12.1 Common Smart Devices and Their Risks
Why Cheap Hardware Ships Insecure
Most smart bulbs, plugs, locks, and sensors run on sub-$5 system-on-chips: aging ARM9 or MIPS cores with 8-32 MB of RAM, running Linux with a monolithic BusyBox userland or a bare RTOS. The bill of materials leaves no budget for security engineering, so firmware ships unsigned and unencrypted, binaries lack stack canaries and NX/ASLR, and the same root password gets baked into every unit in a product line. One reversed firmware image therefore compromises millions of devices at once -- the exact economics that make IoT an attacker's commodity.
The Attack Surface You Can Actually See
From your own LAN you can enumerate it: telnet on 23 or 2323, admin HTTP panels on 80/8080, RTSP video on 554, UPnP IGD on 1900/5555, and unauthenticated MQTT on 1883. Mirai showed what happens when these face the internet: bots scanned global port 23, brute-forced a hardcoded table of default credential pairs harvested from leaked BusyBox telnetd source, then echoed static BusyBox flooders onto the shell to launch SYN, UDP, and GRE floods. The October 2016 DYN outage, driven at roughly a terabit per second, came from webcams and DVRs; when the source leaked, "botnets as a service" multiplied.
Cloud Dependency Is a Remote Kill Switch
Many devices relay every command through vendor cloud, with the local API disabled or undocumented. The consequences: an outage turns your lights off-line, the vendor holds a record of occupancy patterns, and a firmware update can remove local control entirely. When the vendor exits the business, devices go unpatchable while their open services stay reachable.
Assume Breach When You Inventory
Classify devices by blast radius before buying: cameras and smart locks can place a microphone, lens, or door strike on your network; a smart plug mostly offers DDoS bandwidth. Tiered risk drives segmentation and purchase decisions, which later sections cover.
Architecture Diagram
Key Takeaways
- Cost-optimized IoT SoCs and monolithic BusyBox firmware ship unsigned, with few or no exploit mitigations.
- The same hardcoded root password across a product line turns one firmware leak into mass compromise.
- Default-open telnet, HTTP admin panels, RTSP, and UPnP are the services Mirai-style botnets scan and brute-force.
- Cloud-relay designs give vendors (and anyone who breaches them) visibility and control over your home.
- Inventory devices and tier them by blast radius; cameras and locks deserve far stricter handling than plugs.