How does attacking IoT cloud platforms differ from traditional IoT device attacks?

Traditional IoT attacks target internet-exposed devices with vulnerable services, while cloud platform attacks target the vendor infrastructure that devices connect to by default. This requires chaining multiple vulnerabilities—first compromising device authentication to access the cloud broker, then escalating privileges to impersonate the cloud itself. It's a multi-stage operation that can reach devices not directly exposed to the internet, making it more sophisticated but potentially more impactful than scanning for exposed devices on Shodan.

What is the Open Sesame attack and how does it work?

Open Sesame is a proximity-based attack where an attacker physically near a Ruijie device captures Wi-Fi beacons that broadcast the device's serial number. Using this identifier and the discovered vulnerabilities, the attacker can authenticate to the cloud platform, impersonate the device, and gain access to the internal network. This drive-by attack scenario is particularly concerning for offices and buildings where an attacker could walk through with a laptop and compromise networks without triggering the detection that mass-scale attacks might cause.

Attacking IoT Cloud Platforms: Ruijie Networks Research

Name: Attacking IoT Cloud Platforms: Ruijie Networks Research
Uploaded: 2026-05-08T19:18:16-04:00
Duration: 31 min 39 s
Description: Claroty Team82's Noam Moshe and Tomer Goldschmidt join the Nexus Podcast to discuss the research team's latest publication on 10 vulnerabilities discovered in Ruijie Networks' Reyee OS cloud platform. A chain of these vulnerabilities could allow an ...

Claroty

05/08/2026

0 (0%)

Report Like Favorite

TL;DR

Team82 discovered 10 vulnerabilities in Ruijie Networks' cloud platform that allowed remote code execution on any connected device by exploiting weak device authentication based on serial numbers and MAC addresses
The attack chain leveraged MQTT broker misconfigurations to impersonate both devices and the cloud platform, leaking sensitive information about all Ruijie devices globally and enabling full remote control
A proximity attack called Open Sesame allows attackers to capture device identifiers from Wi-Fi beacons and infiltrate internal networks without mass-scale detection
Ruijie responded rapidly with comprehensive fixes addressing both specific vulnerabilities and architectural authentication flaws, patching some issues within hours of disclosure
The research highlights a critical gap in IoT security: while user authentication has matured, device authentication remains weak because vendors assume their own hardware can be trusted

IoT Cloud Attack Surface and Research Strategy

Team82 researchers Noam Moshe and Tomer Goldschmidt explain their focus on IoT cloud platforms as a critical but underexplored attack surface. Unlike traditional IoT vulnerabilities in exposed devices, their research targets the vendor cloud infrastructure that IoT devices connect to by default. This connectivity creates a backdoor into secure networks even when devices aren't directly exposed to the internet. The team emphasizes that while user authentication has matured with strong protocols and multi-factor authentication, device authentication remains a weak point. Vendors often assume their own devices can be trusted, leading to inadequate validation of device credentials and creating opportunities for attackers to impersonate legitimate devices.

Ruijie Networks Vulnerability Chain and Remote Code Execution

The research uncovered 10 vulnerabilities in Ruijie Networks' Reyee OS cloud platform, which manages routers and access points globally. The attack chain begins with generating valid device credentials using non-secret identifiers like serial numbers and MAC addresses—information readily available on device labels and in unboxing videos. By exploiting weak device authentication, researchers connected to Ruijie's MQTT broker and escalated privileges to impersonate the cloud platform itself. This allowed them to send commands to any cloud-connected device, achieving full remote code execution capabilities. The MQTT broker misconfiguration also leaked sensitive information about all connected devices worldwide, including network topology, device status, and user configuration changes.

Open Sesame Proximity Attack and Vendor Response

Team82 developed a second attack vector called Open Sesame, targeting organizations that want to avoid mass-scale detection. By sniffing Wi-Fi beacons broadcast by Ruijie devices, attackers in physical proximity can capture serial numbers and use the same vulnerability chain to infiltrate specific networks. This drive-by attack scenario poses risks to offices, terminals, and households using Ruijie access points. Ruijie responded quickly and comprehensively to the disclosure, working with CISA to patch vulnerabilities within hours to days. The fixes included both specific code corrections and broader architectural changes to device authentication mechanisms. All reported vulnerabilities have been remediated, and the vendor demonstrated strong security awareness throughout the coordinated disclosure process.

Chapters

0:00 - Introduction and Episode Overview
1:52 - IoT Cloud Research Strategy
4:56 - Common Cloud Vulnerabilities
9:52 - Ruijie Networks as Research Target
14:49 - Attack Sophistication and Scope
17:23 - Vulnerability Chain Walkthrough
22:47 - MQTT Protocol Exploitation
25:39 - Vendor Disclosure and Response
27:04 - Open Sesame Proximity Attack
29:53 - Fix Implementation and Conclusion

Key Quotes

2:24 "... one of the biggest black spots in most networks that we can see is the unknown IoT devices, because at the end of the day, you buy an IoT device and you are not aware what is going on behind the scenes, under the hood, and what the device actually does ..."
7:02 "... when we're talking about device authentication and device authorization, this is less known and less explored attack surface. Because for a user, you have two factor, you have email, strong passwords, you have JWT, you have all of this infrastructure in place to make sure everything is valid, correct, and good. However, for device credentials, device authentication, this is not as relevant and not as explored ..."
9:03 "... the base view of Rigi was that a device is not a rogue device, that it can be trusted. Why? Well, because it's their code, their device, they control it. However, this idea of an attacker impersonating a device, doing something fake on its behalf, sending payloads as a device did not occur to them and was less explored ..."
18:52 "Because Ruijin and many other IoT vendors relied on these identifiers, which are not treated as secrets, to validate device credentials, we were able to basically leak and generate valid credentials and connect to Ruijin's MQTT broker that handles all Ruijin cloud platform communication ..."
24:51 "... by just being able to gain access to these messages, this was already a very, very severe security issue. Because through it, you are able to both know and have leak information about basically anything that happens to RAID devices all around the world ..."

Categories:

» Cybersecurity » Network Security
» Data Protection

Tags:

Show more Show less

Browse videos

Upcoming Webinar Calendar

05/12/2026

01:00 PM

05/12/2026

Transforming Black Box to Glass Box: Revealing Hidden Threats and AI Risks through Data Lineage

https://www.truthinit.com/index.php/channel/1895/transforming-black-box-to-glass-box-revealing-hidden-threats-and-ai-risks-through-data-lineage/
05/12/2026

11:30 PM

05/12/2026

Implementing Effective Strategies for Active Directory Security and Data Protection

https://www.truthinit.com/index.php/channel/1888/implementing-effective-strategies-for-active-directory-security-and-data-protection/
05/13/2026

01:00 AM

05/13/2026

Transforming the Black Box: Revealing AI Risks and Hidden Threats through Data Lineage

https://www.truthinit.com/index.php/channel/1890/transforming-the-black-box-revealing-ai-risks-and-hidden-threats-through-data-lineage/
05/13/2026

05:00 AM

05/13/2026

Transforming Black Box to Glass Box: Revealing AI Risks and Hidden Threats through Data Lineage

https://www.truthinit.com/index.php/channel/1894/transforming-black-box-to-glass-box-revealing-ai-risks-and-hidden-threats-through-data-lineage/
05/19/2026

01:00 PM

05/19/2026

Establishing a Robust AI Governance Framework for GenAI Throughout Its Lifecycle

https://www.truthinit.com/index.php/channel/1936/establishing-a-robust-ai-governance-framework-for-genai-throughout-its-lifecycle/
05/20/2026

10:00 PM

05/20/2026

APAC: Establishing an AI Governance Framework for GenAI Throughout the Deployment Process

https://www.truthinit.com/index.php/channel/1953/establishing-an-ai-governance-framework-for-genai-throughout-the-deployment-process/
05/21/2026

11:00 AM

05/21/2026

The Autonomous Era: Orchestrating a Resilient Enterprise

https://www.truthinit.com/index.php/channel/1372/the-autonomous-era-orchestrating-a-resilient-enterprise/
05/27/2026

04:00 AM

05/27/2026

Rivoluziona i rischi dell'AI in opportunità con Netskope AI Security

https://www.truthinit.com/index.php/channel/1925/rivoluziona-i-rischi-dellai-in-opportunità-con-netskope-ai-security/
05/28/2026

10:00 AM

05/28/2026

Harnessing AI: Transforming Perception into Purposeful Mastery

https://www.truthinit.com/index.php/channel/1924/harnessing-ai-transforming-perception-into-purposeful-mastery/
05/28/2026

01:00 PM

05/28/2026

AI in the Fast Lane: Effectively Managing AI Security for Small Teams

https://www.truthinit.com/index.php/channel/1951/ai-in-the-fast-lane-effectively-managing-ai-security-for-small-teams/
06/02/2026

01:00 PM

06/02/2026

Satori Spring: Insights from Recent Research on the 2026 Threat Landscape

https://www.truthinit.com/index.php/channel/1930/satori-spring-insights-from-recent-research-on-the-2026-threat-landscape/
06/04/2026

02:00 AM

06/04/2026

Mastering the Unseen: Managing Shadow AI and Agentic MCP Traffic

https://www.truthinit.com/index.php/channel/1948/mastering-the-unseen-managing-shadow-ai-and-agentic-mcp-traffic/
06/16/2026

07:00 AM

06/16/2026

Transforming Data Risk into Actionable Priorities: What to Address First

https://www.truthinit.com/index.php/channel/1952/transforming-data-risk-into-actionable-priorities-what-to-address-first/