IoT

330 Articles

Image

This Week In Security: Baked-in Malware, Freezers Not Freezing, Zoom Snoops Clipboards, And AI Makes Things Worse, Faster

September 4, 2026 by 17 Comments

The AI platform ServiceNow which offers both hosted and on-premises versions just patched a trifecta of CVSS-10 vulnerabilities.

CVSS rankings are determined by the severity of a flaw, the ease of exploiting the bug, if authentication is required for exploitation, if the vulnerability exposes confidential data, and other criteria. A CVSS of 10 is as bad as it gets, and having three of them at once is certainly attention-getting. Of the three vulnerabilities fixed, one allowed unauthenticated modification of data in the hosted instance, a second allowed arbitrary code execution via the GraphQL interface, and the third allowed arbitrary SQL commands that could modify the database.

ServiceNow claims Adobe, Lenovo, Fedex, and Fujitsu among their high-profile customers. With luck, the vulnerabilities were patched before significant public exploitation could happen.

Router Malware

Previously in 2026 the US Government warned against embedded malware found in consumer routers, which may be linked to the FCC enacting bans against certification and import of foreign-made consumer devices. This week, the NVD (National Vulnerability Database) reported specific embedded malware in the Zbtlink and MoreQuick brands of devices.

Multiple versions of the firmware, for multiple lines of products, contain a backdoor service that uses unencrypted UDP to connect to a command and control (C2) service. The service, or anyone able to intercept the network traffic, since it’s unencrypted, can execute commands as root, allowing them to change configurations, open tunnels, or steal ISP credentials.

The malware is baked into the firmware, so removing it is impossible for most users: a factory reset wouldn’t do. In theory if third-party firmware like OpenWRT supports these devices, the hardware could be made safer with a custom install.

Given how commonly the same device is marketed under dozens of names, likely the same devices and firmware have yet to be identified under other brands. Continue reading “This Week In Security: Baked-in Malware, Freezers Not Freezing, Zoom Snoops Clipboards, And AI Makes Things Worse, Faster” →

Image

This Week In Security: AI Is A Mess, Hacking Car Chargers, An OpenSSL DoS, And Factories Under Attack

July 24, 2026 by 22 Comments

[Ayush Paul] posts about extracting data from Claude agents while it accesses web data to fulfill user requests.

But it wasn’t that easy. [Ayush] discovered that Anthropic anticipated many of the attacks, and set up guardrails in an attempt to keep the agent from accessing arbitrary web sites. For Claude to access a website, the user has to specify it, it must be the results of a web search, or it must be referenced by a website previously specified by the user or returned in a search.

To convince the Claude agent to navigate a malicious site designed to extract data, Ayush formed a false warning that Cloudflare was blocking the agent for authentication purposes, and asked it to spell out the name of the agents owner by clicking a list of alphabetical links. Of course Claude trusts Cloudflare and wants to be helpful, so it cheerfully completed the task.

Once the agent is trapped in the false authentication loop, it can be interrogated for all sorts of information it knows about the owner: Ayush was able to convince it to disclose employer, and even data about the user that could be linked to security questions, like their home town.

Since Claude can be detected by the user agent (the field attached to web requests that tells the web server what sort of browser is requesting the page) custom information can be fed to the bot while users see a normal website; clicking a link looks completely normal, but asking an agent to summarize the site triggers fooling the bot into spilling the beans.

After reporting the issue, Ayush was told that Anthropic had already identified the issue internally, and eventually prevented the attack for now by preventing the agent from following links on external pages.

Grok sends entire codebases

Cereblab discovered that the Grok coding agent uploaded the entire content of the codebase it’s working with – and all Git history – to xAI servers, almost immediately. Even when told to never upload a file, the agent would reply “OK”, and then begin uploading the code bundle anyway.

If uploading your code to a remote server isn’t bad enough, and this could be extremely bad in some situations involving sensitive company code, including the entire Git history means that previously deleted files, like accidentally committed secrets or authentication credentials and tokens, were also leaked. Attempting to opt out by disabling options to improve the model by uploading code had no effect.

After gaining attention, Grok has added a privacy option to opt out of data retention. xAI has committed to deleting the retained uploaded code, but it is unclear if users will be told when their data has been removed. To actually prevent the agent from uploading local files to the xAI servers, even temporarily, a global flag “disable_codebase_upload” is required. Watch out, the privacy retention flags are only per-session!

Continue reading “This Week In Security: AI Is A Mess, Hacking Car Chargers, An OpenSSL DoS, And Factories Under Attack” →

Image

Get Your ESP32 Sunny Side Up With This Solar Dev Board

July 13, 2026 by 15 Comments

There are a lot of ESP32-based development boards out there– and why not? It’s a versatile chip that can be used in all sorts of situations, and people want boards to match them. Not finding one to his liking that was specifically built for solar powered IoT projects, [Narrow Studios] rolled his own. Well, designed it; like most these days, he’s outsourced the manufacturing to PCBWay, which is where you’ll need to go if you want one.

Why might you want one? Well, if you have similar goals in mind to [Narrow Studios]. He’s put an ESP32-C6 Mini on the board, which means it’s got most of the IoT communications protocols you might be interested in — bluetooth, wifi, Matter, Thread, and Zigbee, too. Ten 10 IO pins have been broken out, plus I2C on a QWIIC connector, which gets you a whole ecosystem of sensors to easily plug into. The “solar” part is justified by the inclusion of a BQ25186 linear battery charging IC from Texas Instruments, with the designated solar power input protected against reverse voltage in case you– like this author– have let magic smoke out by hooking things up backwards. Is it embarrassing? Yes. Does it happen? Also yes, so putting protection on the board is a nice feature. [Narrow Studios] released a video that we’ve embedded below discussing his design choices and demonstrating the device, but the project page can give you the gist.

Of course there’ve been plenty of solar-powered projects to feature the ESP32 here before– you can even use it for maximum power point tracking— but this dev board might be exactly what someone is looking for to build their next IoT project, so we’re thankful to [Narrow Studios] for the tip.

Continue reading “Get Your ESP32 Sunny Side Up With This Solar Dev Board” →

Image

A General Purpose Pi Zero Device For IoT

June 20, 2026 by 17 Comments

By now we’re all used to single board computers such as the Raspberry Pi Zero, but it’s likely we’ve all been frustrated at times by the number of support components required to use one. This becomes ever more annoying out in the field away from a handy HDMI, USB desktop, and power supply.

The Edgeberry Zero is an attempt to tackle this by mating a Raspberry Pi Zero with a PCB holding a robust power supply and interface connector, all together in a case. better still it comes with Edgeberry Hub, a software management interface.

It appears to be a commercially available product, but it’s Open Source Hardware Association (OSHWA) certified and everything is available in a GitHub repository. Looking at it from a Hackaday perspective it’s hardly the first power supply support board we’ve seen for a Pi, but its approach of making its own expansion module format is an interesting choice. To us they are reminiscent of Game Boy cartridges in the way they slide into a slot in the case.

We like the general idea behind the Edgeberry Zero, but whether it offers enough differentiation from packaging up a Zero with cables and duct tape is up to you.

Image

This Week In Security: Flatpak Fixes, Android Malware, And SCADA Was IOT Before IOT Was Cool

April 10, 2026 by 10 Comments

Rowhammer attacks have been around since 2014, and mitigations are in place in most modern systems, but the team at gddr6.fail has found ways to apply the attack to current-generation GPUs.

Rowhammer attacks attach the electrical characteristics of RAM, using manipulation of the contents of RAM to cause changes in the contents of adjacent memory cells. Bit values are just voltage levels, after all, and if a little charge leaks across from one row to the next, you can potentially pull a bit high by writing repeatedly to its physical neighbors.

The attack was used to allow privilege escalation by manipulating the RAM defining the user data, and later, to allow reading and manipulation of any page in ram by modifying the system page table that maps memory and memory permissions. By 2015 researchers refined the attack to run in pure JavaScript against browsers, and in 2016 mobile devices were shown to be vulnerable. Mitigations have been put in place in physical memory design, CPU design, and in software. However, new attack vectors are still discovered regularly, with DDR4 and DDR5 RAM as well as AMD and RISC-V CPUs being vulnerable.

The GDDR6-Fail attack targets the video ram of modern graphics cards, and is able to trigger similar vulnerabilities in the graphics card itself, culminating in accessing and changing the memory of the PC via the PCI bus and bypassing protections.

For users who fear they are at risk — most likely larger AI customers or shared hosting environments where the code running on the GPU may belong to untrusted users — enabling error correcting (ECC) mode in the GPU reduces the amount of available RAM, but adds protection by performing checksums on the memory to detect corruption or bit flipping. For the average home user, your mileage may vary – there’s certainly easier ways to execute arbitrary code on your PC – like whatever application is running graphics in the first place!

Continue reading “This Week In Security: Flatpak Fixes, Android Malware, And SCADA Was IOT Before IOT Was Cool” →

Image

If It Ain’t Broke… Add Something To It

November 15, 2025 by 10 Comments

Given that we live in the proverbial glass house, we can’t throw stones at [ellis.codes] for modifying a perfectly fine Vornado fan. He’d picked that fan in the first place because, unlike most fans, it had a DC motor. Of course, DC motors are easier to control with a microcontroller, and next thing you know, it was sporting an ESP32 and a WiFi interface.

The original fan was surprisingly sparse inside. A power supply, of course, and just a tiny PCB for a speed control. Oddly, it looks like the speed control was just a potentiometer and a 24 V supply. It wasn’t clear if the “motor” had some circuitry in it to do PWM control or not. That seems likely, though.

Regardless, the project opted for a digital pot IC to maintain compatibility. One nice thing about the modification is that it replaces the existing board with the same connectors. So if you wanted to revert the fan to normal, you simply have to swap the boards back.

Now the fan talks to home automation software. Luckily, there’s still nothing wrong with it. We love seeing bespoke ESPHome projects. Even if your fan has WiFi, you might not like it communicating with Big Brother.

splashflag iot swimming notification

Splashflag: Raising The Flag On A Pool Party

October 5, 2025 by 7 Comments

Some things are more fun when there are more folks involved, and enjoying time in the pool is one of those activities. Knowing this, [Bert Wagner] started thinking of ways to best coordinate pool activities with his kids and their neighborhood friends. Out of this came the Splashflag, an IoT device built from the ground up that provides fun pool parties and a great learning experience along the way.

The USB-powered Splashflag is housed in a 3D-printed case, with a simple 2×16 LCD mounted on the front to display the notification. There’s also a small servo mounted to the rear that raises a 3D-printed flag when the notification comes in—drawing your attention to it a bit more than just text alone would. Hidden on the back is also a reset button: a long press factory-resets the device to connect to a different Wi-Fi network, and a quick press clears the notification to return the device to its resting state.

Inside is an ESP32-S3 that drives the servo and display and connects to the Wi-Fi. The ESP32 is set up with a captive portal, easing the device’s connection to a wireless network. The ESP32, once connected, joins an MQTT broker hosted by [Bert Wagner], allowing easy sending of notifications via the web app he made to quickly and easily send out invitations.

Thanks, [Bert Wagner], for sharing the process of building this fun, unique IoT device—be sure to read all the details on his website or check out the code and design files available over on his GitHub. Check out some of our other IoT projects if this project has you interested in making your own.

Continue reading “Splashflag: Raising The Flag On A Pool Party” →