I'll never forget that 'famous' smart plug I bought years ago when I first caught the 'smart home' fever. Being able to start the coffee machine from my phone while heading to the office felt like pure luxury. One evening, I thought, 'Let's see what our little friend is whispering to the outside world,' and fired up Wireshark. What I saw made me lose my appetite for coffee. Our 'smart' plug was logging my home Wi-Fi password in cleartext and sending it to a server in China. I had literally paid $20 to invite a Trojan Horse into my house. That was the day I realized: in the IoT world, the 'S' stands for Security—and as you can see, there is no 'S' in IoT.
Internet of Things or Internet of Vulnerabilities?
Hey folks, today we're talking about those little boxes we call 'smart' that almost always fail the security test. They are everywhere—offices, homes, factories. But through a Red Teamer's eyes, these devices are the most comfortable pivot points for pivoting into a corporate network. Why? Because nobody ever bothers to change the 'root' password of an IP camera or a smart thermostat.
I remember a penetration test (think of it as a simulation we did at testCompany) where we spent days trying to crack hardened servers with no luck. We eventually gained access through a vulnerable library running on a smart fridge in the breakroom. It sounds like a joke, right? A multi-million dollar security investment rendered useless because of a refrigerator.
Step One: Recon and the Shodan Reality
The first rule of IoT security is this: If it’s connected to the internet, someone has already found it. Platforms like Shodan or Censys are essentially 'Google' for these devices. An attacker's first move is to scan the target company's IP blocks for non-standard ports.
For instance, the MQTT (Message Queuing Telemetry Transport) protocol is the language of the IoT world. Running on port 1883, this protocol is a total disaster when TLS (encryption) isn't used.
A typical reconnaissance scan looks something like this (using 127.0.0.1 as our example, of course):
# Let's scan for MQTT ports and versions on the target network
nmap -sV -p 1883,8883 --script mqtt-subscribe 127.0.0.1
If a sysadmin thinks 'It’s just temperature data, who cares?' and disables authentication, we can eavesdrop on the entire network traffic with this simple command:
# Listen to all channels from a broker that doesn't require authentication
mosquitto_sub -h example.com -t "#" -v
You’d be surprised—among the data flowing here, you can sometimes find device configuration files or even admin panel credentials.
Firmware Analysis: Looking Inside the Box
Since IoT devices usually have limited resources, developers often sacrifice security to save on performance. If we have physical access to the device or can download the firmware file from the internet, the game changes. binwalk becomes our best friend here.
# Extract the file system from the firmware
binwalk -e firmware_v1_0.bin
When we unpack the file system and find /etc/shadow...