What’s in the Box? Part II: Hacking the iParcelBox

McAfee ATR examined the iParcelBox secure package delivery system and found that developer-posted credentials and insecure cloud permissions allowed an attacker to unlock devices, extract sensitive certificates/keys and obtain primary-owner access via AWS IoT queries; predictable MAC generation made targeting easier. The vendor was notified and remedied the leaks and misconfigurations promptly.