{"id":13514662,"url":"https://github.com/nebgnahz/awesome-iot-hacks","last_synced_at":"2025-09-27T10:30:36.231Z","repository":{"id":37548708,"uuid":"42153998","full_name":"nebgnahz/awesome-iot-hacks","owner":"nebgnahz","description":"A Collection of Hacks in IoT Space so that we can address them (hopefully).","archived":false,"fork":false,"pushed_at":"2020-05-16T21:18:59.000Z","size":34,"stargazers_count":2294,"open_issues_count":2,"forks_count":420,"subscribers_count":141,"default_branch":"master","last_synced_at":"2025-09-13T03:03:08.276Z","etag":null,"topics":["awesome","hack","iot","security"],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nebgnahz.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-09-09T03:33:13.000Z","updated_at":"2025-09-12T18:02:27.000Z","dependencies_parsed_at":"2022-07-12T16:22:41.155Z","dependency_job_id":null,"html_url":"https://github.com/nebgnahz/awesome-iot-hacks","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/nebgnahz/awesome-iot-hacks","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nebgnahz%2Fawesome-iot-hacks","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nebgnahz%2Fawesome-iot-hacks/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nebgnahz%2Fawesome-iot-hacks/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nebgnahz%2Fawesome-iot-hacks/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nebgnahz","download_url":"https://codeload.github.com/nebgnahz/awesome-iot-hacks/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nebgnahz%2Fawesome-iot-hacks/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":275974138,"owners_count":25562664,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-19T02:00:09.700Z","response_time":108,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["awesome","hack","iot","security"],"created_at":"2024-08-01T05:00:59.896Z","updated_at":"2025-09-27T10:30:35.985Z","avatar_url":"https://github.com/nebgnahz.png","language":null,"funding_links":[],"categories":["\u003ca id=\"9a20a70f58ea7946f24224c5d73fac15\"\u003e\u003c/a\u003e工具","\u003ca id=\"d55d9dfd081aa2a02e636b97ca1bad0b\"\u003e\u003c/a\u003e物联网(IoT)\u0026\u0026嵌入式设备\u0026\u0026路由器\u0026\u0026交换机\u0026\u0026智能设备\u0026\u0026打印机","物联网（IOT）","Awesome Repositories","Others","Table of Contents","Others (1002)","\u003ca id=\"8c5a692b5d26527ef346687e047c5c21\"\u003e\u003c/a\u003e收集","Other Lists","📘 Valuable Repositories","Here is a collection of hackers, pentesters, security researchers, scripts and more:","Related Awesome Lists","Uncategorized","Related awesome lists","Awesome Lists","Hardware, Embedded, IoT \u0026 ICS/OT"],"sub_categories":["\u003ca id=\"cda63179d132f43441f8844c5df10024\"\u003e\u003c/a\u003e未分类-IoT","ML/DL","Awesome Repositories","TeX Lists","Uncategorized","Video Surveillance","Misc Tools"],"readme":"# Awesome IoT Hacks\n\nA curated list of hacks in IoT space so that researchers and industrial products\ncan address the security vulnerabilities (_hopefully_).\n\nThe table of content is generated with\n[doctoc](https://github.com/thlorenz/doctoc). Make sure you run it and update\nthe table of content before making pull requests.\n\n## Contents\n\u003c!-- START doctoc generated TOC please keep comment here to allow auto update --\u003e\n\u003c!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE --\u003e\n\n\n- [Analysis, Reports and Slides](#analysis-reports-and-slides)\n- [Communities](#communities)\n- [IoT Hacks](#iot-hacks)\n  - [Thingbots](#thingbots)\n  - [RFID](#rfid)\n  - [Home Automation](#home-automation)\n  - [Connected Doorbell](#connected-doorbell)\n  - [Hub](#hub)\n  - [Smart Coffee](#smart-coffee)\n  - [Wearable](#wearable)\n  - [Smart Plug](#smart-plug)\n  - [Cameras](#cameras)\n  - [Traffic Lights](#traffic-lights)\n  - [Automobiles](#automobiles)\n  - [Airplanes](#airplanes)\n  - [Light Bulbs](#light-bulbs)\n  - [Locks](#locks)\n  - [Smart Scale](#smart-scale)\n  - [Smart Meters](#smart-meters)\n  - [Pacemaker](#pacemaker)\n  - [Thermostats](#thermostats)\n  - [Fridge](#fridge)\n  - [Media Player \u0026 TV](#media-player--tv)\n  - [Firearms](#firearms)\n  - [Toilet](#toilet)\n  - [Toys](#toys)\n  - [Drones](#drones)\n\n\u003c!-- END doctoc generated TOC please keep comment here to allow auto update --\u003e\n\n## Analysis, Reports and Slides\n\n- [Internet of Things Research Study (HP 2014 Report)](http://www8.hp.com/h20195/V2/GetPDF.aspx/4AA5-4759ENW.pdf)\n- [The Internet of Fails](http://www.slideshare.net/markstanislav/the-internet-of-fails-where-iot-has-gone-wrong-and-how-were-making-it-right),\n  ([video](www.youtube.com/watch?v=8hLeVSvoHqI))\n- [Cameras, Thermostats, and Home Automation Controllers, Hacking 14 IoT Devices](https://www.iotvillage.org/slides_DC23/IoT11-slides.pdf)\n- [Hack All The Things: 20 Devices in 45 Minutes](https://www.defcon.org/images/defcon-22/dc-22-presentations/Heres-Etemadieh-Baker-Nielsen/DEFCON-22-Heres-Etemadieh-Baker-Nielsen-Hack-All-The-Things.pdf) - ([wiki](https://www.exploitee.rs/), [video](www.youtube.com/watch?v=h5PRvBpLuJs))\n- [Careful Connections: Building Security in the Internet of Things (FTC)](https://www.ftc.gov/system/files/documents/plain-language/pdf0199-carefulconnections-buildingsecurityinternetofthings.pdf)\n- [Analysis of IoT honeypot data; How devices are hacked, type of infections and origin of attacks (Kaspersky lab, 2018)](https://securelist.com/new-trends-in-the-world-of-iot-threats/87991/)\n\n## Communities\n\n- [IoT Village\u003csup\u003eTM\u003c/sup\u003e](https://www.iotvillage.org/)\n- [BuildItSecure.ly](http://builditsecure.ly/)\n- [Secure Internet of Things Project (Stanford)](http://iot.stanford.edu/people.html)\n- [The Open Web Application Security Project (OWASP)](https://www.owasp.org/index.php/Main_Page)\n\n## IoT Hacks\n\n### Thingbots\n\n- [Proofpoint Uncovers Internet of Things (IoT) Cyberattack](http://investors.proofpoint.com/releasedetail.cfm?releaseid=819799)\n\n### RFID\n\n- [Vulnerabilities in First-Generation RFID-enabled Credit Cards](http://www.arijuels.com/wp-content/uploads/2013/09/HBFJ+07.pdf)\n- [MIT Subway Hack Paper Published on the Web](http://www.pcmag.com/article2/0,2817,2327898,00.asp)\n- [Tampered Card Readers Steal Data via Bluetooth](http://www.americanbanker.com/security-watch/bluetooth-skimming-1042020-1.html)\n\n### Home Automation\n\n- [IOActive identifies vulnerabilities in Belkin WeMo's Home Automation](http://www.ioactive.com/pdfs/IOActive_Belkin-advisory-lite.pdf)\n- [Cameras, Thermostats, and Home Automation Controllers, Hacking 14 IoT Devices](https://www.iotvillage.org/slides_DC23/IoT11-slides.pdf)\n- [Popular Home Automation System Backdoored Via Unpatched Flaw](http://www.darkreading.com/vulnerabilities---threats/popular-home-automation-system-backdoored-via-unpatched-flaw/d/d-id/1320004?_mc=sm_dr_editor_kellyjacksonhiggins)\n\n### Connected Doorbell\n- [CVE-2015-4400: Backdoorbot, Network Configuration Leak on a Connected Doorbell](https://blog.fortinet.com/2016/01/22/cve-2015-4400-backdoorbot-network-configuration-leak-on-a-connected-doorbell), ([video](https://www.youtube.com/watch?v=a05RciFhPrs))\n\n### Hub\n\n- [TWSL2013-023: Lack of Web and API AuthenticationVulnerability in INSTEON Hub](https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2013-023/?fid=3869)\n\n### Smart Coffee\n\n- [Reversing the Smarter Coffee IoT Machine Protocol to Make Coffee Using the Terminal](https://www.evilsocket.net/2016/10/09/IoCOFFEE-Reversing-the-Smarter-Coffee-IoT-machine-protocol-to-make-coffee-using-terminal/)\n\n### Wearable\n\n- [How I hacked my smart bracelet](https://securelist.com/blog/research/69369/how-i-hacked-my-smart-bracelet/)\n\n### Smart Plug\n\n- [Hacking the D-Link DSP-W215 Smart Plug](http://www.devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plug/)\n- [Reverse Engineering the TP-Link HS110](https://www.softscheck.com/en/reverse-engineering-tp-link-hs110/)\n- [Hacking Kankun Smart Wifi Plug](http://www.anites.com/2015/01/hacking-kankun-smart-wifi-plug.html)\n- [Smart Socket Hack Tutorial](http://souliss.net/media/smart-socket-hack/)\n\n### Cameras\n\n- [Trendnet Cameras - I always feel like somebody's watching me](http://console-cowboys.blogspot.com/2012/01/trendnet-cameras-i-always-feel-like.html)\n- [Hacker Hotshots: Eyes on IZON Surveilling IP Camera Security](https://www.concise-courses.com/security/izon-hacking/)\n- [Cameras, Thermostats, and Home Automation Controllers, Hacking 14 IoT Devices](https://www.iotvillage.org/slides_DC23/IoT11-slides.pdf)\n- [Hacker 'shouts abuse' via Foscam baby monitoring camera](http://www.bbc.com/news/technology-23693460)\n- [Urban surveillance camera systems lacking security](https://blog.kaspersky.com/urban-surveillance-not-secure/8901/)\n- [TWSL2014-007: Multiple Vulnerabilities in Y-Cam IP Cameras](https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2014-007/?fid=3850)\n- [Say Cheese: a snapshot of the massive DDoS attacks coming from IoT cameras](https://blog.cloudflare.com/say-cheese-a-snapshot-of-the-massive-ddos-attacks-coming-from-iot-cameras/)\n- [Samsung SmartCam install.php Remote Root Command Exec](https://www.exploitee.rs/index.php/Samsung_SmartCam%E2%80%8B)\n\n### Traffic Lights\n\n- [Green Lights Forever: Analyzing The Security of Traffic Infrastructure](https://jhalderm.com/pub/papers/traffic-woot14.pdf)\n- [Hacking US (and UK, Australia, France, etc.) Traffic Control Systems](http://blog.ioactive.com/2014/04/hacking-us-and-uk-australia-france-etc.html)\n\n### Automobiles\n\n- [Hackers Remotely Attack a Jeep on the Highway](http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/)\n- [Comprehensive Experimental Analyses of Automotive Attack Surfaces](http://static.usenix.org/events/sec11/tech/full_papers/Checkoway.pdf)\n\n### Airplanes\n\n- [Hackers could take control of a plane using in-flight entertainment system](http://www.telegraph.co.uk/technology/2016/12/20/hackers-could-take-control-plane-using-in-flight-entertainment/)\n\n### Light Bulbs\n\n- [Hacking into Internet Connected Light Bulbs](http://www.contextis.com/resources/blog/hacking-internet-connected-light-bulbs/)\n- [Hacking Lightbulbs: Security Evaluation Of The Philips Hue Personal Wireless Lighting System](http://www.dhanjani.com/docs/Hacking%20Lighbulbs%20Hue%20Dhanjani%202013.pdf)\n- [IoT Goes Nuclear: Creating a ZigBee Chain Reaction](http://www.wisdom.weizmann.ac.il/~eyalro/iotworm/iotworm.pdf)\n- [Extended Functionality Attacks on IoT Devices: The Case of Smart Lights](https://zh.scribd.com/doc/306620189/Eyal-Ronen-and-Adi-Shamir-Hack-Lightbulbs)\n\n### Locks\n\n- [Lockpicking in the IoT](https://media.ccc.de/v/33c3-8019-lockpicking_in_the_iot)\n\n### Smart Scale\n\n- [Fitbit Aria Wi-Fi Smart Scale](https://www.hackerspace-bamberg.de/Fitbit_Aria_Wi-Fi_Smart_Scale)\n\n### Smart Meters\n\n- [Solar Power Firm Patches Meters Vulnerable to Command Injection Attacks](https://threatpost.com/solar-power-firm-patches-meters-vulnerable-to-command-injection-attacks/122324/)\n\n### Pacemaker\n\n- [Pacemakers and Implantable Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses](http://www.secure-medicine.org/public/publications/icd-study.pdf)\n\n### Thermostats\n\n- [Cameras, Thermostats, and Home Automation Controllers, Hacking 14 IoT Devices](https://www.iotvillage.org/slides_DC23/IoT11-slides.pdf)\n- [Google Nest: Exploiting DFU For Root](https://blog.exploitee.rs/2014/google-nest-exploiting-dfu-for-root/)\n- [Smart Nest Thermostat, A Smart Spy in Your Home](https://www.blackhat.com/docs/us-14/materials/us-14-Jin-Smart-Nest-Thermostat-A-Smart-Spy-In-Your-Home.pdf)\n- [TWSL2013-022: No Authentication Vulnerability in Radio Thermostat](https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2013-022/?fid=3870)\n\n### Fridge\n\n- [Proofpoint Uncovers Internet of Things (IoT) Cyberattack](http://investors.proofpoint.com/releasedetail.cfm?releaseid=819799) - Spam emails from fridges.\n- [Hacking Defcon 23'S IoT Village Samsung Fridge](https://www.pentestpartners.com/blog/hacking-defcon-23s-iot-village-samsung-fridge/)\n\n### Media Player \u0026 TV\n\n- [Breaking Secure-Boot on the Roku](https://blog.exploitee.rs/2013/breaking-secure-boot-on-the-roku/)\n- [Google TV Or: How I Learned to Stop Worrying and Exploit Secure Boot](https://blog.exploitee.rs/2013/google-tv-or-how-i-learned-to-stop-worrying-and-exploit-secure-boot/)\n- [Chromecast: Exploiting the Newest Device By Google](https://blog.exploitee.rs/2013/chromecast-exploiting-the-newest-device-by-google/)\n- [Ransomware Ruins Holiday By Hijacking Family's LG Smart TV on Christmas Day](https://www.yahoo.com/tech/ransomware-ruins-holiday-hijacking-familys-201136667.html)\n\n### Firearms\n\n- [DEF CON 25 - Plore - Popping a Smart Gun](https://www.youtube.com/watch?v=J3f0p3vTY-c) ([Slides](https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEFCON-25-Plore-Popping-a-Smart-Gun.pdf))\n- [Hacking a IoT Rifle - BlackHat 2015 - 36 slides](https://www.blackhat.com/docs/us-15/materials/us-15-Sandvik-When-IoT-Attacks-Hacking-A-Linux-Powered-Rifle.pdf)\n- [Hackers Can Disable a Sniper Rifle—Or Change Its Target - Wired 2015](https://www.wired.com/2015/07/hackers-can-disable-sniper-rifleor-change-target/)\n\n### Toilet\n\n- [TWSL2013-020: Hard-Coded Bluetooth PIN Vulnerability in LIXIL Satis Toilet](https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2013-020/?fid=3872)\n\n### Toys\n\n- [TWSL2013-021: Multiple Vulnerabilities in Karotz Smart Rabbit](https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2013-021/?fid=3871)\n- [Fisher-Price smart bear allowed hacking of children's biographical data (CVE-2015-8269)](https://www.theguardian.com/technology/2016/feb/02/fisher-price-mattel-smart-toy-bear-data-hack-technology)\n- [Hello Barbie Initial Security Analysis](https://static1.squarespace.com/static/543effd8e4b095fba39dfe59/t/56a66d424bf1187ad34383b2/1453747529070/HelloBarbieSecurityAnalysis.pdf)\n- [Security researcher Ken Munro discovers vulnerability in Vivid Toy's talking Doll 'Cayla'](http://www.techworm.net/2015/01/vivid-toys-cayla-talking-doll-vulnerable-hacking-says-security-researcher.html)\n- [Data from connected CloudPets teddy bears leaked and ransomed, exposing kids' voice messages](https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/)\n\n### Drones\n\n- [Parrot Drones Hijacking - RSA2018 Video, Pedro Cabrera, March 2018](https://youtu.be/66z-aXy_1Yo) ([Slides](https://www.rsaconference.com/writable/presentations/file_upload/mbs-w14-parrot-drones-hijacking.pdf))\n- [Hacking the DJI Phantom 3, Paolo Stagno, January 25, 2017](http://dronesec.xyz/2017/01/25/hacking-the-dji-phantom-3/)\n- [PHDays VI, hacking Syma X5C quadcopter, Pavel Novikov and Artur Garipov, June 9, 2016](http://blog.ptsecurity.com/2016/06/phd-vi-how-they-stole-our-drone.html)\n- [All your bebop drones still belong to us, drone hijacking, Pedro Cabrera, 2016](https://youtu.be/ra0nKHvaXnc)\n- [Shelling out on 3DR Solo, Kevin Finisterre,June 15, 2015](http://www.digitalmunition.com/ShellingOutOnSolo_nopass.pdf)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnebgnahz%2Fawesome-iot-hacks","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnebgnahz%2Fawesome-iot-hacks","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnebgnahz%2Fawesome-iot-hacks/lists"}