The Internet of Things is Held Together With Duct Tape and Default Passwords[Badly]

My smart light bulb tried to mine crypto last Tuesday.

Not a joke. Not a metaphor.

I have a cheap Tuya bulb I bought from for $12.99 in 2023. "Smart Life" app, WiFi enabled, 16 million colors, works with Alexa. I put it in my closet so I could say "closet on" and feel like I'm in .

At 3:17 AM, my network monitor woke me up. Not an alarm — just a little red dot on my Grafana dashboard. My closet bulb had uploaded 400MB of data to an IP address in Shenzhen and was now holding a persistent outbound connection on port 3333. Port 3333 is not for turning on lights. Port 3333 is for Monero mining pools.

I unplugged it. I took it apart. Inside was an ESP8266 clone, 2MB of flash, firmware from 2019 with a hardcoded Telnet password: admin:admin. And a little bonus binary called xmr_mini hidden in a partition that shouldn't exist.

That bulb was $13. It had no business having enough brains to betray me, but it did. And it's not alone. Your house is full of them.

Welcome to the Internet of Shit.

The Lie We All Bought

The IoT pitch was beautiful: everything connected, everything smart, everything effortless.

The reality is this: a $400 billion industry built on the cheapest possible chips, running the oldest possible Linux kernels, written by the lowest bidder, shipped with default credentials that haven't changed since 2008.

Here's the math that kills you:

A company wants to sell a smart plug for $9.99.

• The ESP8266 chip costs $0.89
• The relay costs $0.40
• The plastic costs $0.30
• The profit margin needs to be $4

Where do you think they cut costs? Security audits? Code review? A firmware update server?

No. They cut everything.

They take the SDK example code from Espressif that says // TODO: CHANGE DEFAULT PASSWORD, they don't change the default password, they compile it, and they ship 500,000 units.

I've dumped firmware from 23 different IoT devices in the last year. Light bulbs, cameras, doorbells, pet feeders, a smart toaster — yes, a toaster that can run Doom and also get botnetted.

Here is what I find, every single time:

1. Telnet or SSH open with root:root or admin:admin
In 2026. After Mirai. After 8 years of us screaming about Mirai.

2. A web server running as root from 2016
With a CVE list longer than my grocery list. No update mechanism. Ever.

3. Hardcoded MQTT credentials
One username and password for every device they ever sold. mqtt_user: TuyaSmart123! — I found that in 4 different brands.

4. Cloud buckets with no auth
Your camera footage, your voice clips, your WiFi password — sitting in an open S3 bucket because the intern left public: true in the config.

This isn't a bug. This is the business model.

My Living Room Botnet Census

I got angry after the light bulb thing, so I did what any normal person does: I turned my apartment into a surveillance state for my own devices.

I took that $26 GL.iNet Mango router — the little yellow travel router everyone buys for hotel WiFi — and I made it my border guard.

I flashed it with OpenWrt. Put it between my modem and my real router. Installed:

• Pi-hole to DNS-blackhole every ad, tracker, and telemetry domain
• AdGuard Home as backup
• Suricata in IDS mode to watch what my devices actually say

Then I let it run for 7 days. I didn't block anything. I just watched.

Here is what my "smart" home does when I'm not looking:

My $35 Wyze camera: Pings wyze-log.s3.amazonaws.com every 30 seconds, even when I have "record only on motion" turned off. Uploaded 2.1GB in a week. Of what? I'm not recording 2.1GB of my living room wall.

My smart TV (TCL ): At 2am every night, it resolves 47 different ad domains. It tried to reach doubleclick.net 14,000 times in 7 days. Fourteen thousand. It also sends my WiFi SSID and a list of nearby SSIDs to Roku every 6 hours. Why does Roku need to know my neighbor's WiFi name?

My robot vacuum: Sent a compressed map of my apartment — literally a floorplan of where my bed is — to a server in Singapore. The privacy policy says "to improve cleaning." My bed doesn't need to be in Singapore.

My wife's smart toothbrush: Yes, this exists. It sends brush time, pressure, and location to . 19 times a day.

The worst offender? A $19 smart plug from a brand that doesn't exist anymore. It tried to SSH into my NAS. My own plug tried to brute force my own NAS on my local network. Because its firmware had Mirai's old dictionary baked in and it scans /24s automatically.

We put computers that actively attack other computers inside our houses and then act surprised when they do.

Why Your Router is Lying to You

Your ISP router is not a router. It's a plastic box designed to blink green so you stop calling tech support.

It does NAT. It does WiFi badly. It does not inspect traffic. It does not tell you that your light bulb is mining Monero. It will never tell you.

You need a watchtower.

This is why I tell everyone to build a $20 SOC — Security Operations Center. It sounds insane. SOCs are for enterprises with 6 monitors and cold brew on tap. But a $20 SOC is just a tiny Linux box that sits and judges all your other boxes.

The Mango costs $20-26 on Amazon. Total build with a USB stick for logs is under $30. It draws 2 watts. It has no subscription. It will outlive your smart fridge.

What it gives you:

• Visibility. For the first time, you see that your bulb is talking to 45.76.123.89 at 3am. That alone is worth it.
• Blocking at the root. Pi-hole kills ads, trackers, and 80% of malware C2 domains before they even leave your house. Your TV gets dumber — which is good. Dumb TVs can't snitch.
• Receipts. When that bulb gets popped, you have logs. When you call the manufacturer and they say "impossible," you send them a pcap. They shut up very fast.

The second part of my setup is even more paranoid: an offline box.

I have a Raspberry Pi Zero 2 W — $35 if you're lucky — running a local LLM completely offline. No WiFi, no cloud. I call it the Blackbox. I feed it suspicious firmware dumps, weird log lines, long ToS documents I don't want to upload to ChatGPT. It summarizes, it finds hardcoded creds, it writes abuse emails. Nothing ever leaves my apartment.

When you're dissecting a light bulb that tried to rob you, you don't want to paste its private key into someone else's cloud.

The Fix Isn't What You Think

People want me to say "don't buy smart devices." That's not realistic. I'm not going to hand-wash dishes because my dishwasher has WiFi.

The fix is hostile architecture. Treat every IoT device like it's already compromised, because statistically, it is.

My rules now:

1. VLAN or it didn't happen. All IoT shit goes on its own WiFi network that can't talk to my laptops, NAS, or phones. The Mango makes this 3 clicks. Your main router probably doesn't. That's why you need the Mango.

2. No internet unless it proves it needs it. My light bulbs don't need internet to turn on. I block their internet at DNS level. If they stop working, good — I return them and buy ones that work locally with Home Assistant or ESPHome. If a light bulb requires the cloud to turn on, it's not a light bulb, it's a subscription to light.

3. Flash or trash. If a device runs ESP8266/ESP32, I flash it with Tasmota or ESPHome immediately. Open firmware, local control, no cloud, no mystery binaries. It takes 10 minutes and it turns a spy into a tool. If I can't flash it, I don't buy it.

4. Assume default passwords. First thing I do with any new device: nmap it. nmap -p 23,22,80,8080 <its IP>. If Telnet is open, I try admin/admin, root/root, admin/password. It works 60% of the time. I then change it or brick it.

5. Log everything for 7 days. When you get a new device, put it in the watchtower and just watch. If it phones home 14,000 times, you know.

The IoT industry will not fix itself. There is no incentive. A $13 bulb that is secure costs $15. And $15 loses to $13 on Amazon every time. Security is invisible until it fails, and failure is externalized onto you.

The only person who can secure your house is you. And it doesn't take a $10,000 rack. It takes $26, a USB stick, and the willingness to accept that your smart home is actually a very dumb botnet that you happen to live in.

My closet light is now running ESPHome. It turns on. It turns off. It doesn't mine crypto. It doesn't talk to Shenzhen. It took me 20 minutes to flash.

It is the only smart device in my house I trust.

The rest are in jail.

---

Want to build the same jail I use?

This is the exact defensive stack from this story — the parts lists, flash commands, Pi-hole blocklists, and Suricata rules I use so my own light bulbs can't betray me:

The $20 SOC: Build a Tiny Defensive Network Monitor — The Mango build, step-by-step. How to put a Pi-hole + IDS between your modem and your whole house, VLAN your IoT, and finally see what your TV does at 2am. My live configs and power measurements inside: numbpilled.gumroad.com/l/20dollarsoxc

BUILD THE BLACKBOX: An Offline AI Field Terminal That Works When Nothing Else Does — The Pi Zero that runs Phi-3/Gemma locally with no cloud. I use it to dissect firmware, parse logs, and draft abuse reports without ever sending your home data to OpenAI: numbpilled.gumroad.com/l/blackbox-offline-ai