How I found critical vulnerabilities in Petlibro smart pet feeders allowing complete account takeover via broken OAuth, access to anyone's pet data, device hijacking, and private audio recordings - and how they're still leaving the auth bypass active for 'legacy compatibility' two months later.

I was looking at the Petlibro app - they make smart pet feeders, water fountains, and other IoT pet products. Millions of pet owners use these things to feed their cats and dogs remotely.

What I found was… a lot.

  • mfed1122English
    9·
    1 month ago

    $500 seems offensively low for how bad this is. This is the second vulnerability I’ve seen from this guy where the company security seemed just unbelievably bad. Like it’s basically non-existent.

    • winkerjadams@lemmy.dbzer0.comEnglish
      2·
      1 month ago

      There’s no consequences or accountability when they get hacked so they have no reason to care. Its just $500 gone with no potential profit to them. And capitalism gonna capitalism