Practical Internet of Things Hacking - 2025

Explore how the internet of things connects devices and gateways through direct connections and gateway architectures, enabling data transfer and highlighting security vulnerabilities and attack vectors.

Use Shodan and Google to locate IoT devices like webcams and industrial control systems by IP, identify open ports and web servers, and recognize vulnerabilities with emphasis on authorized testing.

Explore what firmware is, its bootloader, kernel, file systems, and busybox utilities across architectures like MIPS and ARM, and why firmware analysis aids IoT security research.

Explore extracting and analyzing IoT firmware with boardwalk, focusing on the software approach. Inspect architecture, compression, and file systems, and review credentials in shadow to spot backdoors.

Identify the attack surface by downloading and extracting IoT firmware, analyzing its content with binwalk and grep, and spotting insecure protocols like telnet in a wireless bridge device, with authorization.

This lecture guides you through analyzing and extracting IoT firmware, locating usernames and password hashes, and cracking passwords with Hashcat using a dictionary attack to gain device access.

Emulate an IoT firmware using the Firmadyne emulator and a Python automation script, bypassing the need for a physical device while accessing the firmware via its web interface.

We download and analyze a vulnerable IoT firmware, extract its files, identify a vulnerable page enabling remote code execution, and demonstrate exploitation via a proxy and burp suite.

Learn how shellcodes are small, architecture-dependent machine code payloads used after exploiting a vulnerability. Generate reverse, bind, or two-stage shellcodes with MSF venom, and set up delivery and listeners.

Learn how to backdoor an IoT device by extracting and analyzing its firmware, generating a payload, and flashing it to persist on startup.

Emulate firmware and demonstrate a dictionary attack against the IoT login page using Burp Suite to access the control panel and analyze payloads and login status.

Extract and analyze firmware to detect backdoors by examining scripts and firewall configurations. Decode suspicious base64 strings to reveal a listener on port 763 for remote access.

The wrap-up stresses that IoT devices often prioritize functionality over security, leaving wireless and firmware layers vulnerable to backdoors, and urges ongoing education with practical IoT hacking resources.