Iot Embedded Pentest

---
name: iot-embedded-pentest
description: "Use when assessing IoT / embedded device security — firmware analysis (extraction, hardcoded secrets, outdated components), hardware interfaces (UART/JTAG/SPI debug), device-to-cloud and mobile companion APIs, and wireless protocols (BLE, Zigbee, MQTT/CoAP). Follows the OWASP IoT Top 10 and firmware security testing methodology, with detection and remediation. Authorized testing of devices you own or are cleared to assess."
---

# IoT / Embedded Device Testing

Connected devices combine a constrained embedded system, a mobile/cloud backend, and radio protocols — three attack surfaces in one. Assessment mapped to the **OWASP IoT Top 10** and firmware testing methodology. Authorized testing of hardware you own or are cleared to assess.

## 0. Authorization gate
- [ ] You own / are authorized to test the device, its firmware, and its backend.
- [ ] Physical-access and radio-testing rules; spare units for destructive steps.
- [ ] Backend/cloud + companion-app scope (pair with `api-security-audit`, `mobile-pentest`).

## 1. Firmware analysis (highest value, lowest risk)
- **Obtain:** vendor download, update capture, or extraction from flash (in scope).
- **Unpack:** identify filesystem/components; extract binaries and config.
- **Look for:** hardcoded credentials/keys/certs, debug/backdoor accounts, private keys, API endpoints/secrets, outdated components with known CVEs, insecure update mechanism (unsigned/unencrypted firmware).
- **Fix:** no hardcoded secrets, signed+encrypted firmware updates, patch components, secure boot.

## 2. Hardware interfaces
- Identify debug interfaces (UART console, JTAG/SWD, SPI flash). Assess whether they expose a root shell, memory, or firmware readout.
- **Fix:** disable/lock debug interfaces in production, secure boot, flash read protection.

## 3. Device ↔ cloud / mobile
- Test the device's cloud API and the companion mobile app (route to `api-security-audit` and `mobile-pentest`): auth, device identity/provisioning, tenant isolation (can one device/account reach another's), and update distribution.
- **Fix:** strong per-device identity, mutual TLS, authorization on device resources.

## 4. Wireless / protocols
- Enumerate radios and protocols: **BLE** (pairing, GATT authorization), **Zigbee/Z-Wave**, **Wi-Fi** (→ `wireless-pentest`), and app-layer **MQTT/CoAP** (auth, topic authorization, TLS).
- **Fix:** authenticated/encrypted pairing, per-characteristic/topic authorization, TLS, no open brokers.

## 5. Remediation themes
Secure boot + signed/encrypted updates, no hardcoded secrets, locked debug interfaces, per-device identity + mutual TLS, authorization on device/cloud resources, and patchable components.

## 6. Tooling
binwalk / firmware extraction, Ghidra (binary analysis), flashrom + hardware adapters (UART/JTAG/SPI), BLE sniffers/tooling, MQTT clients, proxy for device/cloud traffic. Follow RoE; keep spare hardware.

## 7. Reporting
Per finding: component (firmware/hardware/cloud/radio), weakness (OWASP IoT), impact (device takeover / fleet reach / data), detection, remediation. Fleet-wide chains → `vuln-chaining`. Checklist: `references/iot-checklist.md`.
---
<sub>© 2026 noahfranklin · Part of the [Gideon](https://github.com/noahfranklin/gideon) security suite · MIT License · Original work.</sub>