#HITB2017AMS COMMSEC D2 - IoT Hacking Simplified

### Overview In this presentation at HITB2017AMS CommSec, the speaker addresses the growing security challenges within the Internet of Things (IoT) landscape and introduces "ExploitI" (exploitI), an open-source framework designed specifically for IoT penetration testing and exploitation. The talk outlines how IoT vendors—driven by speed-to-market pressures and low security awareness—frequently bypass basic functional testing, misconfigure protocols, hardcode encryption keys, and leave critical interfaces exposed. It highlights why security testers need dedicated, modular tooling rather than juggling fragmented or immature open-source scripts across hardware, firmware, mobile, and cloud layers.

### Key Topics - **IoT Attack Surface**: The IoT ecosystem encompasses the device itself (embedded Linux, external storage/USB, exposed hardware like UART, unencrypted firmware), the mobile application (data storage, communication channels, firmware delivery via Bluetooth), and the cloud backend. - **Common Vendor Pitfalls**: Startups and hardware vendors often adopt protocols without understanding their security models, deploy debug libraries into production apps, hardcode static encryption keys across product lines, or rely entirely on default, unvetted hardware modules. - **Penetration Testing Tooling Gaps**: Testing IoT environments currently requires cobbling together disparate tools (SDR tools like HackRF/BladeRF, firmware unpackers, serial terminal emulators). The absence of mature, commercial IoT pen-testing suites led to the creation of ExploitI. - **The ExploitI Framework**: A modular penetration testing tool where all operations (scanning, service discovery, attacks) are treated as test cases managed by a test suite engine and controlled via a console interface.

### Technical Details - **UART Baud Rate Identification**: Hardware assessments commonly require connecting to serial UART interfaces using tools like Minicom, Screen, or Tera Term. ExploitI incorporates a `baud_scan` module—adapted from `devttys0`'s `baudrate.py`—which cycles through standard baud rates (e.g., 115200) until valid data is parsed from a target board (demonstrated using a custom test board called "DEVA"). - **CoAP (Constrained Application Protocol) Discovery**: CoAP is a lightweight, UDP-based RESTful protocol derived from HTTP using binary options instead of text headers. The speaker demonstrates RFC 6690 service discovery against an Eclipse Californium test server (`californium.eclipse.org`), revealing exposed resource endpoints (`/.well-known/core`) that can be tested for unauthorized `GET`, `PUT`, `POST`, or `DELETE` requests. - **MQTT Client Disconnection (Denial of Service)**: Using the Mosquitto MQTT broker (`mosquitto.org`), the speaker shows how the protocol's requirement for unique client IDs can lead to denial of service. When an attacker connects to the broker using an active client's identifier (such as `foobar`), the broker automatically disconnects the previously connected legitimate client. Additionally, brokers often expose administrative topics containing system information or logs. - **Cloud Injection via Sensor Telemetry**: Because cloud platforms frequently treat incoming sensor telemetry as trusted, unvalidated data streams can compromise backends. The speaker demonstrates injecting an XSS payload in place of standard temperature values over an MQTT topic, showing how malicious payloads render directly in monitoring web applications.

### Takeaways Hardware hacking is only one facet of IoT security; the cloud backend represents the single largest threat vector because compromising the cloud can compromise an entire product fleet. Security testers must validate end-to-end trust boundaries, particularly by treating sensor telemetry as untrusted input. The ExploitI framework aims to unify protocol-level testing (CoAP, MQTT), hardware interfacing, and exploit modules, with planned roadmap additions for Bluetooth Low Energy (BLE), hardware breakout boards, ZigBee (via KillerBee), and community-contributed exploits.