Hi there, welcome back to this course. In this lesson, I will talk about IoT Pentest methodology.
We can start by defining three phases which make up the methodology for carrying out the Pentests of Iot
devices.
The first phase is used to define the attack surface of the Iot device.
The next phase is the actual VAPT phase of the device on the base or the defined attack surface.
The last phase consists in the preparation of the documentation and final reporting.
The process of attack surface mapping consists of: the collection of information on the device to be
tested.
That is documentation, manuals, online resources, then understanding of the global architecture of
the device or Iot system, list of components, that is hardware, embedded devices, firmware, software
and applications, radio communications. And then identify the attack vectors for each component of
the architecture.
In this figure, we can see a Broadlink universal remote device and the FCC ID code of the device is
indicated with the red arrow, which is then useful for retrieving information on the device itself.
From the fccid.io web site, it is possible by entering the FCC ID code of the device
to do a search, retrieving technical data of the device.
So entering, for example, the FCC ID code of the Broadlink universal remote device and performing
the search. You'll get technical data of the device very useful for a possible subsequent phase of
vulnerability assessment.
You can also download a whole series of technical manuals related to the operation of the device.
Often there are also photos of the printed circuit board of the device from which information about
the hardware can be detected visually.
So going into the detail of a complete vulnerability assessment of an Iot architecture, it is necessary
to contemplate tests relating to: the hardware of the Iot device, the network and radio communication
protocols used by the Iot device, cloud and Web services tests, and any mobile app used for the management
of the Iot architecture should be tested.
OK, this lesson ends here.
Thank you for your attention bye