Performing IoT Security Assessment

When to Use

• Evaluating the security of IoT devices before deployment in enterprise or critical infrastructure environments
• Assessing consumer IoT products for security vulnerabilities as part of product security review or certification
• Testing industrial IoT (IIoT) devices for vulnerabilities that could affect operational technology environments
• Analyzing firmware for backdoors, hardcoded credentials, and known vulnerabilities in embedded components
• Evaluating the security of the complete IoT ecosystem including device, cloud backend, and mobile companion app

Do not use against IoT devices without written authorization, for modifying firmware on devices you do not own, or against medical devices or safety-critical systems without specific medical device testing authorization and safety protocols.

Prerequisites

• Physical access to the target IoT device(s) for hardware analysis and testing
• Hardware tools: USB-to-UART adapter (FTDI), Bus Pirate, logic analyzer, JTAG debugger (Segger J-Link), SPI flash programmer (CH341A)
• Firmware analysis tools: Binwalk, Firmwalker, Firmware Analysis Toolkit (FAT), Ghidra, QEMU for emulation
• Network analysis: Wireshark, tcpdump, Bluetooth tools (Ubertooth, nRF Connect), Zigbee tools (KillerBee)
• Soldering equipment for accessing hardware debug points if needed

Workflow

Step 1: Device Reconnaissance and Hardware Analysis

Examine the physical device and identify attack surfaces:

• External inspection: Document all physical interfaces (USB, Ethernet, serial ports, SD card slots), labels, FCC ID, and model numbers
• FCC ID lookup: Search the FCC database (fcc.gov/oet/ea/fccid) using the FCC ID to find internal photos, schematics, and radio frequency information
• PCB analysis: Open the device enclosure and photograph the PCB. Identify:
  • Main processor/SoC (read markings, search datasheet)
  • Flash memory chips (SPI NOR, NAND, eMMC)
  • Debug headers and test points
  • UART/JTAG/SWD pins (look for 4-pin or 10-pin headers, or unpopulated pads)
• UART identification: Use a multimeter to identify UART pins (TX, RX, GND, VCC). Connect USB-to-UART adapter and attempt serial console access at common baud rates (9600, 38400, 57600, 115200)
• JTAG identification: Use JTAGulator or manual probing to identify JTAG pins (TCK, TMS, TDI, TDO, TRST). Connect JTAG debugger for memory access and debugging.

Step 2: Firmware Extraction and Analysis

Extract and analyze the device firmware:

• Firmware acquisition methods:
  • Download from manufacturer website or update server
  • Extract from flash memory using SPI programmer: connect CH341A to SPI flash, read with flashrom -p ch341a_spi -r firmware.bin
  • Capture over-the-air updates via network interception
  • Extract from UART bootloader console (U-Boot: md.b memory dump)
• Firmware unpacking: binwalk -e firmware.bin to extract filesystem, kernel, and bootloader components
• Filesystem analysis:
  • Search for credentials: grep -rn "password\|passwd\|secret\|key" squashfs-root/
  • Examine /etc/shadow for password hashes
  • Review startup scripts in /etc/init.d/ for insecure service configurations
  • Identify web server configurations and CGI scripts for web interface vulnerabilities
  • Use Firmwalker: ./firmwalker.sh squashfs-root/ for automated sensitive data discovery
• Binary analysis: Use Ghidra to reverse engineer key binaries (web server, management daemon, authentication modules) for hardcoded credentials, command injection, and buffer overflow vulnerabilities
• Known vulnerability scanning: Extract software versions and cross-reference with CVE databases. Use firmware-analysis-toolkit for automated CVE scanning.

Step 3: Network Communication Analysis

Analyze all network traffic from the IoT device:

• Traffic capture: Connect the device to a network with traffic mirroring (SPAN port) or use an inline transparent bridge. Capture all traffic with Wireshark.
• Protocol analysis: Identify all protocols used (HTTP, HTTPS, MQTT, CoAP, AMQP, custom TCP/UDP). Check for unencrypted sensitive data transmission.
• TLS analysis: Verify TLS implementation: certificate validation, cipher suite strength, certificate pinning. Attempt MITM interception with Burp Suite.

…