11 Jan, 2018
IOT Penetration Testing
Penetration Testing
Reading Time: 2 minutes

What is IOT Penetration Testing?
The IOT Penetration Testing is more like checking the vulnerabilities of the IOT device which it can consider as checking for any weakness on the IOT Device
The advantages of IoT penetration testing is that

  • Strengthening device security,
  • Protecting against unauthorized usage,
  • Avoiding Elevation of Privileges,
  • Lower reducing the risk of compromise,
  • Better user and data privacy,
  • Set the Encryption strong to avoid man-in-the-middle (MTM) attacks.

Don Green, mobile security manager of Threat Research Center at WhiteHat Security, also agrees that

IoT assessments are inherently more complicated because there is more hardware, software, and communication protocols involved.

He also said that

“This translates into a larger attack surface and a wider array of attack vectors. A successful IoT assessment requires that the electronic ecosystem for a specific IoT device is thoroughly mapped and a detailed assessment plan is developed,”

Lure an end-user to open the Phshing email. These phishing emails usually comes with a well crafted email with a malicious hyperlink to a site which contains other payloads. The payloads could come in document attachment where it will contain some malware that been stored in the attachment. However, the world of IOT is different because there will be end-user handling the device. As a result, the attacker will have nobody to lure in and it will be challenging to comprise any embedded device
Diversity in IOT is the only different between traditional and non-traditional IOT Penetration Testing.

Traditional Testing Non-traditional Testing
  • With IOT been implement, the new architectures where it will be uncommon for most Security Tester.
  • Traditional Testers can get entirely lost in the vulnerabilities of embedded devices.
  • Testing in the IoT environment will be need an greater knowledge of non-traditional devices operating systems,communications and protocols  such as  connected TVs, cameras, smart buildings and other assets are unlike PCs and servers,

What are the steps?
The following is the step that need to be doing to conduct the IOT Penetration Testing
The Security tester need to have a knowledge of network security structure so that they can determine the protocol that been used and what kind of information that might be leaked out to the public.
The Security Tester also need to have a good knowledge of the normal web application testing where the purpose of it is to check and see for any weakness with any of the web based configuration interface that been implement on the device. A tester has to be good at embedded engineering, and usi.ng engineering tools to find and back door testing interfaces
The Security Tester should have a very good knowledge of reverse engineering and also decompiling the application for the raw extracted firmware. Because of that, the tester need to have a basic of assembly language so that the tester can completely reverse the application so that the tester can determine whether the application can be attack or comprise.