IoT and Embedded Penetration Testing

Four surfaces: the device hardware, the firmware it runs, the radio and wired interfaces it speaks over, and the companion app and cloud backend behind it. On the board we inspect chips, locate debug interfaces and test points, and connect to UART and JTAG to reach the console and read memory. In firmware we unpack the file system and hunt hardcoded secrets, weak crypto and vulnerable services. Over the wire we intercept device-to-cloud traffic and test the companion app and its backend, then show how one compromised unit affects the fleet behind it. What sits outside is whatever you do not name in the Rules of Engagement: other product lines, production fleets already in customer hands, and physical premises. The companion app and the cloud platform can also be tested as surfaces in their own right, and our Mobile Application and Cloud services exist for that depth.

Plan on more than one, and settle the exact number in the scoping call. The reasoning is practical: one unit carries testing you can undo, a second absorbs work that leaves it opened, desoldered or reflashed, and a spare gives us a known-good reference to compare behaviour against when something stops booting. Send them with power supplies, any pairing accessories, the firmware version you want tested and, where they exist, the update files and the companion app build that matches. Scoping confirms the device models and firmware versions in scope and confirms which units we may open and modify, and those handling rules go into the signed Rules of Engagement before anything is shipped. Devices come to our Greater Noida West office. We return what survives the bench work, and we tell you in advance which units are unlikely to.

Extraction turns a sealed product into a readable file system, and that is usually where the useful findings sit. Once the image is unpacked we look for hardcoded credentials and API keys, private keys and certificates shipped identically across a fleet, weak or home-grown crypto, debug and test services left enabled, and outdated binaries carrying known vulnerabilities. We also read the boot and update logic, because an unsigned update path is the difference between one compromised device and a fleet-wide problem. Images come from flash directly, from vendor update files, and through debug interfaces. Encrypted images and locked ports do not end the test, because attempting to get past them is the test, and we report honestly on which protections held and which we got around. An image we cannot extract is itself a result worth writing down, and the Firmware Analysis Findings handover records both outcomes.

Parts of hardware testing are irreversible, and we say so before starting rather than afterwards. Opening a sealed enclosure, soldering to test points, desoldering a flash chip to read it off-board, and reflashing modified firmware can leave a unit unusable. Those actions are agreed individually during scoping, which is where we confirm which units we may open and modify, and they go into the signed Rules of Engagement together with handling rules and testing windows. We work on the bench units you ship us, not on devices in customer hands. If the product controls something physical, medical or otherwise safety-related, say so on the scoping call, so the boundary is drawn around exploitation that could move an actuator or alter a setting that matters. What you rule out stays ruled out, and the report records what was not attempted and why.

Run it while the firmware can still change, which in practice means before the build is frozen for certification or handed to a customer for review. Findings from one pass of testing are graded against the OWASP IoT Top 10, the OWASP Firmware Security Testing Methodology, PTES, NIST SP 800-115 and CVSS v4.0, so you are not paying for the same work once per framework. You receive a findings report with proof of concept, firmware and hardware analysis notes, an executive summary, remediation guidance and a verified retest report. The retest sits inside the engagement rather than on a separate invoice, and it is the document reviewers usually want, because it shows closure rather than intent. Critical findings reach you within three hours of discovery, so a blocking issue does not wait for the report. Book the scoping call early enough to leave a fix window before your date.