IoT Penetration Testing Cookbook

Step 4: Rating the threats

Using the following table, we will choose one threat and find out its risk rating:

Threat risk rating: Attacker could access local resources on the mobile device
Item	Score
Damage potential	3
Reproducibility	2
Exploitability	1
Affected users	1
Discoverability	2
Risk rating score: Medium	9

In the mobile space, common threats pertain to data and the way it's stored as well as transported. As a result, the risk is relatively low in mobile bugs unless the exploit affects a large number of users or many users' data was to be exposed. It would be rare for a mobile vulnerability to result in a shell on the server or mobile device during application testing.