IoT Penetration Testing Cookbook

Step 4 - identifying threats

At this stage, we have drawn out the data flow of a DVR system and identified entry points. We now have to identify the risks of each entry point as it relates to the user, the network, and the application as well, as the vendors who wrote the application code. From an attacker perspective, we want to identify threats which affect the network, applications, and hosts that may be exploitable and cause the following impact:

• Affect a large number of users utilizing this specific DVR system
• Compromise the vendor's infrastructure to induce mass exploitation
• Compromise the DVR to pose a privacy risk to users
• Compromise the DVR to pose a safety risk to the DVR owner

To help with identifying threats and categorizing ...