Weaponization of Cellular Based IoT Technology

The talk starts from a gap the researchers saw in IoT testing: more devices now carry cellular modules built onto the board, and few teams know how to assess them. They set aside the over-the-air radio link, which is encrypted and FCC-regulated, and aimed at the chip-to-chip connection between the main microcontroller and the module. That link, carried over UART or USB, is usually unencrypted. An attacker who controls it can act as the device toward cloud services and private APN networks while the product keeps working normally.

The middle section covers access and tooling. They described ways to reach the module's pins, from overlay-guided probing with needles, to lifting and reflowing the module, to cutting traces and rerouting them through a switch box. From there they drove the module with AT commands. Their demos included a cloud storage bucket scanner that pulls objects through the module's HTTP commands, a SOCKS5 proxy that turns network traffic into socket commands, a port scanner with limited UDP support, and PPP over UART. Constraints appeared quickly: modules allow only about seven to ten sockets, and default UART speeds are slow. On USB, a multiplexer in the line let the module enumerate as a network interface, and traffic from a laptop could be routed through it.

The closing part turned to defence and impact. Suggested measures included tamper switches that wipe keys, potting, disabling unused interfaces, encrypting chip-to-chip traffic, watching cellular data volume for anomalies, segmenting private networks, and threat modeling in product security. The presenters also warned that a hidden implant using an unused side channel could be hard to detect. Proof-of-concept code and a white paper were published.