IoT PEN TEST
Verify Your Security With a Penetration Test
OVERVIEW
What Is An IoT Pen Test?
An IoT pen test enables to search for security flaws in the connected object’s entire ecosystem: hardware, embedded software, communication protocols, servers, mobile applications, APIs and Web interfaces.
Even though IoT security is a major challenge, with the development of smart homes, smart cities, connected health care systems and the 4.0 industry, CSG’s accredited UK team have extensive IoT pen testing experience, helping organisations to identify exposures across a multidude of devices
CSG understands the many challenges of IoT devices such as varying architectures, communication protocols, coding and operating systems which results in almost immeasurable combinations of technology. Therefore, CSG utilise only the most experienced penetration testers for IoT testing.
OVERVIEW
Types Of IOT Pen Tests
Their are three main categories for testing IoT device, hardware, firmware and communication protocol testing. CSG can help you device a test strategy to ensure it meets your requirements for either one or all these categories.
Hardware Testing
Penetration tests of hardware focus on the electronic components of the solution (non-invasive and invasive attacks).
Techniques Used
- Reverse engineering of elements extracted from the hardware equipment studied
- Memory dumps
- Cryptographic analysis
Firmware Testing
Penetration tests of firmware focus on the software embedded in the object.
Techniques Used
- Detection of communication ports that are open and badly protected
- Buffer overflow
- Breaking passwords
- Reverse engineering
- Cryptographic analysis
- Modifications of firmware
- Debugging
- Detection of configuration interfaces or backdoors measures to mitigate risk
Communication Protocol Testing
Penetration tests of communication protocols focus on the technology enabling the communication of the object and the sending of data to the outside (RFID, NFC, ZigBee, Bluetooth, WiFi, SigFox, LoRa, etc.).
Techniques Used
- Capture and analysis of multi-protocol radio signals (sniffing)
- Cryptographic analysis
- Passive monitoring of exchanges
- Interception and corruption of exchanges
- Denials of service
Methodology
CSG’s Comprehensive Testing Methodology
01. Reconnaissance
Initial reconnaissance activities to locate responding hosts and services across each public IP range and facilitate the development of the target list.
02. Target Planning
Initial targets are selected based on perceived opportunity and prioritized for first stage attacks.
03. Vulnerability Enumeration
Vulnerabilities, both published and undocumented, are enumerated to identify potential exploits to pursue on each targeted host.
04. Vulnerability Validation
Additional testing to confirm valid vulnerabilities, eliminate false positives, and validate target selection.
05. Attack Planning
Utilizing the information gathered, the methods, tools, and approaches are selected to pursue services likely to present opportunity to gain access.
06. Exploit Execution
Tests are conducted to establish command and control, ideally with persistence, to vulnerable hosts, applications, networks, and services.
07. Privilege Escalation & Lateral Movement
Post exploit actions are performed to gain additional access, penetrate further into the internal environment, escalate privileges, compromise lateral hosts, and harvest additional information.
08. Data Exfiltration
Locating sensitive information, configuration information, and other evidence is gathered to demonstrate impact.
DELIVERABLES
Deliverables For Completed Test
The complete penetration testing results are documented in our content rich report which includes the background, summary of findings, detailed findings, scope and methodology, and supplemental content for context and reference. Samples are available upon request.
An introduction of the general purpose, scope, methodology, and timing of the penetration test.
A brief but concise overview summarizing the results at a glance, such as key critical findings requiring priority attention, system or recurring issues, and other general results.
Comprehensive results of each vulnerability, including a description of the vulnerability observed, the impact, recommendations for remediation, evidence where the vulnerability was observed, step by step demonstrations of exploits performed.
A detailed recap of the specific scope of what was tested, the methodologies utilized, and related historical information necessary for audiences such as auditors to understand the specifics of the test approach.
Additional content and guidance, such as recommended post assessment activities, that provides added value to the audience of the report.
Why Choose CSG
-
A trusted partner with a personalized service
-
A company with a global reach
-
An extensive understanding of how threat actors operate
-
In-depth threat analysis and advice you can trust
-
Latest tools and technology