[Music]
Press
[Music]
Start perfect so let me introduce you
these two gentlemen you can hear the
screen I'm always very happy when you
know when there are people that take a
long flight to present B work so before
we had a gentleman coming from Israel
with SC of far away these guys come from
us so let's cheers our American
colleagues
[Applause]
here to unmute this is one of my
favorite talk I got from a where cfp so
these guys basically I'm not going to
spoil everything but it's really a Funny
Story I mean there is a uh research
behind what they did but there is also a
interesting and curious story about
their work so I give you a stage and uh
enjoy good luck thank you Marco thank
you
oh immediately messes this
up okay uh thank you all um thank you
for the opportunity uh now no hat and
the sponsors um a conference wouldn't be
what it is without uh sponsors like this
it's really awesome to see a community
come together and uh thank you all for
your attention I know that we're the
only thing standing between um Awards
and drinking so I have captive audience
which is great um my name is Adam and
this is Matt and we're here to talk to
you today about um a our product our
time in a product review cabal and all
the uh bugs and malware that came with
it um so uh just a little bit about us
uh I run a team that focuses on um
optimizing security and making it more
efficient uh I also run uh my own
conference in the US um with several
members and uh pretty active in my
community um Matt he's uh been at Cisco
for almost over 16 years um Hardware
junkie uh forensics malware analysis uh
and uh he's the reason that I got into
home labbing in Hardware uh and I'm I'm
in I would qualify him as a junkie and
me as an En
Enthusiast and so before we get started
um just a quick bowler boiler plate uh
disclaimer all this work was done for
research purposes only um nothing we
discussed today is represented of either
of our employers views
opinions um and we ensure that every
review photo and video video that we
submitted were immediately taken down
and reported um this is platform
agnostic uh this affects all online
retailers not particular platforms um
despite us saying that we are a cabal we
we are an ethical cabal uh and um we're
definitely here in Italy uh for the
security despite how um appetizing our
slides
look that said here's today's menu
all right so first we're going to talk
about um how we got started and how we
formed the cabal uh and for our first
course we'll talk a little bit about
scaling the cabal and and noticing some
odd patterns in retailers uh and then
for our second dish we're going to do a
deep dive into some of our free products
hardware and software and then we'll
have a little uh uh you know fruit and
cheese and we'll talk about cautionary
tales of other products behavior and
lastly we're going to wrap up with um
how to purchase technology safely online
and kind of Lessons Learned
Matt yeah so how did this work how did
we end up with this this massive
wheelbarrow load of gear great
question so during the pandemic a lot of
people did a lot of things you know
everybody was wearing masks and
everybody was watching Netflix and
everybody was buying everything online
uh I was personally buying lots of smart
home stuff online I was stuck at home
doing we were just getting ready to do a
big REM model on our house and uh was
trying to find stuff to do since we
couldn't leave the house and do anything
so I started buying stuff from from
online retailers to work on my
house and uh it's amazing how effective
postcards can still be in in today's
society so one of these products I
bought from this company treat life it
had this little card in it and it said
oh thank you for buying our product we
are celebrating our company anniversary
and if you send us an email we will send
you a free switch we send you a free
Smart Switch and at that time this was
kind of expensive hardware and it's like
I everybody has a number and mine
happens to be more so uh I I respond to
them and I say hey I got this card and
and I'm I'm interested I'd love to get a
free switch they responded back oh we're
sorry we can't give you one free switch
how about we give you four and uh
so so we did and uh so then they showed
up and and this became a really
interesting deal because treat life had
this this um kind of relationship they
were wanting to establish with people
was hey you as a customer you go buy it
and then you send a a screenshot of your
receipt to the company and then they
will refund you via
PayPal and they may ask for a review but
treat life didn't force you to write a
review they would just say maybe you
consider writing a review and uh you
know maybe you you'll help us get our
our product to trend on retailers so
they they were trying to drive people
buying it and sometimes they would say
please don't go to the link for the
product please do a search for smart
home switch and and then click and buy
so we would buy it send them the
screenshot they would refund it and then
a few weeks later they would send
another email hey we have a new product
we'd like you to to be a VIP and Sample
and so this cycle went on and on over a
few weeks so um but then it comes back
to what what about more how do we get
this to scale I have a whole house I
have to set up and doing one at a time
doesn't work for me so think think like
a hacker so what do we do we we start
interacting I started interacting with
treat life with a couple different email
addresses like I would buy it and buy it
with a different uh retailer account and
I would send both of my screenshots in
separate emails and they would refund
both orders like oh what if I had more
email addresses and I could just buy
more and do more so but what I got to be
careful like what if they notice and
what if they what if they uh stop stop
working with me but do you think they
noticed they did not not at
all so it scaled significantly and this
is this is a little bit of what we got
there was a lot of stuff so lots of
smart home stuff lots of cameras uh
vacuum cleaner that's a big one the
vacuum map at the top projectors uh LED
strips lots of microcontrolled devices
lots of stuff it was
great and and this is where I can't come
into the story because uh friends were
jealous specifically me I was jealous I
was going to Matt was telling me hey
dude I got all this free stuff like look
at all this free gear and I said damn it
like how can I get some of this free
stuff and uh so he he he he started
replying to the people can I refer one
of my friends and some of them said yes
right away and so he would he would
refer them to me and then they they
would email me um others uh never
replied and so Matt started um
forwarding me their emails and I would
change you know um body headers Etc and
reply to them pretending to be Matt
Still um but we noticed we soon noticed
that um they didn't really care who
responded like not at all there's just a
huge Bank of people sending out the
emails they don't care if you if you
respond or not uh not only did they not
care um they like we realized like they
didn't even look at who they were
sending and stuff too um so this this is
where we started forming the cabal all
right and the cabal was essentially a
group of people home labers you know
people interested in hardware and and
well free stuff and uh we said okay
we're going to start just telling
everyone when we have an invite for
something we could say hey uh I got an
offer for a vacuum does anyone want me
to forward that to them and somebody
might say like uh no thanks I've got two
already uh somebody else might say yes
you forward it to them and they just
reply to the email as if it was sent to
them in the first place here's a real
example of Matt getting an email from uh
uh somebody ask telling him that he was
a victure VIP and um because of his VIP
status they they wanted him to go review
their product and they would send it to
him for free and so Matt forwarded it to
me and I just replied picture VIP here
I'm
interested and I got it
so uh that really started to escalate um
this is victure right here this is just
like a sampling of the emails I started
getting um and then the next one is
Amman uh that's how many I got from
Amman and then our favorite uh was treat
life right I mean treat life was one of
our favorites but they sent us so much
junk
and uh you know we get these emails and
so we go and get the products all right
right right right but but what about the
stuff yeah but what about the stuff you
know what let's uh dive deep into that
with
Matt introducing Chef Matt
vurus welcome to the Deep dive Cafe on
today's menu are the three T's Tekken
treat life and Toya camera Hardware
camera software and mesh routers yes
chef uh who's ready to taste some
delicious Hardware nuggets yes
chef so Tekken treat life and tuya so
these the the Tekken and uh and treat
life platforms use the tuya backend
ecosystem for bringing devices online
and and the application infrastructure
and everything uses the tuya backend and
tuya is evil if any of you are familiar
with tuya you know that if you don't
know tuya it's it's evil uh they collect
a lot of data during device registration
and user profile setup like your name
your phone number your email address
your uh SSID for your Wi-Fi and all that
gets stored and collected in plain text
uh over plain text and it's goes into a
giant database and any any 2A register
developer can access that database at
large so it's it's not like oh I'm I'm
from treat life and I get my slice no
you from treat life get the database and
if you from another vendor that's signed
on as a as a developer with TOA you get
the database as well so it's all out
there and it's all able to be mined and
and some of the scary things that are
potentially in that database Beyond like
your Wi-Fi username and password and all
that is the floor plant to your house
remember we had that vacuum a few slides
back those vacuums are on the 2y you
platform and the floor plan of your
house will be in that database so that's
interesting and then also if your lights
are on or off if you have a a iot
connected door lock that's through the
2u platform if your house is locked or
not these are things things that are all
in that database and all you have to do
to be a 2A developer is say I want to be
it it used to be free now it costs
around ,000,000 so it costs essentially
nothing to become a developer and the
way that tuya does a lot of onboarding
is they say hey if you would like to be
a developer with our platform bring your
devices that's fine we can give you some
firmware or we have these white label
devices would you like a camera or a
light switch or a light bulb or a what
ever we have these this catalog of
devices that we can monochrome with your
logo and you can sell it as as verus
Tech home automation and we'll do all of
the stuff so they make the onboarding
really easy and where where things get
interesting from an infos perspective is
they can push a firmware update anytime
silently so if you have a bunch of 2-e
devices in your house and you generally
think I know what they do I know how
they work I I trust them that could
change tomorrow they could push an
update that does something malicious
they could push an update to to uh that
that might include a vulnerability that
wasn't there before just having someone
else in total control of your software
ecosystem is super dangerous so um the
first wave of a lot of the devices we
collected were based on
esp8266 great microcontroller very open
architecture very well documented and
and lots of code out there for it so
that was that was great um then once we
we started kind of working with them at
at CCC um stiger wall a few years ago
had a post about a vulnerability that
his team found and there was a an
exploit that came out of that called to
you convert where you could take an A A
2 you device with an ESP controller and
you could flash it over the air to an
open source package it was very easy no
disassembly no soldering so that was a
thing that that a lot of people did and
and we saw that and did that and worked
with that quite a bit uh eventually that
that exploit was patched and then there
was a REV to the exploit and then it got
really patched where the key derivation
method changed and the keys were stored
on the server rather than on the device
so there's no way to figure out what the
key was through an exploit so that kind
of ended that and everybody was sad
and and then we we kept collecting
devices and uh there were some changes
to the hardware and this was interesting
because the the FCC documentation in the
US when you sell a device it has to be
registered with the FCC and they take
pictures and do all these things to
certify it and these uh these devices
from the the resellers and the 2A
platform they were making sub stantial
changes to the circuitry but they were
not updating the FCC documentation so
that was one interesting thing so you
would buy a light switch or a thing and
you would have to open it up to see what
actual Hardware it had even though it
would have the same secci ID as as an
older Hardware rev that had a different
chip in it completely so these these
second generation chips weren't by
espressive they weren't ESP uh esp8266
is they were actually based on beckin
silicon and uh
wb2scecuhvg out they are the same pinout
but they're not software compatible so
that was kind of sad and of course they
still use the 2yu platform so all the
evil things still apply but we did find
out that since they're pin compatible
with the ESP 12f and the ESP 32 C3 we
could use a hot air station and just
remove the beckin chip and put a
different chip on it that we could flash
our own software on and since we
controlled the software we could reset
all the all the gpios and make
everything work with open source code
like Moda or whatever it would it would
work with our code and and be off
platform um then with the the beckan
chips there was a lot of research and a
a guy named Kar and some others they
found a vulnerability in the beckon
chips to be able to remove the the keys
that are binding the the the
microcontroller to the 2u platform
binding it via the API there's a way to
write our own keys to the to the
microcontroller and then on our Network
we're able to address it via API since
we know the keys that it's using and
since we flashed the keys the the chip
itself is no longer in communication
with the tuya cloud so that was a big
thing for a while is called Cloud
cutting and then we would be able to use
the 2ya API locally to control the
device um still running generally uh
inefficient code and couldn't do a lot
of things we wanted to do but at least
it was local and out of the cloud and
and then shortly after that there was a
port of the ESP Home Project called
libertiny that that works on the beckin
chips and another software project
project called open beckon which also
runs on the the beckin chips and through
the cloud cutter exploit you're able to
flash both of those firmware packages
without soldering without disassembly so
it was a really great thing to be able
to take even these second generation
smart home devices and and second gen
cameras and devices and move them off of
the 2yo platform to code that we trust
so it was great and it was easy to flash
them with uart tools as well we made 3D
printed jigs where you could just push
it on the chip and Flash and Go or you
could flash over the air so it was a
great way to get these devices out of an
untrusted insecure ecosystem and brought
into local
control uh so moving on from the two-e
stuff into the cameras so we got cameras
from a lot of vendors from from victure
from voger from scam and uh some of them
had had okay firmware and but mostly the
firmware was not very good so the the um
a lot of the cameras had an interesting
app that you'd have to have to set it up
and very
uh very not not trusted app I would say
interesting wording interesting terms of
service and uh the cameras had long boot
times and of course lots of them were
still on the 2y you platform and there
were a lot of moving IP space we'll talk
about that a little bit but some in
China some on cloud providers but very
fluid where they were calling back to
now some of the cameras that weren't on
to you like scam it was really
interesting uh it had this this
peer-to-peer notion and one of the
challenges about a security camera CER
is if you put a camera up and you want
to connect to it from your mobile from
somewhere not at home you have to you
know Port do a port forward in your
router or do a static Gap map and there
are a lot of people that don't do that
that aren't computer Engineers aren't
computer savvy and they can't do that so
there's this interesting peer-to-peer
service that runs on the scam cameras
and on a lot of others and uh Paul Mar
PC there's a link here I would encourage
you to go watch that his video he did a
great job of it but the the gist of it
is the camera itself makes an outbound
connection to a P2P relay server and
then the app on your phone will also hit
that same P2P relay server and allow you
to ride that established connection from
your camera out you can ride it back in
so you can see your camera from anywhere
and that that doesn't sound like such a
bad thing except for one the traffic
isn't encrypted and two the relay server
is it's not just the relay servers
themselves to do the relaying but the
camera itself can be a super node so if
you are one of those people who is Savvy
you can configure a port forward put
your camera on the net with a valid port
forward and when it calls out to the P2P
server there's a very high likelihood
that your camera will be a super node
and your camera will be part of the P2P
Network and the the uh relay server will
tell other cameras that are in your Geo
it'll tell them to connect to your
camera rather than the super node so you
can sniff traffic from your own camera
and see lots of traffic to other cameras
so that's interesting but to be able
able to do the peer-to-peer connections
you have to have a a a unique ID a uid
and the uid is on a sticker on the
camera and the uid is also able to be
calculated by by doing some basic math
and and Mer PC has a tool to help you
figure out all the prefixes for all the
camera vendors and figure out how to
calculate all the uids so essentially if
you know someone's uid you can connect
to their camera with no other
authentication that's not good when you
set the scam camera up through their
provided app
it forces you to have the the
peer-to-peer connectivity on there's no
way to turn that off by default there's
no way to set the camera up apparently
from the app uh out of the box in an old
version of the app it has a local setup
mode where you could click it and it
would bring up a web if of the camera
but the current version of the app
doesn't do that so how do you get around
that well when you uh when you first
connect to the camera with your phone
it'll give you an address you have to
look at the address given to your phone
look at the Gateway and then browse to
the Gateway and it'll bring up the web
if of the camera then you can have it
join your Wi-Fi disable the P2P and and
move on but these are all things that I
would say normal users don't do they'll
just go through the app put it on net
and have this P2P thing running on their
Network and not even know it so big
exposure big threat service and uh lots
of lots of things that we can do to to
clean that
up so every camera connected out some
connected a little some connected a
whole lot there's a few interesting IPS
some out to China uh some out to Oracle
some out to AWS interesting things and
uh some of the cameras they worked with
varying degrees on local local protocols
like onvif and rtsp um the scam and the
fos cam worked the best but they still
had a lot of challenges in figuring out
how to do the substreams and how to get
you know things really optimized so uh
also one interesting thing on the fos
cam camera we had is it's running the
the 555 uh live 555 rtsp encoding binary
on it and it uh as you boot up it tells
you specifically what version it's
running it you have to connect to the U
port and and get into the the console
debug on the camera itself but once you
do that it tells you this is live 55
version you see it right there and you
troll around a little bit and you find
that that version is is vulnerable and
that there's xlit code out on GitHub and
if you take that code and point it at
that camera on the same net you'll be
dropped into a root shell on the camera
and it's it's right there and it works
perfectly every time and the camera I
had was fully updated with the latest
firmware from scam and I had no issues
doing this so one thing to know is that
there are lots of vulnerabilities I'm
sure there are more this is one that I
found that I wanted to call out and uh
so how do we go about fixing this how do
we go about containing these cameras so
there's a few things we can do um you
can do a DHCP reservation without a
Gateway know sometimes doing layer three
filtering or things like that is hard
it's really easy to just give a camera
an address and give it no Gateway and
it'll try to do things but it'll never
be able to reach out uh we can also do
like acl's or layer 3 firewalling other
things like that too um every camera
that I worked with had a uart or a j tag
available sometimes they were right
there and labeled sometimes they weren't
sometimes they were underneath of a a
carrier board for Wi-Fi i' have to
remove the Wi-Fi carrier board to get to
the U interface and then put it back on
with the wires kind of big tail at the
bottom um but every camera had that and
it was extremely useful there's a lot of
things you can do from from a uart
session I got some pictures we'll talk
about that in a minute
and uh one one definite thing I would
recommend is open firmware no matter
what you do to a camera running
untrusted software you you can't ever
you can't ever audit what it's doing
unless you do some crazy analysis so the
best option would be what if I could
just put some open source code on it so
open IPC and This rtsp Server are two
really good kind of maturing platforms
for uh for arm and for lots of other uh
chipsets and cameras where you can Flash
this software package and completely get
rid of everything that's there there are
some challenges getting it done making
sure you have compatible devices and
maybe working through some kernel
modules but the the GitHub uh pages are
really good supports really good there's
a really good community building around
this kind of Open Source firmware for
these very untrustworthy
devices uh so a little bit of more Deep
dive about the camera so on the on the
top left that's an scam camera and it
was very easy to get into just it was
harder to take it apart than anything
else but this is just a a BDM frame with
three Pogo pin probes you just drop them
on the right pins which you can find out
with a multimeter it's not very
complicated to figure out what's what's
uh txrx and VCC and ground and I think
this one was even labeled if I remember
right but it's it's a pretty easy
exercise and there's lots of videos on
how to do that and then from there able
to get into uboot and see what it's
doing from from being able to get into
uboot you can break uboot and then
change the change the bootstrap command
tell it to boot to a shell once you get
it to boot to a shell into clean otot or
into a clean shell you can do lots of
things like completely replace uboot
with a package from open IPC and then
from there it's fairly easy to flash
straight open IPC and there we are at a
root prompt on our camera that's now
running open source code so there's no
more P2P stuff it's straight rtsp we
know exactly what it's doing and we can
just work with the the open IPC group in
the community there to mature the
firmware and be a part of the community
and find a way to give back and make
everything
work yeah and this so that this is
cameras we talked a little bit about
other um uh Tekken tuya uh Etc um but
these vendors uh they were pushing
cameras a lot uh cameras a lot but then
also the other thing they were pushing a
lot was routing uh routers you know uh
Wi-Fi extenders Etc uh and it makes you
wonder right whether this was just
intentionally uh unsafe
products or if this was malicious and we
we got one for um this mesh routing
system here um and looking at it it was
really interesting the router
configuration requires a phone to set up
and uh they don't have a web interface
to the router um n map shows that we
have um three ports open uh up un PMP
UPnP on 5500 which is enabled by default
it's should be disabled obviously um the
app interface and then another port for
autoc configuring the Wi-Fi
repeaters
um the app uh the app used clear text
communication over Port 9000 to retrieve
the serial number and configure the
device and the serial number was your
unchangeable password being sent in
clear
text and uh the Android application like
if you take the APK that you are
supposed to connect with and actually um
and actually start analyzing that it
connects to a few places uh the router I
suppose that makes sense um number two
it reaches out to Facebook for some
reason like I don't know why Facebook
needs to know that you are now
online um but you know who does need to
know this random IP address right there
I wonder who that is I think we can all
guess it's China of course so uh this
router is calling out the China
um and letting them know that your
router in your house is now online so uh
you could feel safe knowing that another
country now knows that you are
online um so looking a little more into
the APK uh there was a few bits that um
started resembling some of these tenda
back doors in routers uh the um CGI bin
Lucy admin data uh data manager was
called out a few blogs um and looking
around and reading these articles I
unplugged it and and got rid of it so uh
this is something that clearly like they
were you know I don't there were issues
with this router itself in addition to
all of the other devices that we had
covered um and so now let's talk a
little bit about cautionary tales uh of
other products
[Applause]
Matt yeah so uh I live on a farm in the
US it's kind of large and I have Wi-Fi
everywhere like across 60
Acres and uh so over time I I I didn't
notice this one day it wasn't like oh I
did this and then this started just kind
of over time like there are these two
strange
ssids like ah and this is them wmb 07
fac like I remember it because I looked
for it for so long but uh didn't know
where they came from couldn't couldn't
correlate any any event with them
showing up and uh so I
investigated kind of for like a year and
a half busy and scatterbrained and so
it's hard to to Really dial in but when
I would connect to it there would be
nothing there and uh poor 80 would be
open it would give me a DHCP address and
then I would I would play around a
little and then nothing would show up
and it was uh it was a Azure wve device
and I so I thought one of my neighbors
did something to link between house and
barn and when the power would go out in
our neighborhood it would disappear when
the power would come back it would come
back and as but eventually it started to
cause me problems people would come to
my house and say oh I'm trying to
connect to your Wi-Fi it's open I see it
but I can't like like yeah it's it's not
mine I don't know what that is and
that's a bad look for a a computer
engineer a security post like hey what
are these weird Wii I don't
know so uh so finally uh I got a tool
called a dope scope and a dope scope
there's a picture of here and it's kind
of like a monocular and you look in it
it has an LCD screen and it'll show you
all the Wi-Fi networks and the BL
devices and it has an es32 in it so it's
a like a directional Wi-Fi and B signal
finder so I I'm going to find this thing
I get my dope scope and I go down to my
office and I'm I'm looking all around my
office and like it's got to be in this
looking around and it's it's up it says
up so I'm like in ceiling like there's
no there's no APS there's nothing there
there's no power there like there is
nothing there it's got to be up upstairs
and so I go up upstairs and I'm looking
all around looking and it's saying it's
like out the window and then if I go
over by the window it says it's another
it's all over the place I I cannot
figure it out so I I go into the
bathroom and I sit down on the edge of
the we have a big tub I sit down on the
tub and I'm holding the thing like this
I'm just like what what is this and then
I just kind of slide down and look and
it's it says it's right in front of me
through the wall right immediately
through the bathroom wall in the master
bedroom
is the adjustable bed
so now uh this is the offending Hardware
the base unit of our of our adjustable
bed now I I am not an idiot because I
did investigate this I did think that
could be it from the beginning but a few
things first I looked at the order when
we ordered the bed and I'm cheap so I
did not order the Wi-Fi enabled one
because who would need that and
certainly not me I did not order that so
it can't be that I didn't order it and
second I looked at the manual for the
bed and it says your there's a picture
the Wi-Fi module is here and it looks
like this so I get under the bed and
look and nope doesn't look like that not
at all so I I just wrote it off and
figured it's something else it is indeed
the bed I was able to connect join join
the device to my OT Network everything
worked great so the the moral of this
story is even if you have a product
that's trusted even if you know what it
is and what it does it can still act in
very strange ways and very strange
things can happen so be diligent be
mindful full and take security seriously
because I was nearly killed anyone could
have driven down the road and folded my
bed in half it's just a straight API
command could have just folded me right
in half so I'm lucky to be here speaking
with you today and uh please heed my
words when I found out about this I was
so mad cuz I wanted to be that guy to
fold you in
half uh yeah and as as we discussed we
also had we had lots of offers for
cameras and uh around this time I had
kids and I was getting baby camera
offers and I was putting them you know
setting them up and getting them ready
and they they were supposed to call out
to um uh my phone and I was supposed to
be able to connect to them and uh view
them through the app however uh one
random SSID showed up uh with a random
string of of characters and numbers it
had unauthenticated access it didn't
appear to do anything nor have any
standard ports um I had only plugged in
so many new things so I didn't need to
buy like an entire thing to figure this
out and I just figured out that it was
the uh baby monitors eventually um and
the solution was to return them all uh
buy one that actually says it has no
Wi-Fi on it and then verify that
product's claims so just uh to reiterate
Matt's Point Um this can happen uh
regardless of what you're buying if
you're buying something that's supposed
to uh just allow you to connect via an
app and view your your your kid um you
know watch out for um providing access
to your network that you don't know
about um great okay uh so now we're
going to wrap up and talk a little bit
about Lessons Learned and um and what we
have uh and and what we've learned and
what uh we can do to purchase things
online
safely uh so Matt mentioned white labels
before if if you've not heard of them
they're everywhere and uh this is kind
of what like our offers look like where
they they knew that they couldn't even
put a label on these cameras because
they could change tomorrow so they would
blur them out I don't know it's maybe
difficult to see from this uh from the
audience but those are blurred out
images of logos because they would just
laser on a new logo um for whoever
needed it and this happened often um
basically like a a brand would relabel
themselves if their storefront got shut
down right if their new egg or Amazon or
Walmart storefront got shut down because
people complained hey you're selling
junk and all your reviews are fake you
know and so they would just make a new
company a new LLC and then they would
jump through all the Hoops they
practically had it automated and now
this exact same camera is a different
different brand um often times the
firmware might even differ slightly like
have different names different um
versions uh but the hardware is exactly
the same with the same flaws and
vulnerabilities and just to reiterate
white label Hardware is often times
supplied by tuya which as we all know
now tuya is evil yes thank you crowd
participation great 10 out of 10
so I
got keep that energy up for the end
okay uh if something seems too good to
be true it probably is so always check
your Hardware that you're buying offline
in a safe environment before plugging it
into production Ops um be wary of online
reviews approach them with caution not
all of them are
legitimate this is how you could spot a
fake reveal if somebody's giving five
stars every time um they they leave
maybe very generic good but no detail
they're overly enthusiastic one way that
we spotted fake uh fake reviews was
exclamation points like nobody uses
those unless you're a teenager uh or
probably like an 8-year-old now right uh
and uh they always have a picture no
negative comments and then this is great
this is one that Matt found sometimes
they're not even related to the product
at all look at the title excellent
dimmer highly functional these are great
pictures of a dimmer but then the
description was my digital thermometer
is dependable and has great value those
aren't even related I don't know how
this one got approved but it's it's
approved and out there still so this is
a good way to spot a fake a review when
you're looking at a product keep these
in
mind um and just another note like these
uh groups um these apts of products if
you want to call them that uh they're
moving on to Facebook groups and some of
them are locked where they're going to
come out and say like Hey we're only
looking for people who live in Italy to
do this or we're only looking for people
in thaan to do this and so not only are
they sending out postcards emails but
now they're sending out like Facebook
requests
um one good thing here uh there are
vendors who do do it right um this is a
this is an example this is amrest I
wanted to give them a shout out they
offered me a research fee for produc for
purchasing and reviewing their camera um
they never asked for an online review
they only asked me to send feedback to
the product research email which I
gladly did I said this is a good camera
this is great this is great this could
use some work I don't like this part of
the app one thing that they thanked me
for was um I noted that their product
image had a read like a lens on the IR
sensor and uh the actual product didn't
so uh they thought that that was a good
oversight the product cost was only $80
but the research fee they sent me was
$140 and then um we were still able to
pass this around the cabal and get
everyone a free mcast thing so this is
an example of a vendor doing it
right um this is a global problem though
right it's not it's not tied to a
specific retailer or a specific country
or group of people um and the people
that suffer for the most are like local
shop owners and public service people um
we've been here for 4 days we went to
Switzerland uh we uh we did some
Northern Italy stuff and um we found a
few of these almost by accident uh this
is a uh local cathedral in
Lugano uh with a vulnerable camera um
this is a Gelato Cafe uh this is the
escam one right yeah this is the scam
one that Matt like pwned and uh with
other research but it's just up there to
monitor the
gelato um and then this one they had two
behind each of us uh at this pizza place
and that they have an unauthenticated
Tapo cam uh connection here which if you
have an unauthenticated camera that's
actively watching that's that's how you
end up watching us watch us watching us
so so the you know be vigilant out there
um make sure that you're you know
looking out for um people who aren't in
security uh you if if someone's saying
like hey I got this great deal because I
bought us this Wi-Fi camera for
€25 you know maybe say what brand is it
and and have you did any research um but
yeah that's it uh thank you all so much
for your attention
[Music]