I'm learning about securing IoT devices and starting to learn how to develop my own software for them.

I wanted to know which are the most common vulnerabilities that any scriptkiddie could exploit and how to be aware of them in general terms.

I'm in a very initial stage, so any tip or information regarding:

  • Popular vulnerabilities in devices or brands
  • Securing typical sofware for cameras/sensors/small devices...
  • Tools for pentesting devices/examples

closed as too broad by Anders, forest, Tobi Nary, Tom K., Steffen Ullrich Apr 24 '18 at 5:09

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


The most common vulnerability is no security at all. Many brands just:

  • put a completely insecure web server onto their devices.
  • put plain-text hard-coded passwords into their code for "maintenance access".
  • standard issues such as buffer overflow.
  • the firmware update functionality is often vulnurable
  • signature of an update was in past verified to be a valid signature, but the certificate itself was not checked for validity. So any self signed certificate provided access.

For best practices, try to keep your code simple and authenticate everything. There will probably be no need to include something like a web server in a camera and it brings many vulnerabilities. Also remember, that users may not ever update your firmware, so keeping bugs to a minimum by making the device simplistic is a good idea.

PS: Also authenticate using something like HMAC, as your connection will most likely not be secure. You should avoid sending passwords.

PPS: If you want some sort of developer access, use public key cryptography and always include an option to turn it off.

  • 2
    Hardcoded passwords are certainly a big one. Unfortunately that's even the case for insanely expensive high-end core routers the size of your refrigerator... I have a question though, what does HMAC have to do with authentication for passwords? All an HMAC does is mitigate the issue of malleability, not provide secure key exchange. – forest Apr 20 '18 at 8:40
  • Well, my assumption was we are more concerned by the attacker gaining access. Yes, also using encryption, ideally something strong such as mutually authenticated TLS is required, if confidentiality is a concern. My worry was about certificates not being very reliable in IoT, as their distribution is difficult. A good practice for users is to block IoT devices on their routers firewall. That way, they can't be exploited from an outside network unless the attacker already gained access to the network. Using a separate VLAN may be desirable as well. – Peter Harmann Apr 20 '18 at 9:10
  • @PeterHarmann That still doesn't explain what HMAC has to do with this – AndrolGenhald Apr 20 '18 at 14:35

Peter's answer is good and covers most of the problems. The typical end-user must be taken into consideration, too. The problem with IoT devices is that many of them does something that is not perceived as data processing by the end-user. Therefore, they might be used just like the item before its new smart version, leaving default password as is.

As a developer using common default password for every device isn't a good practice. Better alternatives include:

  • using a random password shown to the user at initial setup
  • forcing user to pick own password during initial setup
  • using default passwords calculated from e.g. device S/N and/or MAC address using complex algorithm. Such password can be printed on a label outside the device and it would survive resets and firmware upgrades.

Not the answer you're looking for? Browse other questions tagged or ask your own question.