<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-iot-security-testing
description: >-
  Test IoT device security including firmware analysis, hardware interface
  probing, network protocol fuzzing, cloud API assessment, and physical
  security evaluation across the OWASP IoT Top 10.
domain: cybersecurity
subdomain: security-testing
tags:
  - iot-security
  - firmware-analysis
  - hardware-hacking
  - protocol-fuzzing
  - embedded-systems
  - owasp-iot
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1584", "T1200", "T1542"]
  tools: ["python3", "binwalk", "firmwalker", "nmap", "mqtt-explorer", "logic-analyzer"]
---

# Performing IoT Security Testing

## Overview

IoT security testing evaluates the full attack surface of connected devices
including firmware, hardware debug interfaces, wireless protocols, cloud
backends, and mobile companion apps. IoT devices often ship with weak
defaults, unpatched firmware, and exposed debug ports.

## Prerequisites

| Requirement | Details |
|---|---|
| Physical access to target device | Required |
| Hardware tools | UART adapter, logic analyzer, JTAG debugger |
| Firmware extraction tools | binwalk, firmwalker |
| Network tools | Wireshark, nmap, MQTT Explorer |

## Key Concepts

- **Firmware extraction**: Dump and analyze device firmware
- **UART/JTAG access**: Hardware debug interfaces left enabled
- **Protocol analysis**: MQTT, CoAP, ZigBee, BLE inspection
- **Default credentials**: Factory default passwords and keys
- **Update mechanism**: Unsigned or unencrypted firmware updates

## Workflow

### Step 1: Firmware Analysis

```bash
# Extract firmware from binary
binwalk -e firmware.bin

# Analyze extracted filesystem
firmwalker extracted_firmware/

# Search for credentials and keys
grep -rn "password\|secret\|key\|token" extracted_firmware/
strings firmware.bin | grep -i "pass\|key\|secret\|api"

# Identify vulnerable libraries
find extracted_firmware/ -name "*.so" -exec strings {} \; | grep -i "openssl\|busybox"
```

### Step 2: Hardware Interface Probing

```python
import serial

def probe_uart(port: str = "/dev/ttyUSB0", baudrate: int = 115200) -> dict:
    """Probe UART interface for interactive shell access."""
    results = {"port": port, "baudrate": baudrate}
    try:
        ser = serial.Serial(port, baudrate, timeout=5)
        ser.write(b"\n\n")
        output = ser.read(1024).decode(errors="ignore")
        results["response"] = output[:200]
        results["shell_access"] = "login:" in output.lower() or "#" in output
    except serial.SerialException as e:
        results["error"] = str(e)
    return results

COMMON_BAUDRATES = [9600, 19200, 38400, 57600, 115200, 230400, 460800, 921600]
```

### Step 3: Network Protocol Testing

```bash
# Scan IoT device network services
nmap -sV -sC -p- --min-rate 5000 192.168.1.100

# MQTT broker testing — subscribe to all topics
mosquitto_sub -h 192.168.1.100 -t '#' -v

# BLE scanning and enumeration
hcitool lescan
gatttool -b AA:BB:CC:DD:EE:FF --char-read --handle=0x0001

# CoAP resource discovery
coap-client -m get coap://192.168.1.100/.well-known/core
```

### Step 4: Document and Report

```bash
node agent.js firmware --image firmware.bin --output analysis/
node agent.js scan --target 192.168.1.100 --protocols all
node agent.js report --findings iot_findings.json --standard owasp-iot
```

## Detection

```yaml
title: Iot Security Testing Detection
id: 2a9dbc49-8220-42a6-9fac-eaa5ddccbe59
status: experimental
description: Detects suspicious activity related to performing iot security testing techniques in security testing context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*iot*"
  condition: selection
level: medium
tags:
  - attack.t1584
  - attack.t1200
  - attack.t1542
  - attack.discovery
falsepositives:
  - Authorized security testing tools during scheduled assessment windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Iot Security Testing Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1584, T1200, T1542 |

## Verification

- [ ] Firmware fully extracted and analyzed
- [ ] Hardware interfaces (UART/JTAG) tested
- [ ] Network protocols enumerated and fuzzed
- [ ] Default credentials checked
- [ ] Cloud API backend assessed
- [ ] Update mechanism verified for integrity

## References

- [OWASP IoT Top 10](https://owasp.org/www-project-internet-of-things-top-10/)
- [NIST IR 8259 — IoT Cybersecurity](https://csrc.nist.gov/publications/detail/nistir/8259/final)
- [OWASP Firmware Security Testing Methodology](https://owasp.org/www-project-firmware-security-testing-methodology/)
