| name | performing-iot-security-assessment |
| description | Performs comprehensive security assessments of IoT devices and their ecosystems by testing hardware interfaces, firmware, network communications, cloud APIs, and companion mobile applications. The tester uses firmware extraction and analysis, hardware debugging via UART and JTAG, network protocol analysis, and runtime exploitation to identify vulnerabilities across all layers of the IoT stack. Activates for requests involving IoT security testing, embedded device assessment, firmware security analysis, or smart device penetration testing.
|
| domain | cybersecurity |
| subdomain | penetration-testing |
| tags | ["IoT-security","firmware-analysis","embedded-systems","hardware-hacking","UART-JTAG"] |
| version | 1.0.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"] |
| mitre_attack | ["T1595","T1190","T1059","T1078","T1078.004"] |
Performing IoT Security Assessment
When to Use
- Evaluating the security of IoT devices before deployment in enterprise or critical infrastructure environments
- Assessing consumer IoT products for security vulnerabilities as part of product security review or certification
- Testing industrial IoT (IIoT) devices for vulnerabilities that could affect operational technology environments
- Analyzing firmware for backdoors, hardcoded credentials, and known vulnerabilities in embedded components
- Evaluating the security of the complete IoT ecosystem including device, cloud backend, and mobile companion app
Do not use against IoT devices without written authorization, for modifying firmware on devices you do not own, or against medical devices or safety-critical systems without specific medical device testing authorization and safety protocols.
Prerequisites
- Physical access to the target IoT device(s) for hardware analysis and testing
- Hardware tools: USB-to-UART adapter (FTDI), Bus Pirate, logic analyzer, JTAG debugger (Segger J-Link), SPI flash programmer (CH341A)
- Firmware analysis tools: Binwalk, Firmwalker, Firmware Analysis Toolkit (FAT), Ghidra, QEMU for emulation
- Network analysis: Wireshark, tcpdump, Bluetooth tools (Ubertooth, nRF Connect), Zigbee tools (KillerBee)
- Soldering equipment for accessing hardware debug points if needed
Workflow
Step 1: Device Reconnaissance and Hardware Analysis
Examine the physical device and identify attack surfaces:
- External inspection: Document all physical interfaces (USB, Ethernet, serial ports, SD card slots), labels, FCC ID, and model numbers
- FCC ID lookup: Search the FCC database (fcc.gov/oet/ea/fccid) using the FCC ID to find internal photos, schematics, and radio frequency information
- PCB analysis: Open the device enclosure and photograph the PCB. Identify:
- Main processor/SoC (read markings, search datasheet)
- Flash memory chips (SPI NOR, NAND, eMMC)
- Debug headers and test points
- UART/JTAG/SWD pins (look for 4-pin or 10-pin headers, or unpopulated pads)
- UART identification: Use a multimeter to identify UART pins (TX, RX, GND, VCC). Connect USB-to-UART adapter and attempt serial console access at common baud rates (9600, 38400, 57600, 115200)
- JTAG identification: Use JTAGulator or manual probing to identify JTAG pins (TCK, TMS, TDI, TDO, TRST). Connect JTAG debugger for memory access and debugging.
Step 2: Firmware Extraction and Analysis
