at VulnCheck have discovered two undocumented factory implants in the firmware of Chinese-made ZBT routers, giving an unauthenticated attacker remote command execution with root privileges.
-
Evooo1Bot: A New Linux Botnet Turns Routers into Proxy Nodes
A modular Mirai-based malware strain infects gateway devices and turns them into SOCKS5 relays, while also stealing credentials and taking part in DDoS attacks.
-
Zbtlink Routers Ship with a Factory Backdoor That Opens Passwordless Root Access
Researchers at VulnCheck have found a built-in backdoor in every firmware image from Chinese manufacturer Zbtlink: it hands an attacker an interactive root shell without any authentication whatsoever.
-
Tengu Botnet Reboots Linux Devices When Defenders Kill Its Process
A new Mirai-based botnet abuses the hardware watchdog: kill its main process and the infected device reboots, giving the malware a chance to start up all over again.
-
Vulnerability in Shark Robot Vacuums Allows Hijacking Other Devices Across an Entire AWS Region
A researcher going by the handle tokay0 has discovered and published a method for gaining root access to other people's Shark robot vacuums within a single AWS region. The manufacturer has yet to patch the vulnerability.