IoT and Embedded Penetration Testing

Flow chart of the IoT and Embedded engagement, 6 phases in order, each one selectable. Phase 1, Scoping and Rules of Engagement. We agree the device models, firmware versions, and companion apps and cloud services in scope, and confirm which units we can open. Activities: Confirm device models and firmware versions; Agree companion apps and cloud services in scope; Confirm which units we can open and modify; Set handling rules and testing windows. Hands over Signed Rules of Engagement. Phase 2, Reconnaissance and Hardware Analysis. We inspect the board, identify chips and debug interfaces, and connect to UART and JTAG to reach the console and memory. Activities: Inspect the board and identify chips; Locate debug interfaces and test points; Connect to UART and JTAG; Reach the console and read memory. Hands over Hardware Analysis Notes. Phase 3, Firmware Extraction and Analysis. We pull the firmware from flash or downloads, unpack it and search for hardcoded secrets, weak crypto and vulnerable services. Activities: Extract firmware from flash or downloads; Unpack and analyse the file system; Hunt for hardcoded secrets and weak crypto; Identify vulnerable services and binaries. Hands over Firmware Analysis Findings. Phase 4, Manual Exploitation. We exploit findings on the device, from insecure boot and update mechanisms to services reachable over the network or radio. Activities: Attack insecure boot and update mechanisms; Exploit services reachable over network or radio; Bypass authentication on the device; Confirm impact and rule out false positives. Hands over Proven Device Findings. Phase 5, Communication and Cloud Impact. We test the device-to-cloud and companion-app traffic and show how one compromised device can affect the wider fleet. Activities: Intercept device-to-cloud traffic; Test the companion app and its backend; Show how one device affects the fleet; Assess combined business impact. Hands over Impact and Fleet Risk Assessment. Phase 6, Reporting and Verified Retest. You get a report with proof of concept across hardware and firmware and clear fixes, and we retest once you remediate. Activities: Document findings across hardware and firmware; Produce an executive summary; Walk your team through the results; Retest fixes and confirm closure. Hands over Final Report and Verified Retest. Each phase begins from the artefact the phase before it produced.