Device assessment IoT.

Hacking smart devices is interesting for all sorts of malicious actors. Via these devices hackers can destroy critical infrastructure, spy on people, or enter your internal network. At Qbit we find the vulnerabilities that hackers use to get into your systems and we help you fix them.

Benefits of a device assessment by Qbit

  • Distinguish yourself in the market with a safe device;
  • You comply with the laws and regislation regarding IoT security;
  • Insight in the inherent level of security and real vulnerabilities;
  • Gives confidence to consumers that they do not expose themselves to security or privacy risks;
  • Practical and feasible recommendations.

Why test IoT systems?

Historically IoT systems were never connected and not exposed to a hostile environment. Now that these devices are getting connected to the internet engineers and developers are suddenly required to ensure that the device is capable of facing an extremely hostile environment where everything can (and will) be used against it.

As one can imagine, dealing with this hostile environment is no trivial task and mistakes are often made that enable hackers to abuse the devices for their own malicious goals. Even when you consider your IoT device to be “unimportant” it can still be of interest to a hacker with malicious intentions. The attacker might make the devices part of a larger botnet (e.g. Mirai botnet), use the device as a stepping stone to compromise other systems within the same local network (e.g. URGENT11) or even use it to fake a sensor value leading other systems that rely on the input of the sensors to automatically make decisions which (in the end) lead to catastrophic failures with very serious physical and safety consequences (e.g. TuV Rheinland battery hacking vulnerabilities). The scenarios are endless and every IoT device can be a target.

In addition, the IoT market in general is highly competitive and very poorly secured. Those vendors that can proof they take security and safety serious can use this as a unique selling point.

The IoT device asessment by Qbit

Our device assessment begins with looking at what type of device we are testing, whether it is a simple or complex device and whether it processes sensitive data. Then, we determine the extent of coverage required in the assessment, based on the environment in which the device operates.

Based on our scoping of your device we will design an assessment strategy that will include an appropriate set of tools and techniques that precisely match the device profile. We will undertake wide-ranging tests to thoroughly assess the attack surfaces and risk profile of your device. Such will include, but are not limited to:

  • Network communication checks
  • Firmware vulnerability scan
  • Reverse engineering of firmware
  • Hardware hacking
  • Wireless communication checks
  • Serial communication checks
  • Targeted fuzzing tests
  • Mobile application spot checks
  • Connected service checks

Qbit uses a risk driven testing approach at all times. This means that the attack surface which is most likely to impact a large number of devices if a vulnerability is found, or is most likely to be attacked by malicious actors is tested first and most thoroughly (e.g. a network service that can be attacked from the internet using commonly available tools and techniques will be tested more intense than a Bluetooth protocol which requires specific hardware and an attacker to be within 10 meters from the device). We inform you about the discovered vulnerabilities in detail; the reproduction steps, evidence, impact, probability, overall risk and more. Furthermore, we provide recommendations on how to fix these vulnerabilities. In addition we can report the results from a device assessment using one or more formal standards or guidelines, including:

  • GDPR
  • California Bill SB-327
  • OWASP IoT Top 10
  • ETSI EN 303 645
  • UK Government (DCMS) Code of Practice for Consumer IoT
  • IoT Security Foundation Compliance Framework
  • NIST IR 8259
  • ENISA Baseline
  • CTIA Cybersecurity Certification Test Plan for IoT Devices

In addition to the above we also provide:

  • Trainings for engineers and developers to learn secure coding techniques
  • Hacking workshops to show how a hacker thinks and what you should prepare for
  • Design reviews
  • Code reviews

Advanced techniques - for the experts

We use advanced techniques such as hardware-hacking to connect to JTAG, UART or similar hardware level debug interfaces, read out memory chips like EEPROM and use glitching techniques and logic analyzers to find information and vulnerabilities at the hardware or Operating System level of the device (e.g. getting access to a root shell, finding custom binary executables, encryption keys, private certificates, hardcoded passwords, file system etc.). The gained information is then analyzed or (partially) reverse engineered and used as input to stage further attacks from all possible attack vectors.

As devices are often part of a solution which also communicates with a back-end system and uses a (mobile) application, traffic between the device and related software or servers is also inspected to find vulnerabilities. When possible, we briefly check the mobile application and back-end servers for vulnerabilities as well. If it is required to fully check the mobile application and back-end server, Qbit makes use of the infrastructure assessment or application assessment.

Do you want to know more about our device assessment? Feel free to contact us.

Contact

Wim Mandemakers

Wim Mandemakers

Managing Director

Let me tell you more. Email me or call me on +31 85 8 222 800.

    Request a quote

    Request a quote for: Device assessment (IoT)

    How can we be of service? Please fill in you request and we'll get back to you as soon as possible.

    Thank you! Message successfully sent.

    We received your message and we'll get back to you as soon as possible.

    Please correct the fields below before submitting the request.
    We'll only use your email address to answer you.
    Tell us how we can help you.

    Newsletter