First: This is not one of those "How do I start hacking?" questions, but more of a "How do I begin testing a specific device?".
It is a part of my Bachelor Thesis to perform a Vulnerability analysis/assessment of an IoT device that was Implemented during another BSc Thesis with a security focus in mind, and provide possible solutions or improvements. Applying Kerckhoffs principle, I have full access to the documentation, source code and have even been provided with a test client, leaving it to me to set up the webserver according to documentation.
How do I proceed?
According to this we have various steps for a full assessment.
- Vulnerability Scan
- Vulnerability Assessment
- Security Assessment
- Penetration test
The three major thematic components are already identified:
- RFID Reader/tags
- Microcontroller Client, (Arduino /w Ethernet Shield)
- Backend system
Additional info to provide a better picture:
1) only uses ID of rfid tag (authorisation without authentication), tag cloning/spoofing possible. Considering if it is possible to integrate this with the proprietary door locking system, as the same rfid tags are used, so the system has user authentication.
2) Arduino Uno as interface to serial port and reading rfid tags, uses crypto library to ChaCha20-Poly1305 encrypt/authenticate trafic to backend, pre-shared key, generates new session key periodically, I will implement a small programm that emulates the communication via serial port.
3) Backend with Webserver(Apache), application server (django) and database (sqlite, as its still a test system). Provides Webinterface as administrative tool, uses state of the art TLS.
I am currently stuck on how to tackle this in a methodical and structured way/process.
I don't really have that much hope in attacking (1) as I can't really see that many attack vectors, apart from cloning/spoofing
In (2), as it is an Arduino, using 99% of its capacity for its tasks. I already used flawfinder on the source code, but it showed only a few errors (check array size if copy etc), which were all handled in the code. No dynamic memory allocation is happening, reading from arrays is strictly defined by size of arrays etc. Assuming that the ChaCha20 Library, which brings their own secure RNG is properly implemented, I don't really see anything here.
Finally (3) where I see the most potential. Apache Webserver running on Debian 9. Webserver are quite often configured incorrectly/not up to date which opens up attack vectors. Application server? Not sure about that one. Webclient, depending on the implementation, build with Django, could also be one of the more vulnerable components.
TL;DR: I have an IoT device, consisting of multiple components (Microcontroller, backend webserver with webinterface), and I am stuck in how to do a methodically correct and thorough vulnerability assessment.
- What is the proper methodical approach to this Problem? Are there standards/ frameworks?
- How can I thoroughly test (1) and (2) for vulnerabilities? As there are guides for pentesting (3)
I leave the background information as it is. Main question is:
What is a correct methodical approach to Vulnerability assessment of a multi-component IoT device?