Mezz, a curl-able WiFi sandbox for IoT pentesting
#HackerNews #Mezz #WiFi #sandbox #IoT #pentesting #cybersecurity #tools
Mezz, a curl-able WiFi sandbox for IoT pentesting
#HackerNews #Mezz #WiFi #sandbox #IoT #pentesting #cybersecurity #tools
Is RCS (rich-communication services) finally becoming a mainstream business messaging channel? New research from Juniper Research suggests adoption is accelerating rapidly, though growth remains uneven across global markets. RCS business traffic is expected to surpass 200 billion messages globally by 2027, rising from roughly 70 billion messages in 2025. The surge is being driven largely
Yarbo robot mower live surveillance "attack scenario"
https://github.com/Bin4ry/yarbo-nat-in-my-back-yard#attack-scenarios
Funny thing: I bought some stuff from an #iot supplier. They included this thing in my order with a little slip of paper saying, basically, “Thanks for your purchase, here’s a little courtesy item for you..”
I appreciate the thought. But they forgot to mention what the hell it is.
It is a clear LED with some kind of circuit visible inside. But it has 4 wires coming off the bottom, not 2. I don’t know what it is, what voltage it uses (it was packaged with some stuff that takes both 3.3 and 5V), or what it does.
Does anyone recognise this on sight?
#arduino #homeautomation

Behind a cheap Temu doorbell sits an IoT backend where device IDs are sequential and requests are forgeable with a string baked into every firmware. One signed call lifts any device's persistent password and lets anyone on the Internet hijack the next live call.
Every time I picked up a new smart device, I lost an afternoon to the same setup. hostapd will not start because wpa_supplicant is holding the radio. NetworkManager brings it back the moment you stop it. Port 53 is taken. The FORWARD chain looks right but devices sit there with no internet.
So I packaged it. Mezz: a docker compose stack, two curl commands, edit .env, bring it up.
You are basically paying $12 to let anyone on the internet ring your doorbell.
Bought a cheap Temu smart doorbell, dumped the BK7252N firmware over UART, and worked out how to take over any unit on the platform, hijack live calls, and exfiltrate the owner's WiFi password.
Responsible disclosure sent. Sensitive specifics withheld.

Behind a cheap Temu doorbell sits an IoT backend where device IDs are sequential and requests are forgeable with a string baked into every firmware. One signed call lifts any device's persistent password and lets anyone on the Internet hijack the next live call.