---
name: rt-exploit-iot
description: "IoT and firmware security assessment skill for authorized device, firmware, protocol, and management-plane review. Covers firmware triage, interface inventory, communication security, update integrity, secrets handling, and remediation."
---

# rt-exploit-iot - IoT and Firmware Assessment

> Use only with client-owned devices, approved lab firmware, or explicitly authorized test environments. Radio-frequency, safety-impacting, or production device testing requires separate written authorization.

## Overview

IoT security assessment combines hardware inventory, firmware review, protocol analysis, cloud/API review, and operational safety. This skill helps operators evaluate device risk without damaging devices or interfering with production operations.

## Prerequisites

- Device model, serial policy, and firmware version.
- Ownership and test authorization.
- Lab network separated from production.
- Safety constraints for power, radio, mechanical, or industrial functions.
- Approved data handling for captured traffic and firmware images.

## Skill Levels

| Level | Activities |
|---|---|
| BEGINNER | Device inventory, exposed service review, default configuration checks. |
| INTERMEDIATE | Firmware extraction triage, secrets search, TLS review. |
| ADVANCED | Protocol state review, update mechanism analysis, cloud/API chaining. |
| EXPERT | Hardware debug interface analysis and architecture-level remediation. |

## Workflow

### Step 1 - Device Profile

Record vendor, model, firmware version, interfaces, companion app, cloud endpoints, account roles, and physical access level.

### Step 2 - Interface Inventory

Assess:

- Ethernet/WiFi/Bluetooth/Zigbee/NFC/RFID.
- USB/UART/JTAG/SWD where authorized.
- Web administration panels.
- Mobile app/API pairings.
- MQTT/CoAP/HTTP/WebSocket protocols.

### Step 3 - Firmware Review

Review firmware safely:

- Version metadata.
- Hardcoded credentials or API endpoints.
- Private keys or certificates.
- Update signatures and rollback protections.
- Startup scripts and services.
- File permissions and exposed debug functions.

### Step 4 - Communication Security

Validate:

- TLS usage and certificate validation.
- Sensitive data over cleartext channels.
- Device identity and enrollment.
- Replay resistance for commands.
- Cloud API authorization.

### Step 5 - Management Plane

Review default passwords, forced password change, account lockout, local admin exposure, firmware update workflow, logging, and recovery mode.

## Evidence

Use photos only if approved. Store firmware hashes, version strings, traffic summaries, redacted endpoint lists, and screenshots of configuration issues.

## Remediation

- Unique per-device credentials.
- Signed firmware updates and rollback prevention.
- Secure boot where hardware supports it.
- Certificate validation and modern TLS.
- Disable debug interfaces in production.
- Network isolation for device fleets.
- Secure provisioning and decommissioning.

## Autodoc

```bash
python _rtexit/scripts/autodoc_engine.py log --skill rt-exploit-iot --phase exploitation --cmd "IoT assessment evidence summary" --output "firmware/version/control findings"
```

