Report: IoT Still Wildly Insecure as New ‘Credential Compromise’ Threat Emerges

Barracuda Networks disclosed multiple vulnerabilities in the web and mobile applications supporting a popular connected security camera that allow attackers to capture user credentials and take control of devices. Researchers demonstrated two exploitation paths: a compromised/hostile network using an SSL-proxy to intercept and tamper with mobile-app credentials, and an XSS payload embedded in shared device names that exfiltrates web access tokens, enabling full account takeover and potential lateral movement across local IoT networks. The report warns of impacts from harmless-seeming pranks to theft of personal and financial data, and recommends mitigations such as proper TLS certificate validation, web application firewalls, timely patching, and better manufacturer security practices.