The moment you type telnet 127.0.0.1 and see that 'Login:' prompt, then hit it with admin:admin and get a shell... well, all the charisma of that 'high-tech' device just evaporates. If it's a camera, it's now your eyes. If it's a PLC, you've got your hands on the factory's valves. In the IoT world, 'security' is often just a buzzword that lives only in marketing brochures.
Darkness Inside Those Plastic Boxes
In the tests we've run in the field—especially with the IoT gear we've encountered at testCompany—there's a recurring theme. Manufacturers spend a massive amount of energy on the hardware design but barely a fraction of that on software security. We're usually looking at devices running ancient kernels (like version 2.6) with every unnecessary service imaginable—Telnet, FTP, HTTP, UPnP—wide open right out of the box.
During Red Team ops, we might spend days trying to breach a corporate network. Meanwhile, that 'smart' coffee machine in the hallway or the IP phone in the conference room is just sitting there, handing us the golden key to the internal network. Why? Because nobody changes the default password, and nobody bothers to track firmware updates for these things.
MQTT: The Whispers Everyone Can Hear
The MQTT (Message Queuing Telemetry Transport) protocol, which IoT devices love to use for talking to each other, is a straight-up open buffet for Red Teamers. If the broker isn't configured properly and authentication is weak (or non-existent), anyone on the network can listen to the whole conversation.
Take a look at this simple command:
# Subscribe to all topics and read the data
mosquitto_sub -h 127.0.0.1 -p 1883 -t "#" -v
When you run this, you'll see a stream of data like testCompany/sub-station-01/power_status: ON or, even worse, session tokens for the management interfaces. Unless MQTT traffic is encrypted with TLS, anyone doing some basic packet sniffing can see what the devices are saying, when they're active, and what commands they're receiving.
Firmware Forensics: What's Under the Hood?
If you want to truly 'own' an IoT device, you need to get into its brain: the firmware. Most manufacturers literally give this away under the 'Support' section of their websites. Once you download that .bin file and crack it open with binwalk, you're looking at a full-blown filesystem.
# Extract the filesystem from the firmware
binwalk -e firmware_v1.0.bin
# Dive into the extracted folder and hunt for secrets
cd _firmware_v1.0.bin.extracted/squashfs-root/
grep -r "password" .
grep -r "key" .
What do we find in there? Hardcoded API keys, default root passwords (usually hashed, but often with weak algorithms that are trivial to crack), test scripts left behind as backdoors, and sometimes even certificates used for connecting to other systems. An attacker doesn't even need physical access to the device; they can map out every single vulnerability just by analyzing a file downloaded from the web.
Touching the Hardware: UART and JTAG
When the software interface is locked down tight, that's when it's time to grab your screwdriver and look at the circuit board. Most of these boards have exposed UART or JTAG headers that are basically a 'debug' portal into the heart of the system...