full-disclosure - Belkin Wemo 0day exploit (remote shell + rapid state change)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <6893AD87-9D8A-483D-BB53-01B9C5FAD6DE@gmail.com>
Date: Wed, 30 Jan 2013 19:25:48 -0600
From: Daniel Cardenas <daniel.vcardenas@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Belkin Wemo 0day exploit (remote shell + rapid
	state change)

Discovered several UPnP vulnerabilites which allowed me to gain full shell access and modify the state of the device being controlled. Im in the process of disclosing to Belkin. PoC soon to come. Link to video below.

http://youtu.be/BcW2q0aHOFo

Belkin WeMo with latest firmware. Able to gain full root access and send commands including changing the state of connected device via flaw in UPnP implementation. Chose small desk lamp and simple on/off sequence due to safety concerns. Real world this could be a fan or space heater and rapidly turn on/off without limitation.
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/