Cloud Break: IoT Devices Open to Silent Takeover Via Firewalls

IoT devices can be compromised due to gaps in cloud management interfaces for firewalls and routers, even if security software is in place or devices are not online. In a PoC presented at Black Hat Europe in London, Jincheng Wang, a Nanjing University master’s candidate, and independent security researcher Nik Xe demonstrated a method to take over devices en masse without any vulnerabilities or IP addresses.

The attack hinges on how IoT devices authenticate to the cloud; if cloud servers rely on static identifiers such as serial numbers or MAC addresses, an attacker can impersonate a device and impersonate a cloud management channel to issue administrative commands. The researchers argue that updating authentication to use more robust, random credentials tied to the cloud management app is essential, and suggest checks when device IP addresses change as part of a defence.

They emphasise that cloud channels are widely overlooked, affect many devices, are hard to patch, and that attacks through them are difficult to trace. The piece, by Nate Nelson, was published on 18 November 2025 and highlights the ongoing risk to organisations from cloud-managed IoT devices.