this vulnerability shouldn’t even exist

Software HAS to get better.

🛒 GREAT BOOKS FOR THE LOWEST LEVEL🛒

🔥 SOCIALS 🔥

[josephlabs]

0 sanitization on inputs that has a connection to system calls is insane.

[coreymartin]

This 100% counts as gross negligence, if my crappy online Python course can do user input validation, a _security_ company should be able to

[xXYourShadowDaniXx]

And THIS is why you run your Smarthome devices in their own VLAN with NO access to your other VLANs

[henrijohansson]

0:36 missed opportunity to say "Another day and another Zero-Day"

[Ilix]

Man, "spray and pray" is never how you want a successful security breach to be described.

[LeetTuber]

I didn't realize Mirai was still going on. For my cybersecurity class a few years ago I did a report on zombie botnets and this was a major thing. Its crazy that camera vendors (who Mirai was targeting before) didn't shore up that hole.

[Jirodyne]

Companies, I would argue ARE 100% Liable, under Express Warranty. If you buy a product, they are expressing a warranty that there is nothing critically wrong or harmful with that item. A massive issue like this? I would 100% argue that breaks warranty and they are 100% Liable for any damage caused by the virus that was installed on your device because of their negligence of securing the device.

But then again, I'm not a lawyer, and the courts don't care about consumers would side with the company who is paying them behind the scenes.

[CarlinaPhnix]

I disagree about vendors not making firmware available. Is FOSS also insecure because the source is available? Or is it MORE secure, because it can be audited by anyone? The issue is vendors writing shitty code and, more importantly, either not patching it when vulns are found, or, often, not even having the capability to patch it.

[DadofScience]

I've not embraced IoT stuff because I have no faith in businesses to create products that are "safe" if they have no external obligation to do so. For example, pharmaceuticals are heavily regulated for good reason because they have the potential to cause great harm. I don't want stuff like that in my home, thanks.

Great work, Ed.

[PeterZaitcev]

Wait a second, why is it unpatchable if it allows executing external code? You could install the update _fixing_ that vulnerability _using_ that vulnerability!

[luxploit]

I think Ed's old Router is a Netgear Nighthawk, probably an R7000. I recognise the hideous casing and 3 way antenna setup. I flashed mine with FreshTomato, way better then NG's stock fw

[Lupinicus]

You are providing a great service, both by explaining interesting topical exploits but also by providing real courses to get people better educated. I am now retired after 40+ years in IT, starting with 25 years of assembly programming on realtime kernels in the mainframe world, then transitioning to security. Lack of knowledge about how the machines actually work is very common amongst modern programmers. Improvements in knowledge should lead to more secure architectures and code. Please keep up the good work.

[Trenjeska]

Full access to firmware is not a bad thing. In fact, it should be a requirement for any device. How else are you going to re-flash the device or maintain it without dependency on the manufacturer that may or may not exist anymore?

[chipthegoober]

11:44 LMAOOOO WHAT IS THAT SCREAM IM CRYING BRO

[HinaraT]

The worst part is that the bug would not have occured if they just simply wrote directly to the file as the kernel would have refused

[lorenzopazzification]

It's funny that the vulnerability is in the line with the "safe_printf"

[naimah]

The attitude of “it’s just software” needs to go away. There needs to be an engineering rigor applied to get correct(ish) and safe software. We don’t allow civil engineers to self certify so why are we doing that with software?

[madson-web]

"the internet of things sucks" YES

[benarcher]

Why is anyone surprised that bugs like this exist? The number of connected devices out there is enormous. The companies developing these are probably more interested in launching the product than spending yet another dollar on testing or implementing a safer language. I have no idea how to fight this. Regulation? Informed users? Videos like this :-) -> definitely! Thanks for a good walk-through.

[von...]

"thanks Triple L, you're the best! I am a ***generic mobile user agent*** and I am very ***positive adjective*** that you were thinking of us!"

***actually viewing on a 1000:45 mega ultrawide with 10k smell-o-vision***
"...pft they dont even know im only pretending to be a mobile user"