P2P Weakness Exposes Millions of IoT Devices
Summary: Security researcher Paul Marrapese found that iLnkP2P, P2P software from China-based Shenzhen Yunni Technology bundled into millions of security cameras, webcams, baby monitors, smart doorbells and DVRs, offers no authentication or encryption and can be easily enumerated, with his proof-of-concept script identifying more than two million vulnerable devices worldwide. He said 39 percent were in China, 19 percent in Europe and seven percent in the United States, and that neither China's CERT, iLnk nor a half dozen major vendors responded to his reports more than four months after he first reached out.
Key Takeaway: Marrapese's proof-of-concept attack abuses the devices' heartbeat feature to steal administrative credentials sent in plaintext, and many of the two million affected devices still run on factory-default passwords - the same weakness Mirai used to spread to millions of devices.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026