0

First things that I am trying to discover using pentest:

  • Files permissions (are sensitive files in my Linux build secure from exploits)
  • Are programs running under users (e.g., something running under root user hen it should not)

Is there any framework/tool that can be employed to discover weaknesses in the above two areas for an Embedded Linux devices?

P.S: Consider me beginner in the area of penetration testing. I am trying to discover basic vulnerabilities and to fix those.

Improve this question
1
  • This question is fairly broad, and will largely depend on some of the specifics of the given scenario. What is your end goal? Are you trying to learn more about how to perform penetration tests on embedded devices in general? Or do you have a specific system which you are working with? Are you trying to perform a pen-test on the device, or are you a developer who is trying to design a secure system?
    – Dan Landberg
    Commented Jul 6, 2017 at 15:37

2 Answers 2

Reset to default
2

Read up on binwalk (and similar programs). I usually carve firmware with just dd.

Often files inside firmware are in upx or gzip format, which is no problem, and other times they are in obscure formats, usually identifiable with file.

In webroot, you can sometimes find vulnerabilities, and elsewhere you can find e.g. un/privileged accounts. Even if passworded, you can usually crack these accounts.

Dropbear sshd seems common enough that you should take an interest in new vulnerabilities for it, and dnsmasq (quite popular) has also had problems.

I haven't played with JTAG, but it is my understanding you can live patch binaries like getty and login with some effort. So that's definitely worthwhile, if you have physical access.

For expensive toys like PLCs you can implant arduinos with e.g. LoRa or 2.4GHz modules to just override tripping relays ON/OFF(if you do it really fast, it kills whatever it is driving), and with faster MCUs like Teensy, you can probably interdict traffic on ethernet ports. Concerning powering these MCUs, you can stick a small circuit with 7808 or 7805 regulators in, if there is no 5V rail. Many PLCs run on 24V, which the 78* regulators can run off - you need a few extra caps to catch the spikes, example: 780X

Not my diagram, unsure why there isn't a C1 - here C2 and C3 correspond to the normal C1 and C2. C4 and C5 catch the spikes when the 7805 is powering up. Important! Also observe that: W_dissipate = ( V_in - V_out ) * I_load.

Improve this answer
2

Embedded systems are usually on a plain of their own due to them being highly customized to the specified needs subject to the use case scenarios. It really depends on how the system is going to be used and how the system is built.

For example, if you're using Wind River Linux on an embedded system, there is no single use case / misuse case that we can plan for considering it's going to be a custom build depending on the customers needs and as such, there is only so much we can do. You need to define your requirements and then define cases in which you can defeat the security requirements (Misuse cases). From there you can dictate attack vectors and start pen testing.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .