IoT Penetration Test

The focus of the requirements analysis are the protection objectives, i.e. the requirements that you place on the IT security of your device. If your device is an industrial control system, uninterrupted operation is high priority. If you want to protect your intellectual property it is important that an attacker cannot read the firmware from the device. A smart home device, on the other hand, must protect personal data by means of encrypted transmission.

You may already know the protection objectives of your device very well. Otherwise, we will determine them together with you. A simple approach might be the question: What are the worst-case scenarios when an IT attack is launched on your device?

In the penetration test we will try to violate these protection objectives of your device. To do this optimally, we need an attacker model. In this model, you describe the essential properties of the attacker you want to protect against.

Does the attacker have physical access to your device or can he only access it via a network? In the case of an e-charging station installed in public places physical access is possible. However, a router is operated in an access-restricted environment. It is therefore inaccessible to the attacker and physical security is not relevant.

Complex devices often support a role concept. Here, the strict separation of roles is important for the security of your device. Can a guest user really only view data or can he perhaps also change its configuration?

In this way, you give our IoT penetration test a clear and individual direction.

In addition, the attack surface of your device is also an important part of the requirements analysis. This includes in particular technical questions about interfaces and communication.

The purchase of a device in the form of a white label solution is just one example. It is also possible that individual parts come from a third-party. For example, radio communication modules, where the exact specification is not known to you.

In these cases, it is useful to preview your device. Here we obtain an overview of its technical interfaces: Starting from the network services via the web interface up to the radio communication. Without you delving deeply into technical issues, we can provide you with a quote.

Out IoT penetration test divides the security aspects of your device into four categories.

Communication security

Your device communicates with other systems. This communication must be encrypted and tamper-proof. This applies especially to the exchange of data via the Internet. But also the radio communication of your device is often security-critical. If a door lock can be opened by replaying a message (replay attack), building security is not ensured.

With the IoT penetration test, we therefore critically check whether your device actually complies with the state of the art. For this purpose, we use established procedures such as the Technical Guidelines of the german Federal Office for Security in Information Technology.

Interface security

An attacker, however, can not only access the communication of your device, but also directly access its interfaces and exploit vulnerabilities there. Common vulnerabilities are incorrect identification of the communication peer (authentication) or unintentionally granted rights (authorization). Other vulnerabilities allow the attacker to permanently disrupt the functionality of your device or even to take over complete control of the device.

To test this, our IoT penetration test makes use of established procedures such as the OWASP Testing Guide. The many years of experience of our pentesters also allows us to examine unknown and proprietary protocols.

Architecture

In the architecture analysis we examine at the internal data exchanges of your device. For this purpose, we determine communication relationships and trust bounderies between individual software components. Thus we systematically identify weak points in the design.

Physical security

If the physical security of your device is relevant, this will also be considered. For example, an attacker could gain access to your device via USB or developer interfaces (e.g. UART or JTAG) which are not properly disabled. This way, he can deposit malicious code, permanently alter the functionality and integrate your device into a botnet.

For each vulnerability, the report includes:

• A brief summary, which may be understood even without in-depth technical knowledge
• Necessary preconditions for the attacker to exploit the vulnerability
• A realistic assessment of the potential damage
• A technical description that allows your developers to easily reproduce it

Upon request, we can also provide recommendations how to fix the vulnerability. In addition, we can evaluate the security architecture and the resilience of your device.