Mobile Platform, IoT, and OT Hacking · Topic 3 of 4
IoT Hacking
Learn IoT architecture, protocols, the OWASP IoT Top 10, common IoT attacks such as Mirai, the IoT hacking methodology and the countermeasures for CEH v13.
- 5 min
- IoT has four layers: device, gateway, cloud and application.
- Hardcoded and default passwords lead the OWASP IoT Top 10.
- Mirai is the textbook IoT botnet using default credentials.
What it is
The Internet of Things (IoT) is the set of physical devices with sensors, software and network access: cameras, thermostats, smart locks, wearables and medical devices. They are often small, cheap and hard to update.
This page covers IoT concepts, attacks, the hacking methodology and countermeasures. The exam asks for the right architecture layer, protocol, attack name, methodology step or fix.
How it works
IoT concepts
An IoT system has four layers: devices and sensors, a gateway that translates between local protocols and the internet, a cloud platform for storage and analysis, and a user application.
| Protocol | Notes |
|---|---|
| MQTT | A lightweight publish and subscribe messaging protocol. TCP port 1883, or 8883 with TLS. |
| CoAP | Constrained Application Protocol. A lightweight request and response protocol over UDP, port 5683. |
| Zigbee | Low power mesh networking for home and industrial automation |
| Z-Wave | Low power wireless protocol for smart homes |
| Bluetooth Low Energy | Short range, low power link, used by wearables |
| LoRaWAN | Long range, low power wide area networking |
| RFID and NFC | Short range identification and payment |
| 6LoWPAN and Thread | IPv6 based networking for constrained devices |
IoT devices have limited processing power, so strong encryption and updates are often skipped. Many ship with default credentials.
OWASP IoT Top 10 (2018)
- Weak, guessable or hardcoded passwords
- Insecure network services
- Insecure ecosystem interfaces
- Lack of secure update mechanism
- Use of insecure or outdated components
- Insufficient privacy protection
- Insecure data transfer and storage
- Lack of device management
- Insecure default settings
- Lack of physical hardening
IoT attacks
| Attack | Description |
|---|---|
| Default credential abuse and botnets | Devices with factory logins are taken over and joined to a botnet. The Mirai botnet did this and launched large distributed denial of service (DDoS) attacks. |
| DDoS from IoT devices | Compromised devices flood a target |
| Replay and rolling code attacks | A captured radio signal (for example from a key fob) is replayed or its code sequence is predicted |
| Jamming | Radio interference blocks the device |
| Sybil attack | One malicious node pretends to be many nodes in a network |
| Firmware attacks | Insecure or unsigned firmware is modified or extracted to find secrets |
| Side channel attacks | Power use or timing is measured to learn secrets |
| Man-in-the-middle | Unencrypted device to cloud traffic is read or changed |
| Ransomware and data theft | Devices or their data are locked or stolen |
| BlueBorne and Bluetooth flaws | Attack through the wireless stack without pairing |
| Physical attacks | Debug ports such as UART and JTAG are used to reach the device software |
IoT hacking methodology
- Information gathering: identify devices, vendors and exposed services. Search engines for devices, such as Shodan, Censys and Thingful, list internet facing devices.
- Vulnerability scanning: find open ports and weak services using tools such as Nmap, and IoT specific scanners.
- Launching attacks: for example sniffing radio traffic, replaying commands or attacking the firmware.
- Gaining remote access: obtain a shell or control interface on the device.
- Maintaining access: keep a persistent foothold on the device or its gateway.
Tools by purpose:
| Purpose | Tools |
|---|---|
| Find exposed devices | Shodan, Censys, Thingful |
| Capture network traffic | Wireshark |
| Radio analysis | HackRF One, Software defined radio tools |
| Firmware analysis | Binwalk, Firmwalker |
| Port and service scanning | Nmap |
Countermeasures
- Change default credentials and use unique strong passwords per device.
- Update firmware, and enable signed, automatic updates where the vendor supports it.
- Disable services and ports that are not needed, such as UPnP and Telnet.
- Segment IoT devices on a separate network or VLAN.
- Encrypt data in transit and at rest, using TLS for device to cloud links.
- Use device authentication, certificates and a device management system.
- Monitor for unusual traffic and block outbound connections that are not required.
- Disable physical debug ports and harden the hardware.
A worked example
A company installs network cameras. A week later its internet link slows badly. Traffic logs show the cameras sending large amounts of traffic to an outside address.
The cameras still use the factory username and password, and are reachable from the internet. They have joined a botnet like Mirai. The fix is to change credentials, update firmware, remove internet exposure, and move the cameras to their own segment.
How the exam asks about this
- "Which botnet used default credentials on IoT devices to launch DDoS attacks?" → Mirai.
- "Which protocol is a lightweight publish and subscribe messaging protocol common in IoT?" → MQTT.
- "Which search engine lists internet connected devices and their banners?" → Shodan.
What to remember for the exam
- IoT has four layers: device, gateway, cloud and application.
- Hardcoded and default passwords lead the OWASP IoT Top 10.
- Mirai is the textbook IoT botnet using default credentials.
- Shodan, Censys and Thingful support information gathering.
- Segmentation, updates and unique credentials are the core fixes.
A rolling code attack targets the code sequence of a remote, such as a car key fob. It is not the same as a simple replay of a fixed code.
Common mistakes
Treating IoT as harmless. Small devices are used as footholds and as DDoS tools, even if they hold no valuable data.
Relying on the manufacturer's defaults. The default login is public knowledge.
Skipping the gateway. The gateway links device protocols to the internet, so it deserves the same patching as a server.
Check yourself
What does MQTT do?
It carries messages between devices and a broker using publish and subscribe, usually on port 1883 or 8883 with TLS.
What was the main weakness Mirai exploited?
Default or weak credentials on internet reachable IoT devices.
Name two IoT countermeasures.
Change default credentials and segment IoT devices on a separate network.
Topic 3 of 4 in Mobile Platform, IoT, and OT Hacking
Test yourself on Mobile Platform, IoT, and OT Hacking
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.