YoSmart YoLink Hub version 0382

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://bishopfox.com/blog/yosmart-yolink-hub-version-0382
• Blog Title: YoSmart YoLink Hub version 0382
• Suggested Section: Generic Methodologies & Resources > Pentesting Network > MQTT Security & Attacks (IoT/MQTT)

🎯 Content Summary

Target: YoSmart YoLink Hub (IoT gateway). Version: 0382 (released March 23, 2025). Advisory type: Multiple remotely exploitable issues affecting broker, cloud API, and session handling. Status: No vendor fix; disclosure on October 2, 2025.

How YoLink works (relevant pieces)
• YoLink devices/hub/app communicate via cloud MQTT brokers (e.g., mq-yl-appt.yosmart.com:8001 and mq-yl-gw-lb.yosmart.com:8001).
• Device topics i...

🔧 Technical Details

Predictable device IDs + weak broker ACLs => cross‑account control. When a broker authorizes by topic only and device IDs equal MACs, enumerate MACs (OUI + sequential patterns or local sniffing) and publish to /ys/<deviceId>/tx using any valid account’s MQTT creds to call methods like MFLock.setState for unauthorized actions.

API credential harvest via firmware‑derived MD5. If a cloud endpoint returns device MQTT creds for GET /pf/<deviceId>/<MD5>, reverse the hub firmware to learn the secret, compute MD5(UPPER(deviceId || secret)), retrieve creds, then subscribe to hub admin topics (e.g., ylgw*/admin) to capture sensitive messages (Wi‑Fi SSID/password) or disrupt the hub.

Exploiting cleartext MQTT transport. If clients use MQTT without TLS, passively sniff TCP/8001 to recover app/hub credentials, device IDs, and JSON control payloads, then replay/modify t...

🤖 Agent Actions

I analyzed the repository and identified src/network-services-pentesting/1883-pentesting-mqtt-mosquitto.md as the best place to incorporate the techniques from the Bishop Fox blog, since it already hosts MQTT pentesting content and is the canonical location for MQTT attacks in HackTricks. I reviewed at least five relevant files to understand structure and cross-linking:

• src/network-services-pentesting/1883-pentesting-mqtt-mosquitto.md
• src/hardware-physical-access/firmware-analysis/README.md
• src/generic-methodologies-and-resources/pentesting-network/README.md
• src/generic-hacking/brute-force.md
• src/generic-methodologies-and-resources/pentesting-wifi/README.md

What I added

• A new section “IoT/MQTT attack patterns (broker ACLs, cloud APIs, cleartext transport)” to the MQTT page with four IoT-focused attack flows:
  1. Predictable device IDs + weak broker ACLs => cross-account control (topic patterns, MAC enumeration, mosquitto_pub example)
  2. Cloud API credential harvest via firmware-derived secret (firmware RE hints, MD5/HMAC reproduction, curl example, subscribing to admin topics)
  3. Exploiting cleartext MQTT transport (tcpdump/wireshark reconnaissance and replay)
  4. Abusing long-lived sessions/tokens (reuse old MQTT credentials/tokens)
• A “Detection and hardening ideas” subsection with actionable mitigations.
• Command examples using mosquitto_pub/sub to illustrate the attack flows.
• An internal reference to the Firmware Analysis page for extracting firmware secrets:
  {{#ref}}
  ../hardware-physical-access/firmware-analysis/README.md
  {{#endref}}
• A “References” section added at the end of the MQTT page including:
  • The Bishop Fox blog URL (primary source)
  • Aircrack‑ng (airodump‑ng)
  • Ghidra SRE
  • Eclipse Mosquitto clients

File modified

• src/network-services-pentesting/1883-pentesting-mqtt-mosquitto.md

Why here and not a new page

• The techniques are MQTT-specific and fit naturally into the existing MQTT pentesting page. They generalize beyond the single vendor and add high-value IoT/MQTT abuse patterns that weren’t present.

No other files required updates. The changes follow HackTricks style, preserve existing content, include proper markdown, and add references at the end of the file.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 896
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://bishopfox.com/blog/yosmart-yolink-hub-version-0382

Content Categories: Based on the analysis, this content was categorized under "Generic Methodologies & Resources > Pentesting Network > MQTT Security & Attacks (IoT/MQTT)".

Repository Maintenance:

• MD Files Formatting: 896 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0