IoT Cloud Attack Surface and Research Strategy
Team82 researchers Noam Moshe and Tomer Goldschmidt explain their focus on IoT cloud platforms as a critical but underexplored attack surface. Unlike traditional IoT vulnerabilities in exposed devices, their research targets the vendor cloud infrastructure that IoT devices connect to by default. This connectivity creates a backdoor into secure networks even when devices aren't directly exposed to the internet. The team emphasizes that while user authentication has matured with strong protocols and multi-factor authentication, device authentication remains a weak point. Vendors often assume their own devices can be trusted, leading to inadequate validation of device credentials and creating opportunities for attackers to impersonate legitimate devices.
Ruijie Networks Vulnerability Chain and Remote Code Execution
The research uncovered 10 vulnerabilities in Ruijie Networks' Reyee OS cloud platform, which manages routers and access points globally. The attack chain begins with generating valid device credentials using non-secret identifiers like serial numbers and MAC addresses—information readily available on device labels and in unboxing videos. By exploiting weak device authentication, researchers connected to Ruijie's MQTT broker and escalated privileges to impersonate the cloud platform itself. This allowed them to send commands to any cloud-connected device, achieving full remote code execution capabilities. The MQTT broker misconfiguration also leaked sensitive information about all connected devices worldwide, including network topology, device status, and user configuration changes.
Open Sesame Proximity Attack and Vendor Response
Team82 developed a second attack vector called Open Sesame, targeting organizations that want to avoid mass-scale detection. By sniffing Wi-Fi beacons broadcast by Ruijie devices, attackers in physical proximity can capture serial numbers and use the same vulnerability chain to infiltrate specific networks. This drive-by attack scenario poses risks to offices, terminals, and households using Ruijie access points. Ruijie responded quickly and comprehensively to the disclosure, working with CISA to patch vulnerabilities within hours to days. The fixes included both specific code corrections and broader architectural changes to device authentication mechanisms. All reported vulnerabilities have been remediated, and the vendor demonstrated strong security awareness throughout the coordinated disclosure process.
