curl -X POST -d "wifi_ssid=Guest&wifi_pass=$(cat /etc/passwd | base64)" http://127.0.0.1/api/network_config
If you ever see a line like the one above in a web interface request or scrolling through a UART console, game over—you’ve officially lost control of the device. They often say the "S" in IoT stands for Security, but as we all know, there is no "S" in IoT. During our engagements at testCompany, the most dangerous misconception we encounter is treating these gadgets as "just simple sensors." When that simple sensor becomes a pivot point into your secure DMZ, the game changes entirely.
Hardware Opens the Door: The Reality of UART and JTAG
IoT security starts with the hardware long before we touch the software. When you get your hands on a device, the first move is to crack it open and look for those famous headers. Most manufacturers leave UART (Universal Asynchronous Receiver-Transmitter) pins on the PCB for debugging during development. Once you identify the TX, RX, VCC, and GND pins and hook them up to a USB-to-TTL adapter, you’re often greeted by a root shell that doesn't even ask for a password.
If the device is a bit more "enterprise-grade," the vendor might have disabled UART. That’s where JTAG comes in. With JTAG, you can go all the way down to the CPU registers or dump the memory during runtime. It’s like stopping the clock to walk through a locked door. If there is physical access at the hardware level, it’s no longer their device; it’s yours.
Firmware Analysis: Diamonds in the Trash
If we can't get physical access to the board, we go hunting for the firmware file (usually a .bin or .img) from the manufacturer’s support site. This is where binwalk becomes your best friend.
binwalk -e firmware_dump.bin
Once we extract the file system (SquashFS, CramFS, etc.), our first reflex is usually checking the /etc/shadow file. If there’s a hashed root password in there, cracking it with John the Ripper or Hashcat is often trivial. IoT vendors have a tragic love affair with passwords like "123456," "admin," or "password."
However, the real treasure is buried in config files, API keys, and certificates within /home or /root. In one simulation we ran at testCompany, we found a hardcoded AWS Access Key inside a smart camera's firmware that provided full access to the vendor’s entire cloud infrastructure. Imagine that: the data of millions of devices exposed because of a single configuration oversight.
The Dark Side of Protocols: MQTT and CoAP
IoT devices rarely use standard HTTP. They prefer lightweight alternatives like MQTT (Message Queuing Telemetry Transport) or CoAP (Constrained Application Protocol). MQTT works on a "Broker" logic. If that broker has weak or non-existent authentication, you can sit there and sniff the entire message flow.
# Monitoring all topics on a local broker
mqtt sub -h 127.0.0.1 -t "#" -v
By subscribing to the wildcard topic ("#"), you can see every telemetry bit and command sent across the network. If the commands aren't encrypted or signed, an attacker can start publishing their own messages to control the hardware remotely. This is how a smart lightbulb in the parking lot ends up becoming the bridge to your server room.