SESSION ID: MBS2-W02 Building a Comprehensive IoT Security Testing Methodology Deral Heiland IoT Research Lead Rapid7 deral_heiland@rapid7.com @percent_x #RSAC #RSAC The Ecosystem of an IoT Product What is the Internet of Things (IoT) 3 #RSAC #RSAC IoT Ecosystem • Embedded Hardware • Management & Control Application • Cloud Service APIs and Storage 4 #RSAC IoT Ecosystem 5 • Understanding the holistic structure • Help with threat modeling • Understand related security impact • Facilitate security testing #RSAC IoT Security Testing Methodology Structure Security Testing Methodology Structure • 4 key phases • All components of the ecosystem Focused team • – Functional – Reconnaissance – Testing – Analysis 7 #RSAC #RSAC Security Testing Methodology Structure Functional Evaluation Reconnaissance Analyzing 8 Testing #RSAC Functional Evaluation Phase Functional Evaluation Reconnaissance Analyzing 9 Testing #RSAC Functional Evaluation • Standard setup & deployment • Goal: Understanding IoT product – Map out 10 • Feature • Functions • Components • Communication paths #RSAC Reconnaissance Phase Functional Evaluation Reconnaissance Analyzing 11 Testing #RSAC Reconnaissance • Open Source Intelligence – FCC ID – User Manuals – Electronic component datasheets – Product history – CVEs – Electronic component vulnerabilities • Vendor supplied data 12 #RSAC Testing Phase Functional Evaluation Reconnaissance Analyzing 13 Testing #RSAC Cloud & Web API Testing • Vulnerability testing – OWASP top 10 – Injection attacks – Business logic attacks • Functional validation – Encryption – Authentication – Session management • 14 Ecosystem impact Management & Control Application Testing • Vulnerability • Encryption • Authentication • Data management • Ecosystem impact 15 #RSAC #RSAC Network Testing 16 • Vulnerabilities • Exposed services • Encryption • Ecosystem impact Embedded Hardware Testing • Chip sets • Physical ports • Debugger access • Access Security – – – • Memory extraction Side Channel attacks Inter Chip communication Ecosystem impact 17 #RSAC #RSAC Firmware Analysis Testing 18 • Hardcoded default passwords • Encryption keys • Undocumented commands • Hardcoded IP addresses of interest • Hardcoded URLs of interest • Ecosystem impact #RSAC Radio (RF) Testing • Protocol versions • Encryption • Pairing processes • Access control • Replay attacks • Ecosystem impact 19 #RSAC Analysis Phase Functional Evaluation Reconnaissance Analyzing 20 Testing