Our Time in a Product Review Cabal: And All the Malware and Bugs that Came With It

Our Time in a Product Review Cabal: And All the Malware and Bugs that Came With It

Speakers: Adam Schaal, Head of AWS Shine; Matt Virus, IoT Engineer at Cisco

Conference: ShmooCon

YouTube: https://www.youtube.com/watch?v=yIutY_X2FcU

Overview

In "Our Time in a Product Review Cabal: And All the Malware and Bugs that Came With It," Adam Schaal and Matt Virus pull back the curtain on the murky world of online product reviews and the surprisingly prevalent security risks lurking within the cheap, cloud-connected devices that populate our homes. The talk details their journey from casually acquiring free products through an incentivized review scheme to uncovering critical vulnerabilities, backdoors, and privacy concerns in these ubiquitous Internet of Things (IoT) gadgets. What started as a quest for free smart home gear rapidly evolved into a deep dive into hardware hacking, network analysis, and firmware reverse engineering, exposing a systemic lack of security in many consumer IoT products.

This presentation is a crucial wake-up call for consumers and security professionals alike, highlighting that convenience and affordability often come at the cost of privacy and security. Schaal and Virus, leveraging their expertise in cloud infrastructure, IoT engineering, and forensics, demonstrate how seemingly innocuous devices like smart cameras, light switches, and even adjustable beds can become vectors for surveillance, data exfiltration, or even entry points into a home network. Their work underscores the urgent need for greater scrutiny of supply chains, more robust security by design in IoT, and increased user awareness regarding the digital footprint of their connected devices.

The talk not only exposes the vulnerabilities but also empowers users with practical methods to identify, mitigate, and even remediate these security flaws. By sharing their "cabal's" experiences, Schaal and Virus provide a unique perspective on the economics driving insecure IoT development and offer actionable advice for transforming untrustworthy devices into secure, locally controlled components of a smart home, or, failing that, advocating for their complete removal from the network.

Background

▶ Watch: Introduction to speakers and talk topic (0:00)

The genesis of this investigative journey began, as many modern consumer stories do, during the COVID-19 pandemic in 2020. With much of the world sheltering in place, online shopping surged, leading to a proliferation of inexpensive, internet-connected devices. Matt Virus purchased an electronic device that arrived with an intriguing postcard promising a "gift" upon contacting support. This offer, initially for a free product in exchange for a purchase reimbursement (and later, implicitly, a positive review), quickly revealed a widespread system of incentivized reviews. What started with one free smart switch for Matt soon escalated, with him receiving four, then inviting Adam Schaal into the fold.

Their "product review cabal" rapidly expanded. By duplicating email addresses, creating multiple sock puppet accounts, and even assigning different "apartment" identities to rooms in their homes, they scaled their acquisition of free IoT devices. This wasn't merely about light switches; they amassed a diverse collection including cameras, robot vacuums, smart lamps, baby monitors, and even kitchen appliances. The sheer volume and variety of devices—a quarter of which were shown in a single slide—demonstrated the indiscriminate nature of these vendors, who seemed to care little about the identity of the recipient, only the accumulation of positive reviews. This observation sparked a critical question: if these vendors were so lax about their review processes, what did that imply about the security of their products?

The motivation shifted from simply acquiring free gear to a deeper security inquiry. Many of these devices were cloud-connected, raising immediate concerns about data privacy and potential monitoring. A significant portion of the devices leveraged the Tuya platform, which the speakers characterized as "evil." Their research revealed that Tuya stored all developer data in a single, unencrypted repository. Becoming a Tuya developer required only a small licensing fee, granting access to the same shared, vulnerable infrastructure. This context set the stage for their technical deep dive, as they sought to determine the trustworthiness and security posture of the vast array of devices they had acquired.

Key Findings

▶ Watch: The origin of the product review cabal (2:50)

Adam Schaal and Matt Virus uncovered a disturbing array of vulnerabilities and questionable practices pervasive in the cheap IoT market:

• Unencrypted Cloud Data: A primary concern was the Tuya platform, which collected and stored all device data in a single, unencrypted repository. This meant that any developer with a small licensing fee could potentially access sensitive information uploaded by other Tuya-powered devices, posing a significant privacy risk.
• Accessible UART Debug Ports: Almost universally, the devices featured easily accessible UART (Universal Asynchronous Receive and Transmit) ports, often without requiring soldering. These debug ports frequently exposed sensitive boot logs, firmware versions, and even command-line access, providing an invaluable initial foothold for analysis.
• Covert Network Communications: Traffic monitoring revealed that many devices, particularly cameras, established connections to IP spaces in China or cloud providers like Oracle. Even devices claiming local functionality often mirrored video feeds to the cloud, making them accessible to anyone on the platform.
• Known Vulnerabilities in Common Software: Analysis of UART output exposed specific software versions, such as the live555 media server used in some cameras for RTSP streaming. This particular server version was identified as having a well-known Remote Code Execution (RCE) vulnerability, easily discoverable with a quick search.
• Suspicious Firmware Behavior: Some cameras exhibited unusually slow boot times, which UART analysis traced back to scripts performing suspicious actions like changing passwords or referencing non-existent directories, indicating poorly managed or potentially malicious firmware.
• Forced and Obfuscated Firmware Updates: Devices were observed performing automatic firmware upgrades without user consent. In one instance, a camera's beaconing IP address shifted from China to a US-based cloud provider after an update, yet its traffic patterns and behavior remained identical, suggesting an attempt to mask the origin of its communications rather than improve security.
• P2P Network Exploitation: Many cameras utilize peer-to-peer (P2P) networks to bypass NAT and firewall restrictions, making them easier for non-technical users to access remotely. However, the speakers highlighted a critical flaw: authentication to any camera on this network could be achieved using only its UID (Unique Identifier), which is programmatically enumerable. This means attackers could potentially connect to and view streams from countless unprotected cameras. Furthermore, some apps, like the ps6 light app for S-cam cameras, forced P2P connectivity without an option to disable it via the app, only through a hidden local web interface.
• Undisclosed Wi-Fi and Hidden Functionality: Matt Virus shared a personal anecdote about discovering an unknown Wi-Fi SSID originating from his Temperpedic adjustable bed. Despite not ordering a Wi-Fi-enabled model and the manual not indicating its presence, deep investigation with a Dope Scope revealed hidden Wi-Fi hardware, demonstrating that devices can possess undeclared network capabilities.
• White-Labeling and Fake Reviews: A prevalent issue was white-labeling, where identical hardware is sold under numerous different brand names, often reusing the same product images with blurred-out logos. These products frequently share the same underlying vulnerabilities. The talk also detailed the characteristics of fake reviews: always five stars, generic positive comments, lack of detail, excessive exclamation points, and sometimes even describing a completely different product.
• Widespread Unauthenticated Access: The problem extends beyond individual homes. Schaal and Virus encountered unauthenticated, open-access cameras in public spaces, such as a pizza shop in Italy, demonstrating how easily these devices can expose private environments to platforms like Shodan.

These findings collectively painted a grim picture of consumer IoT security, driven by a race to the bottom in terms of cost and a disregard for fundamental security principles.

Technical Deep Dive

▶ Watch: Scaling up free product acquisition (4:00)

The technical investigations conducted by Schaal and Virus employed a range of hardware and network analysis techniques to expose the underlying vulnerabilities of these cheap IoT devices. Their methodology provides a blueprint for anyone seeking to scrutinize their own connected gadgets.

A cornerstone of their hardware analysis was the UART (Universal Asynchronous Receive and Transmit) port. This serial communication interface, present on virtually all embedded systems, is a standard debugging tool. The speakers emphasized its accessibility, noting that it often only requires an inexpensive adapter (around $5) and minimal effort, sometimes just Dupont wires or pogo pins, to connect without soldering. UART access proved invaluable for:

• Boot Log Analysis: Observing the device's boot sequence often revealed critical information, including the operating system, kernel versions, and the execution of various scripts.
• Firmware Version Identification: UART output frequently displayed the specific versions of software components running on the device. For instance, discovering the live555 media server version led to the identification of a known Remote Code Execution (RCE) vulnerability. This vulnerability, associated with specific live555 versions, could allow an attacker to execute arbitrary code on the camera.
• Identifying Suspicious Activity: Through UART, they observed unexpected scripts running during boot, such as those attempting to change passwords or access non-existent directories, indicative of either poorly written firmware or potentially malicious intent.

Beyond direct hardware access, traffic monitoring played a critical role in understanding device behavior. By placing cameras on a network segment where they could sniff packets (e.g., using Wireshark with a span port or mirrored traffic), Schaal and Virus observed outbound connections. Key observations included:

• Geographic Call-Outs: Many cameras routinely connected to IP spaces in China, raising immediate sovereignty and data privacy concerns.
• Cloud Provider Connections: Even when not directly connecting to China, devices often beaconed to major cloud providers like AWS, GCP, or Oracle. The speakers cautioned that this doesn't inherently make a device trustworthy, as malicious entities can simply rent space on these platforms to host their command-and-control (C2) infrastructure.
• Firmware Update Obfuscation: A particularly insidious finding was a camera that, after an automatic firmware update, changed its beaconing IP from China to a US-based cloud provider. Crucially, the underlying traffic patterns and device behavior remained unchanged, suggesting a deliberate attempt to mislead users about the data's ultimate destination.

The talk also delved into the intricacies of P2P (Peer-to-Peer) networks commonly used by cameras to simplify remote access for non-technical users, bypassing the complexities of NAT and firewall configuration. Referencing Paul May PC's work, Schaal and Virus explained that these networks allow cameras to act as supernodes, routing traffic from other cameras. A significant security flaw identified was the ability to authenticate to any camera on this P2P network using only its UID (Unique Identifier), which is "programmatically enumerable." This means an attacker could systematically generate UIDs and attempt to connect to numerous camera streams without needing credentials. The ps6 light app, often bundled with S-cam cameras, was found to force this P2P connectivity, with no in-app option to disable it, forcing users to discover and utilize a hidden local web interface for direct, non-P2P setup.

Finally, the speakers highlighted the utility of specialized tools like the Dope Scope, a Wi-Fi enumeration device. This tool was instrumental in Matt Virus's discovery of the hidden Wi-Fi network emanating from his Temperpedic bed. Despite the bed's model not specifying Wi-Fi capability and the manual indicating a different hardware location, the Dope Scope allowed him to pinpoint the source of the rogue SSID, underscoring that even seemingly "dumb" devices can harbor hidden network interfaces. The pervasive use of white-labeling further complicates the issue, as identical hardware with shared vulnerabilities appears under dozens of different brands, making it difficult for consumers to track known issues.

Demo / Proof of Concept

▶ Watch: Realizing security risks of cloud-connected devices (5:30)

While the talk did not feature a live hacking demonstration in the traditional sense, Adam Schaal and Matt Virus presented compelling evidence and detailed their methodologies, which served as a conceptual proof of concept for the vulnerabilities and mitigation strategies discussed. Their presentation included:

• Visuals of Acquired Devices: Photographs showcasing the vast array of "free" IoT devices accumulated by their "cabal," ranging from smart switches to robot vacuums and cameras, illustrating the scale of the problem.
• UART Output Screenshots: Screenshots of terminal output from UART connections, displaying boot logs and identified software versions, such as the live555 media server with its known RCE vulnerability. This demonstrated the ease of gaining low-level access and extracting critical system information directly from the hardware.
• Network Traffic Analysis Insights: Discussion of observed network traffic patterns, including devices beaconing to IP addresses in China or cloud providers, and the subtle shift in beaconing destination post-firmware update, indicative of attempts to mask malicious or privacy-compromising behavior.
• Example of OpenIPC Firmware: A screenshot of a camera running OpenIPC firmware after successful flashing. This image clearly showed a clean web interface with root access, allowing command execution and complete control over the device. This served as a powerful visual proof of concept for their defensive implications, demonstrating that untrustworthy firmware could be replaced with secure, auditable open-source alternatives.
• "Rogue" Wi-Fi Identification: The anecdote of the Temperpedic bed's hidden Wi-Fi, along with the mention of the Dope Scope, illustrated how unknown network interfaces can be discovered and located, even when not explicitly documented by the manufacturer.
• Examples of Fake Reviews: Visual examples of obviously fake product reviews, highlighting their generic nature, excessive positivity, and sometimes irrelevant content, empowering the audience to recognize these deceptive practices.
• Real-World Exposure: A photograph of an unauthenticated, open-access camera feed from a pizza shop in Italy, emphasizing that these vulnerabilities are not confined to the home lab but pose real-world privacy risks in public and commercial settings.

These presented findings and documented steps effectively served as a demonstration of the research, validating the existence of the vulnerabilities and the efficacy of their analytical and defensive techniques.

Defensive Implications

▶ Watch: How to identify vulnerabilities: Intro to UART (6:50)

The detailed findings from Schaal and Virus's research lead directly to a set of actionable defensive strategies for consumers and network administrators to secure their IoT devices and networks. These strategies range from basic network segmentation to advanced hardware modifications.

1. Network-Level Isolation: The most immediate and often easiest defense is to isolate IoT devices at the network layer.

• DHCP Reservations with No Gateway: Assigning a static DHCP reservation to an IoT device but configuring it with no default gateway effectively severs its Layer 3 connectivity. The device remains on the local Layer 2 segment but cannot initiate outbound connections to the internet, preventing it from "calling home" or exfiltrating data.
• Layer 3 ACLs (Access Control Lists): Implementing ACLs on routers or firewalls allows granular control over which IP addresses or ports an IoT device can access. This can prevent devices from crossing network boundaries or connecting to known malicious IP ranges.
• VLANs/Separate Wi-Fi Networks: Segmenting IoT devices onto a dedicated VLAN or a separate Wi-Fi network (e.g., a guest network) isolates them from more sensitive parts of the home or business network. This limits the blast radius if an IoT device is compromised.

1. Firmware Replacement (Flashing Open-Source Firmware): For many vulnerable devices, particularly cameras and smart home gadgets, replacing the vendor's untrustworthy firmware with open-source alternatives is a robust solution.

• UART/JTAG Access: As demonstrated, UART (and JTAG for more advanced debugging) provides the necessary interface to flash new firmware. This often requires some disassembly of the device but grants full control.
• Open-Source Firmware Projects: Several mature open-source firmware projects exist, such as OpenIPC (for cameras), LibreTiny, OpenBeken, Tasmota, and WLED. These firmwares are auditable, community-maintained, and typically offer local APIs and MQTT integration, eliminating reliance on third-party cloud services. The process involves compiling the firmware (if necessary) and then flashing it via the debug port.
• OTA Exploits: In some cases, existing Over-The-Air (OTA) update mechanisms can be exploited. This might involve modifying encryption keys used for cloud communication to prevent the device from connecting to the vendor's server, then forcing an OTA update with custom, trusted firmware.

1. Hardware Modification (Chip Swapping): For devices where flashing isn't feasible due to patched vulnerabilities, incompatible MCUs, or deeply embedded proprietary systems, a more drastic but effective solution is chip swapping.

• Replacing MCUs: This involves using a hot air station to carefully remove the existing microcontroller unit (MCU) and replace it with a known, open-source friendly chip like an ESP32-2F or ESP32-C3. These chips can reliably run open-source firmwares like Tasmota. The process requires reconfiguring the GPIOs and outputs to match the original hardware's functionality. This ensures complete control over the device's code and behavior.

1. User Awareness and Product Vetting:

• Skepticism and Research: Approach cheap, cloud-connected products with critical skepticism. Research the vendor, look for known security issues, and prioritize products from trusted brands with transparent security practices.
• Recognizing White Labels and Fake Reviews: Be aware that many identical products are sold under different brand names (white-labeling), often sharing the same vulnerabilities. Learn to spot fake reviews (generic, overly enthusiastic, irrelevant content, always five stars) as a red flag for untrustworthy products and vendors.
• Last Resort: Discarding Devices: If a device cannot be secured through network controls, firmware replacement, or hardware modification, the ultimate defensive measure is to remove it from the network entirely and, if possible, physically destroy it. No cheap gadget is worth compromising your network's security posture.

By adopting these layered defensive strategies, individuals and organizations can significantly reduce their exposure to the pervasive security risks presented by insecure IoT devices.

Key Takeaways

• Exercise Extreme Skepticism with Cheap IoT Devices: Many affordable, cloud-connected products, especially those promoted through incentivized review schemes, harbor significant security and privacy vulnerabilities, often due to rushed development and reliance on insecure platforms like Tuya.
• Hardware Hacking is Accessible and Informative: Techniques like connecting to UART debug ports are straightforward and incredibly powerful for uncovering device firmware versions, boot processes, and hidden functionalities, providing a critical first step in assessing trustworthiness.
• Network Segmentation is Non-Negotiable for IoT: Isolate IoT devices using DHCP reservations with no default gateway, Layer 3 ACLs, or dedicated VLANs to prevent them from communicating with the internet or sensitive internal networks, regardless of their perceived security.
• Open-Source Firmware Offers a Secure Alternative: Replacing proprietary, untrustworthy firmware with open-source options like OpenIPC, Tasmota, or WLED provides full control, auditability, and eliminates reliance on potentially malicious cloud services, transforming insecure devices into secure, local components.
• Beware of Hidden Functionality and Deceptive Practices: Devices can possess undeclared network capabilities (e.g., hidden Wi-Fi modules), and vendors often employ white-labeling and fake reviews to obscure product origins and security flaws, demanding diligent consumer research.

About the Speaker(s)

Adam Schaal is the Head of AWS Shine, bringing extensive experience in cloud infrastructure and security. Beyond his professional role, Adam is a passionate home lab enthusiast and deeply involved in the cybersecurity community. He contributes to KernelCon, a conference in Omaha, Nebraska, runs a local Defcon group, and actively participates in open-source projects and other conferences. His community involvement underscores his commitment to sharing knowledge and fostering security awareness.

Matt Virus is an IoT Engineer at Cisco, where he has dedicated a significant part of his career. With a background as a forensics analyst at a DOD agency, Matt possesses a keen eye for detail and a deep understanding of digital evidence. He describes himself as a hardware junkie and founded hacksspace.io, a platform for projects, guides, and technical work. Matt also plays a crucial role at KernelCon, where he runs the hardware hacking village, focusing on making reverse engineering, firmware flashing, and hardware building accessible to a broader audience, helping individuals expand their technical comfort zones.