book

Practical IoT Hacking

by Fotios Chantzis, Ioannis Stais, Paulino Calderon

March 2021

Intermediate to advanced

464 pages

13h 11m

English

No Starch Press

Read now

Unlock full access

Foreword
Acknowledgments
Introduction
This Book’s ApproachWho This Book Is ForKali LinuxHow This Book Is OrganizedContact
Part I: The IoT Threat Landscape
Chapter 1: The IoT Security World
Why Is IoT Security Important?How Is IoT Security Different than Traditional IT Security?What’s Special About IoT Hacking?Frameworks, Standards, and GuidesCase Study: Finding, Reporting, and Disclosing an IoT Security IssueExpert Perspectives: Navigating the IoT LandscapeIoT Hacking Laws The Role of Government in IoT SecurityPatient Perspectives on Medical Device SecurityConclusion
Chapter 2: Threat Modeling
Threat Modeling for IoTFollowing a Framework for Threat ModelingIdentifying the ArchitectureBreaking the Architecture into ComponentsIdentifying ThreatsUsing Attack Trees to Uncover ThreatsRating Threats with the DREAD Classification SchemeOther Types of Threat Modeling, Frameworks, and ToolsCommon IoT ThreatsSignal Jamming AttacksReplay AttacksSettings Tampering AttacksHardware Integrity AttacksNode CloningSecurity and Privacy BreachesUser Security AwarenessConclusion
Chapter 3: A Security Testing Methodology
Passive ReconnaissanceThe Physical or Hardware LayerPeripheral Interfaces Boot EnvironmentLocksTamper Protection and DetectionFirmwareDebug Interfaces Physical RobustnessThe Network Layer ReconnaissanceNetwork Protocol and Service AttacksWireless Protocol TestingWeb Application AssessmentApplication MappingClient-Side ControlsAuthenticationSession ManagementAccess Controls and AuthorizationInput ValidationLogic FlawsApplication Server Host Configuration ReviewUser AccountsPassword StrengthAccount PrivilegesPatch LevelsRemote MaintenanceFilesystem Access ControlsData EncryptionServer Misconfiguration Mobile Application and Cloud TestingConclusion
Part II: Network Hacking
Chapter 4: Network Assessments
Hopping into the IoT NetworkVLANs and Network SwitchesSwitch SpoofingDouble TaggingImitating VoIP DevicesIdentifying IoT Devices on the NetworkUncovering Passwords by Fingerprinting ServicesWriting New Nmap Service ProbesAttacking MQTTSetting Up a Test EnvironmentWriting the MQTT Authentication-Cracking Module in NcrackTesting the Ncrack Module Against MQTTConclusion
Chapter 5: Analyzing Network Protocols
Inspecting Network ProtocolsInformation GatheringAnalysisPrototyping and Tool DevelopmentConducting a Security AssessmentDeveloping a Lua Wireshark Dissector for the DICOM ProtocolWorking with Lua Understanding the DICOM ProtocolGenerating DICOM TrafficEnabling Lua in WiresharkDefining the DissectorDefining the Main Protocol Dissector FunctionCompleting the DissectorBuilding a C-ECHO Requests DissectorExtracting the String Values of the Application Entity TitlesPopulating the Dissector FunctionParsing Variable-Length FieldsTesting the DissectorWriting a DICOM Service Scanner for the Nmap Scripting EngineWriting an Nmap Scripting Engine Library for DICOMDICOM Codes and ConstantsWriting Socket Creation and Destruction FunctionsDefining Functions for Sending and Receiving DICOM PacketsCreating DICOM Packet HeadersWriting the A-ASSOCIATE Requests Message ContextsReading Script Arguments in the Nmap Scripting EngineDefining the A-ASSOCIATE Request StructureParsing A-ASSOCIATE ResponsesWriting the Final ScriptConclusion

Chapter 6: Exploiting Zero-Configuration Networking
Exploiting UPnPThe UPnP StackCommon UPnP VulnerabilitiesPunching Holes Through FirewallsAbusing UPnP Through WAN interfacesOther UPnP AttacksExploiting mDNS and DNS-SDHow mDNS WorksHow DNS-SD WorksConducting Reconnaissance with mDNS and DNS-SDAbusing the mDNS Probing PhasemDNS and DNS-SD Man-in-the-Middle Attacks Exploiting WS-Discovery How WS-Discovery WorksFaking Cameras on Your NetworkCrafting WS-Discovery AttacksConclusion
Part III: Hardware Hacking
Chapter 7: UART, JTAG, and SWD Exploitation
UARTHardware Tools for Communicating with UARTIdentifying UART PortsIdentifying the UART Baud RateJTAG and SWDJTAGHow SWD WorksHardware Tools for Communicating with JTAG and SWDIdentifying JTAG PinsHacking a Device Through UART and SWDThe STM32F103C8T6 (Black Pill) Target DeviceSetting Up the Debugging Environment Coding a Target Program in ArduinoFlashing and Running the Arduino ProgramDebugging the TargetConclusion
Chapter 8: SPI and I2C
Hardware for Communicating with SPI and I2CSPIHow SPI WorksDumping EEPROM Flash Memory Chips with SPII2CHow I2C WorksSetting Up a Controller-Peripheral I2C Bus ArchitectureAttacking I2C with the Bus PirateConclusion
Chapter 9: Firmware Hacking
Firmware and Operating SystemsObtaining FirmwareHacking a Wi-Fi Modem Router Extracting the FilesystemStatically Analyzing the Filesystem ContentsFirmware EmulationDynamic AnalysisBackdooring FirmwareTargeting Firmware Update MechanismsCompilation and Setup The Client CodeRunning the Update ServiceVulnerabilities of Firmware Update ServicesConclusion
Part IV: Radio Hacking
Chapter 10: Short Range Radio: Abusing RFID
How RFID WorksRadio Frequency BandsPassive and Active RFID TechnologiesThe Structure of RFID TagsLow-Frequency RFID TagsHigh-Frequency RFID TagsAttacking RFID Systems with Proxmark3Setting Up Proxmark3Updating Proxmark3Identifying Low- and High-Frequency CardsLow-Frequency Tag CloningHigh-Frequency Tag CloningSimulating RFID TagsAltering RFID TagsAttacking MIFARE with an Android AppRAW Commands for Nonbranded or Noncommercial RFID TagsEavesdropping on the Tag-to-Reader Communication Extracting a Sector’s Key from the Captured TrafficThe Legitimate RFID Reader AttackAutomating RFID Attacks Using the Proxmark3 Scripting EngineRFID Fuzzing Using Custom ScriptingConclusion
Chapter 11: Bluetooth Low Energy
How BLE WorksGeneric Access Profile and Generic Attribute Profile Working with BLEBLE HardwareBlueZConfiguring BLE Interfaces Discovering Devices and Listing CharacteristicsGATTToolBettercapEnumerating Characteristics, Services, and Descriptors Reading and Writing CharacteristicsBLE HackingSetting Up BLE CTF InfinityGetting StartedFlag 1: Examining Characteristics and DescriptorsFlag 2: AuthenticationFlag 3: Spoofing Your MAC AddressConclusion
Chapter 12: Medium Range Radio: Hacking Wi-Fi
How Wi-Fi WorksHardware for Wi-Fi Security AssessmentsWi-Fi Attacks Against Wireless ClientsDeauthentication and Denial-of-Service AttacksWi-Fi Association AttacksWi-Fi DirectWi-Fi Attacks Against APsCracking WPA/WPA2Cracking into WPA/WPA2 Enterprise to Capture CredentialsA Testing MethodologyConclusion
Chapter 13: Long Range Radio: LPWAN
LPWAN, LoRa, and LoRaWANCapturing LoRa Traffic Setting Up the Heltec LoRa 32 Development BoardSetting Up the LoStikTurning the CatWAN USB Stick into a LoRa SnifferDecoding the LoRaWAN ProtocolThe LoRaWAN Packet FormatJoining LoRaWAN NetworksAttacking LoRaWAN Bit-Flipping AttacksKey Generation and ManagementReplay AttacksEavesdroppingACK SpoofingApplication-Specific AttacksConclusion
Part V: Targeting the IoT Ecosystem
Chapter 14: Attacking Mobile Applications
Threats in IoT Mobile AppsBreaking Down the Architecture into ComponentsIdentifying ThreatsAndroid and iOS Security ControlsData Protection and Encrypted FilesystemApplication Sandbox, Secure IPC, and ServicesApplication SignaturesUser AuthenticationIsolated Hardware Components and Keys ManagementVerified and Secure BootAnalyzing iOS ApplicationsPreparing the Testing EnvironmentExtracting and Re-Signing an IPAStatic Analysis Dynamic AnalysisInjection Attacks Keychain StorageBinary ReversingIntercepting and Examining Network TrafficAvoiding Jailbreak Detection Using Dynamic PatchingAvoiding Jailbreak Detection Using Static PatchingAnalyzing Android ApplicationsPreparing the Test EnvironmentExtracting an APKStatic AnalysisBinary ReversingDynamic AnalysisIntercepting and Examining Network Traffic Side-Channel LeaksAvoid Root Detection Using Static PatchingAvoid Root Detection Using Dynamic PatchingConclusion
Chapter 15: Hacking the Smart Home
Gaining Physical Entry to a BuildingCloning a Keylock System’s RFID Tag Jamming the Wireless Alarm Playing Back an IP Camera StreamUnderstanding Streaming ProtocolsAnalyzing IP Camera Network TrafficExtracting the Video StreamAttacking a Smart TreadmillSmart Treadmills and the Android Operating SystemTaking Control of the Android Powered Smart TreadmillConclusion
Tools for IoT Hacking
Index

Content preview from Practical IoT Hacking

12 Medium Range Radio: Hacking Wi-Fi

Medium-range radio technologies can connect devices across a range of up to 100 meters (approximately 328 feet). In this chapter, we focus on Wi-Fi, the most popular technology in IoT devices.

We explain how Wi-Fi works and then describe some of the most important attacks against it. Using a variety of tools, we perform disassociation and association attacks. We also abuse Wi-Fi Direct and walk through some popular ways of breaking WPA2 encryption.

How Wi-Fi Works

Other medium-range radio technologies, such as Thread, Zigbee, and Z-Wave, were designed for low-rate applications with a maximum of 250Kbps, ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781098128876Errata Page

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Practical IoT Hacking

by Fotios Chantzis, Ioannis Stais, Paulino Calderon

12 Medium Range Radio: Hacking Wi-Fi

How Wi-Fi Works

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.