Iot Pentesting Hardware Hacking

---
name: iot-pentesting-hardware-hacking
description: "Use when testing IoT device and hardware security."
version: 1.0.0
author: Hermes Agent
license: MIT
metadata:
  hermes:
    tags: [IoT-pentest, hardware-hacking, firmware, UART, JTAG, SPI, flash-dump]
    related_skills: [iot-security-framework, embedded-security, reverse-engineering-basics, wireless-penetration-testing]
---

# IoT Pentesting and Hardware Hacking

Testing IoT device security — from firmware analysis and UART/JTAG debugging through flash dumping, side-channel attacks, and hardware backdoors.

## When to Use

- Assessing physical IoT device security
- Extracting firmware for vulnerability analysis
- Hardware debugging interfaces (UART, JTAG, SWD)
- Side-channel and fault injection analysis
- Wireless protocol analysis on IoT devices

## Hardware Hacking Techniques

```python
HARDWARE_TECHNIQUES = {
    'firmware_extraction': 'Dump flash via SPI, chip-off, UART bootloader, or update file analysis',
    'uart_debug': 'Connect to UART (TX/RX/GND) at 115200 baud — often gives root shell',
    'jtag_swd': 'Debug port via JTAG/SWD — full device control, memory read/write',
    'eeprom_i2c': 'Read configuration EEPROM via I2C — credentials, API keys, certs',
    'flash_dump': 'Dump SPI flash (Winbond, Macronix) with Bus Pirate, flashrom, or chip-off',
    'side_channel': 'Power analysis, electromagnetic, timing — extract crypto keys',
    'fault_injection': 'Glitch power/clock to bypass secure boot, authentication',
}

# Firmware analysis workflow
FIRMWARE_ANALYSIS = [
    "binwalk firmware.bin — extract filesystem",
    "strings firmware.bin | grep -E 'password|key|secret|token|http://|https://'",
    "firmwalker firmware.extracted/ — find interesting paths and configs",
    "checksec --file=extracted/sbin/init — check binary mitigations",
    "Ghidra decompile: analyze binaries for hardcoded creds and backdoors",
]
```

## Verification Checklist

- [ ] Physical interfaces identified (UART, JTAG, SWD, SPI, I2C)
- [ ] UART console accessed (baud rate detection, root shell)
- [ ] Flash/firmware dumped (via SPI or chip-off)
- [ ] Firmware analyzed (filesystem, binaries, hardcoded secrets)
- [ ] Default credentials tested (admin/admin, root:root)
- [ ] OTA update mechanism analyzed (signed? encrypted? replay?)
- [ ] Wireless protocols tested (Zigbee, Z-Wave, BLE, WiFi)
- [ ] Physical security assessed (tamper switches, epoxy, potting)
- [ ] No destructive testing on production devices (unless authorized)