Internet of Things Devices: Case Studies on Security

Abstract

The purpose of this thesis is to analyze ethical hacking efforts and penetration testing of embedded IoT devices and their relation to recommended mitigations. Embedded devices present specific security challenges which are best mitigated during design and development phases. Penetration testing is contextualized with current approaches to introducing cyber security in organizations, in particular threat modeling and cyber security relevant regulations. Similar tests were performed on a variety of devices employing the same basic measures to demonstrate the commonly successful attacks which require minimal expertise, and show the common vulnerabilities they exploit. The results are used to derive practical measures for developers and management to employ during the development process to avoid the demonstrated flaws and vulnerabilities. The measures are organized in a simple list format which is intended to become a freely available internal resource for the client company.