Kaspersky says malware reached Android car head units through the vendor's own update mechanism, using a flag that installs apps the device never had. The payload has no interface at all.
Perspective Coverage
8 publishers
- Builder
- Builder 36%
- Operator
- Operator 50%
- Investor
- Investor 14%
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap+20
- Incentives45
- Confidence68
Black Lotus Labs counted about a dozen compromised enterprises, mostly in Asia and South America, on a framework that has been publishing operator commands to infected hosts through IoT message brokers since 2024.
Perspective Coverage
3 publishers
- Builder
- Builder 27%
- Operator
- Operator 62%
- Investor
- Investor 11%
Reality
- Evidence66
- Adoption18
- Hype gap+20
- Incentives
- Insufficient
- Confidence64
buildOne report1 publisher The Rust reimplementation of eKuiper now hydrates streams, rules and auth keys from SQLite at startup and serves them from a lock-guarded HashMap, after profiling blamed flash I/O on eMMC gateways for the engine's burst-load packet loss.
Reality
- Evidence44
- Adoption10
- Hype gap+22
- Incentives72
- Confidence46
buildOne report1 publisher The ESP32-S3 example generates the device key on the chip and sends only a CSR to AWS IoT Core. The credential that gets it there is a claim certificate and private key copied into the SPIFFS image every unit shares.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+22
- Incentives30
- Confidence55
CISA's advisory for the Android and iOS app describes read access to real-time data for every active device on a shared broker. The fix is an app store update, and a credential already extracted still works until Bransys changes it.
Reality
- Evidence68
- Adoption25
- Hype gap0
- Incentives30
- Confidence70
Gleb Tcivie's open source monitoring tool outgrew Prometheus once node identity in metric labels blew past the 10-second scrape budget. It now runs on one Postgres database with TimescaleDB.
Reality
- Evidence46
- Adoption31
- Hype gap+14
- Incentives82
- Confidence54
buildOne report1 publisher I-Dacs Labs rebuilt LF Edge eKuiper in Rust around a windowed path that stores no rows, and it reports 5 to 10 MB of memory on the workloads where the Go engines it tested climbed toward the 1 GB limit of the box.
Reality
- Evidence38
- Adoption
- Insufficient
- Hype gap+25
- Incentives82
- Confidence50
A publication ban lifted this week on the case Profero opened in April, when its responders pulled a 101MB RAT that had reportedly reached dozens of Israeli companies through a security vendor's own endpoint component.
Publishers:pc.co.il
Reality
- Evidence52
- Adoption61
- Hype gap+30
- Incentives68
- Confidence47
buildOne report1 publisher Kaspersky says the factory updater on DoFun Android car head units installed whatever an MQTT broker told it to. No CVE was involved in turning shipped cars into proxy nodes.
Reality
- Evidence62
- Adoption30
- Hype gap+5
- Incentives55
- Confidence58