Finished
IoT thermostat security audit
Security audit of a commercial IoT thermostat and all the infrastructure around it: the device itself, the mobile app and the servers it talks to. Work for a university course that ran for several months (2025-2026).
What I did and how it works
- Audit of the thermostat and its whole ecosystem: configuration, behaviour, internet and phone connectivity, and attempts to intercept the messages they exchange.
- Reverse engineering of the mobile app to understand how it talks to the device and to the cloud.
- Following that trail step by step, I found servers that appeared to belong to the manufacturer and had critical vulnerabilities, including remote code execution (RCE).
Results
- Uncovered 3+ critical vulnerabilities: backend RCE, plaintext credential storage and hardcoded API keys.
- Remediation-prioritized report with PoC reproduction steps.