The LG TV network scanning story breaking today includes UDP 9999 Kasa discovery broadcasts every 25 seconds. That's the exact port I documented in CVE-2026-13230 as returning unauthenticated precise GPS coordinates from Kasa cameras with no authentication. Any LG TV + unpatched Kasa camera on the same network = GPS harvesting every 25 seconds. @briankrebs@infosec.exchange Advisory: https://github.com/BadChemical/IoT-Vulnerability-Research-Public/blob/main/TP-Link_Kasa_EC71/Kasa_EC71.md
@BadChemical@infosec.exchange @briankrebs@infosec.exchange Any Chinese product (which would be most products these days) that connects to the Internet is probably pwnable, security simply isn’t a priority because the vast majority of the people they sell to don’t know or care, and the market costs for bad security are zero.
The main business threat would be the Trump admin using security as an excuse for bans or tariffs, and paying him off directly is almost surely cheaper than investing in long-term security work 😔