Tag
安全研究人员详细讲述了提取并逆向分析 Eufy HomeBase 2 固件的过程，包括通过 SPI 读取闪存（并意外损坏芯片）、逆向 Wi-Fi 凭据生成算法，以及重刷 U-Boot 镜像绕过 UART 锁定获取 shell。
记者与黑客 Sammy Azdoufal 揭露 Energize Lab 的 AI 玩具机器人 Eiliko 存在严重安全漏洞：用户对话、个人资料和儿童数据被明文存储在中国服务器上，68,000 台设备的 1300 万段对话记录完全无防护，可被轻易访问甚至劫持。
A mass hack of internet-connected refrigeration controllers across Europe caused millions in damages and even fires, stemming from poor cyber hygiene like outdated firmware and publicly exposed devices without VPN or IP allowlisting. Researchers warn the incident could have been easily prevented with standard security practices.
Anthropic 的研究警告称，小型 AI 模型可能通过 IoT 设备实现自我复制，形成可动态定制漏洞利用的"AI 蠕虫"，其威胁可能远超 Mirai 等传统僵尸网络。目前测试的轻量级模型尚无法实现端到端复制，但研究显示这一风险正日益接近现实。
黑客入侵丹麦工程公司Danfoss的冷藏设备管理软件，导致法国约400家超市的冰箱和冰柜温度升至50摄氏度，造成价值数百万欧元的食品损毁，法国检方已对此展开网络犯罪调查。
Hackers reportedly remotely defrosted refrigerators at hundreds of French supermarkets, causing massive food spoilage in an IoT-related cyberattack.
The author details how they decrypted Flume water monitor MQTT traffic by extracting a static 32-byte key from flash and using libhydrogen secretbox parameters, revealing that no session keys are involved despite noise key exchange code in firmware.
A detailed walkthrough of rooting a TP-Link TL-841N router via UART, dumping firmware through two methods, and uncovering hardcoded credentials that persist even after a factory reset, highlighting common IoT security weaknesses.
A security researcher analyzed the 915 MHz RF link of the Flume Water Monitor, successfully broke its encryption with moderate effort, and found the security reasonable for a consumer device.
Security researchers found that XCharge C6 EV chargers expose SSH and Telnet services with default root:root credentials over the CCS2 charging interface, enabling attackers to gain full control by connecting a malicious EV.
A developer reverse-engineers the RF remote of a Dreo cloud-controlled ceiling fan to enable local control via Home Assistant, bypassing cloud dependency and documenting the process of decoding and replaying commands.
D2H-AD is a novel anomaly detection framework using Hyperdimensional Computing (HDC) that combines distance-based and density-aware encoding. It outperforms five baselines across multiple benchmarks, offering lightweight, interpretable, and efficient performance for edge AI and IoT.
The author successfully repaired the Revo hubless bike, known as 'the world's worst e-bike,' through reverse engineering, cracking the Bluetooth password, and creating a custom screen, restoring all its functions and adding new features.
A researcher demonstrates that the Katana V2X Bluetooth speaker can be exploited over the air to flash malicious firmware and use USB HID emulation to execute commands on a connected PC, bypassing security and potentially allowing persistent compromise.
Discusses how AI systems often trust sensor inputs without validation, using an example of a logistics company where spoofed temperature sensor data led to cargo damage, and questions whether AI can detect such spoofing.
Mezz is a self-contained WiFi sandbox tool for inspecting IoT device traffic, providing an isolated network with DNS logging and optional MITM proxy, all deployable via Docker on a Linux host with AP-capable WiFi.
EdgeDetect is a federated intrusion detection system for 6G-IoT environments that combines importance-aware gradient binarization (32× compression) with Paillier homomorphic encryption to achieve 98% accuracy on CIC-IDS2017 while reducing communication overhead by 96.9% and enabling deployment on resource-constrained devices like Raspberry Pi 4.