IoT Hacking

IoT Hacking Methodology

Hardware and firmware security testing — from device acquisition to firmware extraction, hardware debugging, and network protocol attacks.

## Phase 1 — Device Reconnaissance

1.1

OSINT & Initial Recon

› FCC ID lookup (fcc.io) for FCC filings, internal photos, schematics
› Shodan / Censys — exposed device management interfaces
› CVE database check for known vulnerabilities in chipset/firmware
› Manufacturer documentation, GPL source releases
› Network scanning: nmap, masscan — identify open ports and services

1.2

Physical Inspection

› Identify exposed UART, JTAG, SPI, I2C test points on PCB
› Chip identification: part numbers, datasheets
› Photography and mapping of board layout
› Check for debug interfaces, unpopulated headers
› NAND/NOR flash chips — identify for direct chip-off extraction

## Phase 2 — Firmware Acquisition

2.1

Firmware Extraction Methods

› From manufacturer website or update mechanism
› UART console — interrupt boot, mount filesystem, copy firmware
› TFTP / OTA capture — intercept update traffic with Wireshark
› SPI flash dump: flashrom with CH341A / Bus Pirate
› JTAG / OpenOCD — read flash directly from debug interface
› Chip-off: desolder flash, read with programmer (easy as programming!)

2.2

Firmware Unpacking

› binwalk -e <firmware.bin> — extract filesystem, kernel, squashfs
› Identify filesystem type: squashfs, cramfs, jffs2, ubifs
› jefferson for JFFS2, ubireader for UBI images
› Encrypted firmware: find encryption keys in bootloader, previous versions
› QEMU emulation: firmwalker + buildroot for ARM/MIPS emulation

## Phase 3 — Firmware & Binary Analysis

3.1

Static Analysis

› Extract and analyze filesystem: etc/passwd, shadow, config files
› Find hardcoded credentials: grep -r 'password\|passwd\|admin' rootfs/
› Identify web server, CGI scripts, and API endpoints
› Binary analysis with Ghidra / IDA Pro / Radare2
› Check for dangerous functions: strcpy, system(), popen() in binaries

3.2

Dynamic Analysis / Emulation

› Emulate with QEMU: qemu-arm-static for ARM userspace binaries
› Full system emulation with Firmadyne / FAT (Firmware Analysis Toolkit)
› GDB remote debugging via QEMU + gdb-multiarch
› Fuzz HTTP/CGI endpoints with ffuf once emulation is running
› Hook function calls with Frida for dynamic analysis

## Phase 4 — Hardware Interface Attacks

4.1

UART (Serial Console)

› Identify UART pins: TX, RX, GND, VCC with multimeter or logic analyzer
› Determine baud rate: logic analyzer capture + sigrok / PulseView autobaud
› Connect: USB-to-UART adapter (CP2102, CH340) at 3.3V
› Interrupt boot at U-Boot prompt: drop to shell or modify boot args
› Access root shell: init=/bin/sh or break out of restricted shell

4.2

JTAG Debugging

› Identify JTAG pins: TDI, TDO, TCK, TMS, TRST with JTAGulator
› Connect with OpenOCD + compatible debugger (Bus Blaster, J-Link)
› Halt processor, read registers, dump memory regions
› Extract firmware directly from memory over JTAG
› Set hardware breakpoints for runtime analysis

4.3

SPI / I2C Bus Analysis

› Logic analyzer capture with Sigrok to identify protocol
› SPI flash dump: flashrom -p ch341a_spi -r dump.bin
› I2C scan: i2cdetect, then read/write EEPROM chips
› SPI bus sniffing during firmware update for key extraction
› EEPROM modification — change config, unlock hidden features

## Phase 5 — Network & Protocol Attacks

5.1

MQTT

› Broker discovery: nmap -p 1883,8883 / Shodan query
› Connect unauthenticated: mosquitto_sub -h <broker> -t '#' -v
› Test for authentication bypass, weak credentials
› Publish malicious commands to device command topics
› TLS certificate validation bypass

5.2

Radio Protocols (SDR)

› Hardware: HackRF One, RTL-SDR, YARD Stick One, Flipper Zero
› Capture: GNU Radio / SDR++ / GQRX for signal analysis
› Zigbee analysis: wireshark with RZUSBSTICK / CC2531 sniffer
› Z-Wave capture: Z-Wave USB stick + Wireshark plugin
› 433 MHz replay attacks: rtl_433 for capture, YARD Stick for replay
› BLE sniffing: Wireshark + nRF Sniffer / Ubertooth

5.3

Web Interface Attacks

› Default credentials: admin/admin, admin/password, root/root
› Command injection in ping/traceroute/diagnostic inputs
› CSRF on management interface — no SameSite protection
› Path traversal for config file download
› Firmware upload endpoint — test for arbitrary file upload

## Tools Reference

binwalkGhidraRadare2QEMUFirmadyneflashromOpenOCDBus PirateHackRF OneRTL-SDRFlipper ZeromosquittoGNU RadioJTAGulatorLogic AnalyzerWiresharkfirmwalkerFAT