Greetings folks, Sedat here. Today, let’s talk about those 'smart' devices we buy that sometimes end up being anything but intelligent—let's dive into the dark alleys of the IoT (Internet of Things) world.
You've probably noticed that cybersecurity trends move fast. There was a time when we felt like a 'hacker' just for cracking an 8-character password. Then came 12 characters, 16 characters, and eventually MFA (Multi-Factor Authentication). Now, a password isn't enough; we’re busy dealing with approval codes on our phones. But what about the coffee machine in your office? Or that sleek smart bulb at the end of the hallway? Do they have 16-character passwords, or are they still rocking admin:admin?
Here’s the real deal: We replaced the front door with a seven-bolt steel gate but left the windows wide open. Smart devices in the office have become the weakest link in the network. Let's look at these devices through the eyes of a Red Teamer and see what you can do on the defense (Blue Team) side.
Shadow IoT: Hidden from Sight, Close to Hackers
One day while scanning the office at testCompany (won’t name names, corporate rules and all), I found 14 different devices that even the IT team didn’t know existed. From smart scales to a 'smart' foot warmer a coworker had hidden under their desk... This is what we call 'Shadow IoT.'
Most of these devices come from cheap manufacturers. Firmware updates? Forget about it. Many of these devices carry the security vulnerabilities they were born with all the way to their graves. For an attacker, could there be a better 'initial access' point?
The Silent Cry of Protocols: MQTT and Telnet
The IoT world still loves protocols from the Stone Age. Why? Because resources are tight—low CPU power, low RAM. Encryption is often a luxury these devices can't afford.
Take the MQTT (Message Queuing Telemetry Transport) protocol, for example. If the broker (the central server) isn't configured correctly, eavesdropping on all device traffic is child's play.
Let’s look at a defanged example. Imagine what an attacker could see after running this command once they've gained access to the network:
# Attempting to listen to an MQTT broker on the local network (Defanged)
mosquitto_sub -h 127.0.0.1 -t "#" -v
With this command (thanks to the # wildcard), we can capture all sensor data on that network—maybe even the signals for opening door locks—as plain text. If we're lucky (or if the attacker is), we can even see usernames and passwords passing through this traffic.
Command Injection: The Curse of Web Interfaces
Most IoT devices are managed through a web interface. These interfaces are usually PHP or CGI scripts written in a hurry and skipped by security tests. Command Injection, my favorite type of vulnerability, is still enjoying its golden age in this world.
Think about the 'Ping Test' tool on a router or smart camera. If...