Connected devices are everywhere: smart meters, cameras, medical monitors, industrial sensors, vehicle telematics and building controls. They often stay in service for years, run on hardware that is hard to update, and sit on networks next to critical systems. IoT penetration testing finds the weaknesses in these devices before attackers do. This guide explains what it covers and how it differs from testing ordinary software.
What is IoT penetration testing?
IoT penetration testing is authorised security testing of a connected device and the ecosystem around it. Unlike a web application test, it looks at physical hardware as well as software: the firmware running on the device, its hardware interfaces, its radio communications, the mobile app that controls it and the cloud services it reports to.
The layers of an IoT test
Firmware
Firmware is extracted from the device or taken from update files and analysed for hardcoded passwords, private keys, vulnerable third-party components and weak update mechanisms. A single key found in firmware can sometimes unlock every device of that model.
Hardware interfaces
Many circuit boards expose debug interfaces such as UART, JTAG or SWD. If these are left enabled, an attacker with physical access may get a root shell, read memory or extract secrets.
Wireless communication
Bluetooth Low Energy, Wi-Fi provisioning and protocols such as Zigbee are tested for weak pairing, missing encryption and exposed services that can be reached without authentication.
Mobile apps and cloud
The companion app and the cloud API are often the weakest link. A common serious finding is that one user can control or view another user’s device simply by changing a device ID in an API request.
Common IoT weaknesses
- Default or hardcoded credentials, including shared passwords across all devices.
- Unsigned or unencrypted firmware updates that allow malicious firmware to be installed.
- Debug ports left enabled on production hardware.
- Unencrypted communication between device, app and cloud.
- Cloud APIs that trust the device ID sent by the client.
- Outdated open-source components with known vulnerabilities.
Standards that guide IoT security
- OWASP IoT Top 10: the most common IoT security risks.
- OWASP Firmware Security Testing Methodology (FSTM): a structured approach to firmware analysis.
- ETSI EN 303 645: baseline security requirements for consumer IoT, referenced by regulations in several markets.
- NIST IR 8259: foundational security activities for IoT device manufacturers.
Manufacturers and buyers both benefit
Manufacturers test to find problems before launch, when fixes are far cheaper than recalls or emergency updates. Organisations that buy connected devices, such as hospitals, factories and offices, test to make sure a new camera or controller does not become a doorway into their network.
How to prepare for an IoT test
- Provide test units; some hardware techniques can damage a unit.
- Share firmware images, release notes and any documentation you have.
- Provide companion app builds, test accounts and a test cloud environment.
- Name a contact from the firmware or product team.
Cenvox provides embedded and IoT security testing across firmware, hardware, wireless, app and cloud layers. Get in touch to discuss your device.