SOHO Hacking At Pwn2Own

SOHO Hacking At Pwn2Own

Speakers: Alex Plaskett (NCC Group); McCaulay Hudson (NCC Group)

Conference: HITB Amsterdam

YouTube: https://www.youtube.com/watch?v=vvUrSHLsNxI

Overview

This talk, "SOHO Hacking At Pwn2Own," delivered by Alex Plaskett and McCaulay Hudson from NCC Group's Exploit Development Group (EDG), delves into their experiences and the vulnerabilities they uncovered during the Pwn2Own Toronto competition. Specifically, the presentation provides a detailed technical breakdown of the exploits developed for various Small Office/Home Office (SOHO) routers, culminating in a successful demonstration of the new "SOHO Mashup" category.

The speakers systematically walk through their reconnaissance methodology, which involved firmware analysis, network traffic capture, and gaining shell access to target devices. They then highlight several critical vulnerabilities, predominantly command injection flaws, found across Netgear, TP-Link, Synology, and Ubiquiti routers. The talk not only showcases advanced exploitation techniques, including a complex stack buffer overflow requiring a heap spray, but also underscores persistent security weaknesses in consumer-grade and small business networking equipment, raising significant concerns about vendor Secure Software Development Lifecycles (SSDLCs).

Ultimately, this presentation serves as a crucial resource for both offensive and defensive security practitioners. It demonstrates the real-world impact of seemingly simple vulnerabilities like command injection when chained together, and provides actionable insights into the attack surface of SOHO devices. For defenders, it offers a stark reminder of the importance of robust input validation, secure coding practices, and continuous patching to mitigate risks in an increasingly interconnected home and small business environment.

Background

▶ Watch: Introduction: Pwn2Own Router Hacking Overview (0:00)

Pwn2Own is a prestigious research competition organized annually by the Zero Day Initiative (ZDI), a division of Trend Micro. It challenges security researchers to find and exploit zero-day vulnerabilities in a variety of software and hardware categories, including industrial control systems, virtualization platforms, web browsers, desktops, mobile devices, printers, routers, and other embedded systems. ZDI purchases these discovered vulnerabilities, providing them directly to vendors to facilitate timely patching and firmware updates, thereby enhancing global security.

The 2022 Pwn2Own Toronto event introduced a new and highly lucrative category: the SOHO Mashup. This challenge required contestants to first compromise a router through its WAN (Wide Area Network) interface and then pivot to compromise another device, such as a printer or NAS, connected to the router's LAN (Local Area Network) interface. This multi-stage exploit chain offered the highest reward bonus, reflecting its complexity and significant real-world impact.

The competition operates under stringent rules designed to ensure fair play and reliable exploit development. Participants are prohibited from using any user interaction during their attempt, have a maximum of five minutes per attempt, and are limited to three attempts per device category. Each contestant can submit only one exploit chain per device category (with WAN and LAN interfaces often counting as separate categories). While rebooting devices during an attempt is disallowed, pre-attempt reboots are permitted. The order of attempts is drawn randomly, with the first successful compromise receiving the full prize money, which is subsequently reduced for later successful attempts on the same target. All vulnerabilities discussed in this talk have been responsibly disclosed and patched by the respective vendors.

NCC Group's EDG primarily focused on attacking routers and printers with the singular objective of winning the SOHO Mashup chain. The target devices, pre-selected by ZDI months in advance, were typically the latest models from specific vendors. For this competition, the team targeted the Netgear Nighthawk, TP-Link, and Synology consumer routers, alongside the Ubiquiti EdgeRouter, a popular small business router.

The team's methodology for device reconnaissance was thorough:

1. Firmware Acquisition and Analysis: Firmware was often directly downloadable from vendor websites, usually unencrypted or unobfuscated. Tools like Binwalk were used to extract file systems, allowing for analysis of plaintext code (e.g., bash scripts, HTML) and reverse engineering of compiled binaries using disassemblers like IDA and Ghidra. This also allowed for checking security properties such as the presence of stack canaries, ASLR (Address Space Layout Randomization), and NX (No-Execute) bits, which indicate the difficulty of exploitation.

1. Network Traffic Capture: Traffic was captured from all interfaces (LAN, WLAN, WAN) of the target routers. For LAN/WLAN, direct PC connection with Wireshark sufficed. For WAN, a more complex setup was required: a "capture router" (with shell access and TCPdump installed) was connected to the internet and the research PC, and the target router's WAN interface was connected to the capture router's LAN. This allowed monitoring of all outbound traffic from the target router's WAN, crucial for identifying external attack surfaces. The competition rules allowed assuming one-hop proximity, enabling control over services like DHCP (Dynamic Host Configuration Protocol) for potential attacks.

1. Shell Access: Gaining shell access was essential for debugging (e.g., using GDB) and detailed information gathering. The methods varied by device:

• Synology and Ubiquiti routers provided SSH for administration by design.
• Netgear routers featured a hidden backdoor on UDP port 23. This required sending an encrypted packet containing the router's MAC address, IP, and admin password (hashed with SHA256 and encrypted with a hardcoded key found in firmware). This would enable telnet access. (Note: This method was not eligible for Pwn2Own as it required prior knowledge of credentials).
• TP-Link routers lacked an obvious backdoor. Hardware modification was necessary, involving resoldering TX/RX lines and adding a UART pin header to gain a serial console. (Note: This hardware attack was also not eligible for Pwn2Own but facilitated research).

1. Information Enumeration: With shell access, the team enumerated running processes, listening services, firewall rules, environment variables, and memory protections.

1. Leveraging Open Source Code: Many consumer routers use open-source components licensed under the GPL. Vendors often modify this code, sometimes introducing new vulnerabilities or incorrectly patching existing ones. Downloading this source code (e.g., from Netgear and TP-Link websites) eliminated the need for reverse engineering, significantly speeding up vulnerability discovery.

1. Mobile Phone Applications: To further expand the attack surface, the team analyzed companion mobile apps. These apps often communicate with custom services on the router over both LAN and WAN. Intercepting this traffic and reverse engineering the apps themselves revealed proprietary protocols and potential vulnerabilities.

1. Custom Tooling: To accelerate research, the team developed custom tools. An example is decalls, a script that, given firmware and a binary, uses Radare2 to analyze call paths for specific symbols like open, system, and execve. This helped quickly identify potential command injection vulnerabilities. For collaborative reverse engineering across different time zones, they leveraged IDA Teams and Ghidra's Version Control System to share and synchronize their work.

Key Findings

▶ Watch: TP-Link WAN: Stack Buffer Overflow with Heap Spray (13:30)

The NCC Group EDG team uncovered a significant number of vulnerabilities across the targeted SOHO routers, leading to multiple successful exploits at Pwn2Own Toronto. Their key findings highlight both complex memory corruption issues and a widespread prevalence of "low-hanging fruit" vulnerabilities, particularly command injection.

The team found and exploited multiple vulnerabilities in some cases on both the WAN and LAN interfaces of the devices. These included:

• TP-Link WAN (Messy JSON): A complex stack buffer overflow vulnerability in a proprietary UDP protocol (port 2002) related to TP-Link's mesh Wi-Fi technology. This required a sophisticated heap spray technique, enabled by a separate memory leak bug in the same binary, to achieve reliable code execution.
• Netgear WAN (pucfu binary): A critical Man-in-the-Middle (MITM) vulnerability due to SSL verification bypass (specifically, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER being disabled in curl calls). This allowed an attacker to impersonate the firmware update server and inject a malicious URL, leading to a straightforward command injection via sprintf and Pega_P_open.
• Netgear LAN (pu_http_sniff binary): Another command injection vulnerability found in a service that sniffs HTTP packets on port 80. By injecting malicious commands into the unsanitized User-Agent header, attackers could achieve arbitrary code execution via system().
• Synology WAN (DHCP client): A bash injection vulnerability within the router's DHCP client. An unsanitized domain name, provided by a malicious DHCP server, was passed to an environmental variable and then sourced by a shell script (dhcpcd-eth0.info), leading to command execution.
• Synology LAN (forget_password CGI script): A command injection flaw in the forget_password.cgi web script. The HTTP_CLIENT_IP header, also unsanitized, was used in an snprintf call that constructed an NMB_lookup command, allowing for arbitrary command execution.
• Ubiquiti WAN (DHCPv6 Prefix Delegation): A config injection vulnerability in the DHCPv6 Prefix Delegation functionality. An unsanitized domain name, provided by a malicious DHCPv6 server, was injected into a Perl script that constructed a configuration file. This allowed for the insertion of an execute command within the DHCP config file DSL, leading to command execution.

The successful exploitation of these vulnerabilities allowed the team to achieve root shells on multiple devices. Crucially, their SOHO Smashup chain, involving the Ubiquiti router and a Lexmark printer, was successful and did not suffer from collisions with other contestants, securing a significant portion of their winnings.

Overall, NCC Group's EDG team came in third place in the competition, winning a total of $78,000. The competition saw a large number of entries (42 in embedded categories), leading to significant collisions. The team experienced four collisions out of their six successful entries, and two of their discovered vulnerabilities were patched by vendors even before the competition began, underscoring the widespread nature of these issues. A key takeaway from the talk was the concerning prevalence of "low-hanging fruit" like command injection vulnerabilities, prompting questions about the effectiveness of vendors' SSDLCs in preventing such fundamental flaws.

Technical Deep Dive

▶ Watch: Synology WAN: DHCP Client Bash Injection Vulnerability (31:00)

The NCC Group team's success at Pwn2Own Toronto stemmed from a meticulous approach to vulnerability research, uncovering a diverse set of flaws ranging from complex memory corruptions to pervasive command injection vulnerabilities.

TP-Link WAN: Messy JSON (Stack Buffer Overflow & Memory Leak)

This vulnerability, codenamed "Messy JSON," existed in a proprietary UDP protocol listening on port 2002, used by TP-Link for its mesh Wi-Fi technology. Data transfer relied on an encrypted JSON payload, but the encryption key was hardcoded within the binary, easily extracted from the firmware.

The core vulnerability was a stack buffer overflow in the handling of the oneMeshSupportVersion key. The relevant binary had no stack canaries enabled, although ASLR was present on the library and heap, and NX was enabled. The code snippet revealed a cJSON_ParseWithLength function call, which parsed the incoming JSON string. It then retrieved the data object, followed by the oneMeshSupportVersion array. A for loop iterated over the array size, retrieving each item, validating it as a JSON number, casting its value to an unsigned byte, and storing it in a fixed-size 32-byte array on the stack within a shared_memory_client_structure. Critically, there was no bounds checking on the array size provided in the JSON payload. By supplying an array size greater than 32, the team could overflow the stack.

The stack corruption sequence was intricate: it first corrupted variables within the shared_memory_client_structure, including a cJSON pointer (the oneMeshSupportVersion_array_cjson_pointer). This pointer is used by cJSON_get_array_item in subsequent loop iterations. To continue the overflow and eventually reach the return address, this pointer had to point to valid cJSON objects in memory. Furthermore, the code corrupted one byte of this pointer on each iteration, necessitating four valid cJSON pointers to sustain the overflow.

To overcome the pointer corruption challenge, the team discovered a separate memory leak vulnerability in the same binary, specifically within the slaveKeyOffer function. This function also processed JSON payloads using cJSON_ParseWithLength, allocating cJSON structures on the heap. However, if certain conditions (e.g., the method key not equaling slaveKeyOffer) were not met, the function would return -1 without calling cJSON_Delete to deallocate the heap-allocated cJSON structures. This allowed for a controlled heap spray.

The exploit strategy involved:

1. Heap Spray: Triggering the slaveKeyOffer memory leak repeatedly with controlled JSON payloads to fill the heap with custom cJSON objects.
2. Trigger Overflow: Sending a malicious JSON payload to the oneMeshSupportVersion handler. As the stack overflow occurred, the corrupted cJSON pointer would successively point to the controlled cJSON objects on the heap, allowing the overflow to continue.
3. Code Execution: Once the return address was reached, it was overwritten with a ROP gadget (pop r0, LR; bxlr). r0 was loaded with the address of a system command string (led_cli usb_twinkle), and LR was loaded with the hardcoded address of the system() function (ASLR was not present on the binary itself). The bxlr instruction then transferred control, executing the arbitrary command and causing the router's USB light to flicker, providing proof of concept. The entire process, including the ~4m57s heap spray, was within the 5-minute competition limit.

Netgear WAN: pucfu (SSL Verification Bypass & Command Injection)

The Netgear WAN vulnerability targeted the pucfu binary, responsible for firmware updates. This binary connects to devcom.up.netgear.com on boot to check for updates. The process involved get_check_firmware calling firmware_check_API, which constructed a JSON request and passed it to call_Post for execution via curl.

The critical flaw was that Netgear had explicitly disabled SSL verification by setting CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER to 0. This allowed for a classic Man-in-the-Middle (MITM) attack. The team acted as a malicious DHCP server, providing their own DNS server, which resolved devcom.up.netgear.com to an attacker-controlled server. Using self-signed certificates, they impersonated the legitimate backend.

Once the attacker controlled the JSON response, they exploited a command injection vulnerability. The pucfu binary parsed the JSON response and used the URL key (intended for firmware download links) to construct a command via sprintf (using %s) before passing it to Pega_P_open (a wrapper around execve). By injecting a single quote, semicolon, and arbitrary command into the URL field, the team achieved root shell access via the WAN interface by starting telnet.

Netgear LAN: pu_http_sniff (HTTP User-Agent Command Injection)

On the LAN side of the Netgear router, the team discovered the pu_http_sniff binary. This unusual service used the netfilter subsystem to intercept HTTP packets on port 80 before they reached the standard web server. The handle_packet function extracted data, including the User-Agent header, and passed it to a function the team named exec_command.

This exec_command function attempted to map a WAN IP address to a user agent, using string_scanf and sprintf to construct a command based on the unsanitized User-Agent string. This constituted another command injection vulnerability, directly exploitable via a system() call. By sending a simple GET request with a specially crafted User-Agent header (e.g., User-Agent: fake_agent"; COMMAND_HERE; #), the team could execute arbitrary commands. The exploit involved uploading BusyBox, setting up iptables rules, and starting telnet to gain a root shell.

Synology WAN: DHCP Client (Bash Injection)

The Synology WAN vulnerability was found in the router's DHCP client, an open-source version with minor vendor modifications. The team focused on DHCP option parsing, a common source of vulnerabilities. They discovered that the domain name option, provided by the DHCP server, was not sanitized.

This unsanitized domain name was assigned to an environmental variable called DOMAIN. A script, dhcpcd-eth0.info, was executed by the dhcpcd client daemon when the interface came up. Crucially, this bash script sourced its first argument ($1), which contained the host info, including the attacker-controlled DOMAIN variable, without any sanitization. This allowed for direct bash injection. By setting up a malicious DHCP server that provided a domain name like "example.com; echo EDG=hello world > /tmp/test; touch /tmp/test", the team could execute arbitrary commands and gain a shell instantly.

Synology LAN: forget_password CGI (HTTP Client-IP Command Injection)

On the Synology LAN, a vulnerability was found in the /forgot_password.cgi web script. This script was responsible for parsing HTTP requests, and it called a custom function, Sino_CGI_get_remote_IP, which retrieved the HTTP_CLIENT_IP environmental variable. This variable, if set, would contain the client's IP address.

The code then passed this client IP to the Sino_auto_block binary, specifically through Sino_auto_block_check_denied and Sino_Net_lookup_IP. Within Sino_Net_lookup_IP, the client IP was used in an snprintf call with %s to construct an NMB_lookup command, which was then executed via P_open. Again, there was no sanitization of the HTTP_CLIENT_IP variable.

The exploit involved sending a GET request to /forgot_password.cgi with a Client-IP header containing a malicious command (e.g., Client-IP: 127.0.0.1; COMMAND_HERE; #). Due to certain bad characters, the team had to hex-encode parts of their payload, echo it to a file, and then execute a Python reverse shell to obtain a root shell.

Ubiquiti WAN: DHCPv6 Prefix Delegation (Config Injection)

The Ubiquiti WAN vulnerability was found in the DHCPv6 client, specifically within its Prefix Delegation functionality. This feature, used in IPv6 networks, allows a router to request and then allocate a range of public IPv6 addresses to devices on its internal networks. The vulnerability resided in the parsing of the domain search list option.

The dhcp6c_get_domain function looped through elements in the domain search list, calling dnsd_decode on each. While dnsd_decode performed some parsing, it failed to protect against certain "bad characters" like curly braces, double quotes, plus signs, dots, and slashes. This allowed an attacker to inject these characters into the domain name.

The unsanitized domain name was assigned to the new_domain_name environmental variable. This variable was then processed by a Perl script, ubnt_dhcp6c.pl, which handled DHCPv6 PD responses. The Perl script performed string concatenation to build a configuration file for the DHCP server on the LAN side. Critically, there was no robust regex validation or sanitization of the new_domain_name variable before it was incorporated into the config file.

This led to a config injection vulnerability. The team discovered that the DHCP config file DSL contained an execute command. By crafting a malicious domain name that terminated the current string in the config file, injected a semicolon to start a new command, and then used the execute directive with netcat (which was conveniently present on the Ubiquiti router), they could achieve a connect-back shell. Due to firewall rules, a link-local address was used for the connect-back. Payload size was constrained to 63 bytes due to IPv6 address length. The exploit ultimately resulted in a root shell on the Ubiquiti router.

Demo / Proof of Concept

▶ Watch: Soho Smash-up: New Multi-Stage Router Attack Category (39:30)

The speakers provided compelling video demonstrations for each major vulnerability, showcasing the practical execution of their exploits and the resulting compromise of the target devices.

• TP-Link WAN (Messy JSON): The demonstration began with a lengthy heap spray phase, consuming approximately 4 minutes and 57 seconds of the allowed five-minute competition window. This involved sending numerous crafted JSON payloads to trigger the memory leak. Once the heap was sufficiently sprayed, the final exploit payload was sent, triggering the stack buffer overflow. The proof of concept was visually confirmed when the router's USB light began to flicker on and off, indicating successful arbitrary code execution via the led_cli usb_twinkle command.

• Netgear WAN (pucfu): The video showed the attacker's system acting as a malicious DHCP server, providing its own DNS server address to the Netgear router. This allowed the attacker to MITM the router's firmware update check. The attacker-controlled server, using self-signed certificates, then served a malicious JSON response containing a command injection payload in the URL field. The demonstration clearly showed the command being executed on the router, resulting in the successful initiation of telnet and the acquisition of a root shell on the device from the WAN interface.

• Netgear LAN (pu_http_sniff): For this vulnerability, the demo depicted the attacker sending a standard HTTP GET request to the Netgear router's LAN interface. The crucial element was the User-Agent header, which contained the crafted command injection payload. Upon receiving this request, the pu_http_sniff binary processed the malicious User-Agent, leading to command execution. The proof of concept involved uploading BusyBox to the device, configuring iptables firewall rules, and successfully starting a telnet daemon, allowing the attacker to obtain a root shell.

• Synology WAN (DHCP Client): The demonstration highlighted the speed and simplicity of this attack. A malicious DHCP server was started, configured to offer an IP address lease along with a specially crafted domain name containing the bash injection payload. As soon as the Synology router obtained an IP address from this server, the dhcpcd daemon executed the vulnerable script, and the command injection instantly provided the attacker with a root shell on the device.

• Synology LAN (forget_password CGI): This demo illustrated the challenges of dealing with bad characters in a payload. The attacker started both a shell listener and an HTTP listener. The exploit involved sending an HTTP GET request to the forget_password.cgi script with a Client-IP header containing the hex-encoded command injection. The video showed the payload being echoed into a file on the router, then executed via a Python script to establish a reverse connect-back shell to the attacker's system, granting a root shell.

• Ubiquiti WAN (DHCPv6 Prefix Delegation) - Stage 1 of SOHO Mashup: The demonstration for the SOHO Mashup's first stage involved setting up a malicious DHCPv6 server. This server injected the command into the router's configuration file through the unsanitized domain name in the DHCPv6 Prefix Delegation response. The video showed the exploit quickly enabling telnet on the Ubiquiti router and initiating a connect-back, providing a root shell. As part of this stage, the exploit code automatically deployed the Python scripts required for the second stage onto the compromised router.

• Lexmark Printer (Stage 2 of SOHO Mashup): With the Ubiquiti router compromised, the demo seamlessly transitioned to the second stage. From the router's newly acquired root shell, the attacker executed the previously deployed Python script (./run_stage2.py) targeting the Lexmark printer on the LAN. While the specific printer vulnerability was not detailed in this talk (the speakers mentioned it would be covered in a separate presentation), the video concluded with the successful establishment of a shell on the Lexmark printer, demonstrating the full SOHO Mashup chain.

Defensive Implications

▶ Watch: Audience Q&A: Why choose printer for stage two? (56:30)

The findings from NCC Group's Pwn2Own research offer critical insights for both vendors and network defenders, highlighting widespread and persistent security weaknesses in SOHO networking equipment.

1. Prioritize Secure Software Development Lifecycle (SSDLC): The prevalence of "low-hanging fruit" vulnerabilities, particularly command injection, across multiple vendors points to systemic issues in their SSDLCs.

• Robust Input Validation and Sanitization: This is paramount. Every instance where external, untrusted input (e.g., JSON keys, HTTP headers like User-Agent or Client-IP, DHCP options) is processed or used in shell commands, string formatting, or configuration files, it must be rigorously validated and sanitized. Simple string concatenation or direct use of %s in sprintf with untrusted input is a recipe for command injection.
• Secure String Handling: Avoid deprecated or unsafe functions like sprintf when dealing with user-controlled data. Opt for safer alternatives that include bounds checking or use managed languages/libraries where possible.
• Memory Safety: Actively work to prevent memory corruption bugs like stack and heap overflows. This includes enabling compiler-level protections such as stack canaries, ensuring ASLR is fully effective across all binaries and libraries, and utilizing NX bits. Regular static and dynamic analysis (fuzzing) can help identify these issues.
• SSL/TLS Best Practices: Never disable SSL/TLS certificate verification (e.g., CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER should always be enabled). This creates a critical Man-in-the-Middle (MITM) vulnerability, completely undermining the security of communications.
• Open Source Component Management: Vendors must carefully review and track changes made to open-source components (like DHCP clients or cJSON libraries). Custom modifications can introduce new bugs, or vendors may fail to correctly backport patches for known vulnerabilities.
• Attack Surface Reduction: Minimize the number of exposed services, especially on the WAN interface. If a service isn't strictly necessary, it shouldn't be running or accessible.
• Code Review and Fuzzing: Implement rigorous code review processes and continuous fuzzing campaigns targeting all input-handling components.

1. Regular Firmware Updates: For end-users and small businesses, the most immediate defensive action is to keep all router and connected device firmware updated. ZDI's model ensures discovered vulnerabilities are reported to vendors for patching. Users should enable automatic updates where available or regularly check for and apply manual updates.

1. Network Segmentation: The success of the SOHO Mashup chain underscores the critical importance of network segmentation. If a router (or any device) on the WAN side is compromised, isolating other sensitive devices (printers, NAS, smart home devices) on a separate, more restricted LAN segment can limit the attacker's ability to pivot and cause further damage. Guest networks are a simple form of segmentation that can be leveraged.

1. Monitoring and Logging: Implement robust logging and monitoring on network devices. While consumer routers often have limited capabilities, any unusual outbound connections from the router (especially to unknown IP addresses or ports), unexpected service startups (e.g., telnet), or configuration changes should be flagged and investigated.

1. Strong Default Security: Vendors should ship devices with secure defaults. This includes strong, unique default passwords, SSH disabled by default if not strictly necessary, and all debugging/backdoor interfaces disabled or removed in production firmware.

1. Physical Security: While not directly related to software vulnerabilities, the need for hardware modifications (like for the TP-Link router) highlights that physical access can bypass software controls. Routers should be kept in secure locations to prevent tampering.

The high number of collisions and pre-competition patches indicate that these types of vulnerabilities are not isolated incidents but rather endemic issues across the SOHO router landscape. Addressing them requires a concerted effort from vendors to improve their fundamental security engineering practices.

Key Takeaways

• Command injection remains a pervasive and critical vulnerability in SOHO routers, primarily due to poor input sanitization and insecure string handling in vendor-modified code and proprietary services.
• The "SOHO Mashup" category at Pwn2Own vividly demonstrates the severe risk of pivoting from a compromised router (WAN) to other devices on the internal network (LAN), emphasizing the need for robust network segmentation.
• Vendors frequently disable critical security features like SSL verification in their code, opening the door for trivial Man-in-the-Middle (MITM) attacks and enabling further exploitation.
• Even well-known open-source components, when integrated or modified by vendors, can become sources of new vulnerabilities or be incorrectly patched, leading to exploitable flaws.
• Effective vulnerability research requires a multi-faceted approach, combining systematic firmware analysis, network traffic capture, custom tooling (like decalls), and collaborative reverse engineering to uncover both complex memory corruptions and "low-hanging fruit" logic flaws.
• The high number of successful entries, collisions among contestants, and pre-competition patches strongly indicate a systemic issue in vendor Secure Software Development Lifecycles (SSDLCs) for embedded devices.

About the Speaker(s)

The talk was presented by Alex Plaskett and McCaulay Hudson, members of the Exploit Development Group (EDG) at NCC Group. The EDG, which also includes Cedric and Aaron, is a specialized team within NCC Group dedicated to quantifying the real-world impact, feasibility, and risk of cyber threats for their clients. Their mission involves mimicking high-end, sophisticated attacks to provide clients with a realistic assessment of their security posture. Both Alex and McCaulay bring a variety of expertise in exploit development, honed through their participation in high-stakes competitions like Pwn2Own. Their deep dive into SOHO router exploitation at Pwn2Own Toronto showcases their practical experience in identifying, chaining, and demonstrating complex vulnerabilities in embedded systems.