SAINTCON 2021

It seems every device that is purchased now has a simple request: "Connect me to the internet" This sentiment always bothered me as I never knew why connectivity was always required for what seemed to be the most straight-forward single-function devices. I spent some time first-hand researching various IoT devices (cameras, smart TV's, light switches, Google Cast devices, etc) to see their behavior when they were connected to a network. As I looked through the lan traces, I was shocked to see random outbound traffic flows to data centers in China on obscure UDP ports, subnet sweeps gathering data about all of the devices on its broadcast domain, and other 'features' that may be useful in some scenarios...but are terrifying in the wrong context (UPnP, looking at you here). Join me on a journey of "who's being naughty on my network" using packet captures, looking at shady third-party web portals to 'control' your smart devices, random things you agree to when you are setting up your new devices, as well as some other fun discoveries I made along the way. We will then go over how you can strike a nice balance between functionality and security in both corporate IoT use as well as in your home.