The term Internet of Things (IoT) refers to the use of standard Internet protocols for the human-to-thing or thing-to-thing communication in embedded networks. An IoT network is one where devices, vehicles, buildings and other items integrate with electronics, software, sensors, and network connectivity which enables these objects to collect, exchange data and generally, communicate. The IoT concept applies already to many sectors:
SpearIT provides IoT penetration testing services aligned with the OWASP IoT project.
During this phase, an operational environment is discussed and established with the help of written/verbal communication & scoping questionnaires, defining:
A detailed architecture diagram of the IoT infrastructure is constructed, highlighting all the possible entry points an adversary can use to penetrate. Active & passive OSINT (Open Source Intelligence) techniques are used in combination with neutral observation actions in order to collect as much information as possible regarding the targets to be tested. The more the information, the most attack vectors can be crafted.
The firmware residing inside the IoT devices, as well as any companion / utility software is reverse engineered to discover potential sensitive information. You need to handover the devices to our analysts for a specified period of time, in order to perform:
The main exploitation activities aim to take control of the IoT device(s) and perform a PoC-manipulation of the services the IoT network provides. These actions include:
Reports are a crucial step in a penetration testing engagement as the cornerstone deliverable which provide meaningful insights regarding the security posture of your organization, along with remediation recommendation for each detected risk. Our reports are built upon the following elements:
SpearIT can additionally offer mitigation verification services, which are executed after a penetration test report delivery and ensure the continuous and proper security readiness of your organization against known threats. The verification procedure aims to approve the proper implementation of the proposed mitigation measures and to detect any new vulnerability which may arise from the reconfiguration activities which would probably occur in the context of mitigation.
Ready to assess your IoT/SCADA infrastructure?
Contact Us!
