New Cloud-Based IoT Attack Model Exploits Authentication Flaws for Large-Scale Remote Control

Researchers Jingcheng Wang (Nanjing University of Posts and Telecommunications) and Nick Shi (independent security researcher) presented a new attack model at Black Hat 2024 that exploits authentication flaws in cloud-managed IoT devices to achieve large-scale remote control. The attack targets devices connected only via power and a network cable, bypassing traditional vulnerabilities by focusing on overlooked weaknesses in cloud-device authentication frameworks, including MQTT, WebSocket, and HTTPS protocols. By reverse-engineering firmware, attackers can impersonate devices using only a serial number or MAC address—obtainable through exposed interfaces, brute-forcing (with as few as 3–6 variable digits), or physical labels—then manipulate cloud interactions to hijack devices. Three real-world case studies demonstrated how attackers could bind victim devices, forge password updates, or trigger factory resets via race conditions or session hijacking, even for already-bound devices. The attack model operates silently, evades firewalls/NAT, and requires no public IP exposure, with traffic indistinguishable from legitimate communications. Researchers emphasized that cloud servers’ blind trust in device-reported credentials enables these exploits, which can lead to remote code execution (RCE) across entire product lines. Mitigation suggestions included firmware protection, IP-based re-verification, and replacing serial numbers/MAC addresses with non-exposable random identifiers.