Don't Start Your Hardware Penetration Test Before Reading This

Your IoT devices sit on your client’s networks. They may even sit there for years without the ability to obtain software updates. Your clients may even expose these devices directly to the Internet with no network firewall in place. All the same, your clients still expect these devices to always be available and secure. Before deploying these devices, your team should consider a IoT/hardware penetration test. However, before you begin this process, let’s discuss the uniqueness of this style of engagement, followed by traps to look out for when selecting a provider. 

Unique Challenges of Hardware Testing

It's important to understand that hardware testing is a specialized niche within the broad penetration testing field and your typical penetration tester likely won’t have much experience testing hardware. Oftentimes, their employment history may not have required any hardware knowledge because these tests are required by only a minority of organizations.

Hardware testing also requires knowledge from other domains – notably electronics engineering. And lastly, a variety of expensive tools ranging from oscilloscopes to even x-rays may be required. When you combine all of these factors, it’s no secret why hardware testers are of short supply in the industry.

Furthermore, here is a deeper look at the specialized knowledge and tools which are required for almost all hardware assessments: 

Questions to Ask Your Hardware Penetration Test Provider

With the stage set for the nuances of hardware assessments, let’s dive into the questions you should ask your provider in order to ensure an effective hardware pen test experience: 

What physical tools will your team use?

Your basic multimeter and serial USB adapter isn’t going to cut it. At a minimum, we’d expect an oscilloscope, logic analyzer, various USB adapters for debug interface access, and de/re-soldering tools. Excellent providers will have additional tools, including fault injection equipment, SDR transceivers, and a high-quality illuminated microscope. 

How many physical devices will your team need?

In a black-box scenario, it’s possible that a thorough test is not being performed if only a single device is being provided. We recommend that you ship a minimum of two of each in-scope devices to your provider. The reason for this is that there’s a possibility that the tester may need to disassemble a PCB, which is likely to result in the device no longer functioning. 

Will testing destroy a device?

While the provider shouldn’t outright seek to destroy a device for zero purpose, it is possible that a device could be rendered inoperable as a result of testing. Problems can include accidental component damage, software failures that render devices inoperable, and unsuccessful attempts at soldering or desoldering components. 

Can your team test radio protocols?

Ideally, the team will have the hardware necessary to test radio protocols. While there are specialized tools depending on the exact protocol being used, at a minimum, the provider should have a Software Defined Radio (SDR) transceiver, which serves as an incredibly flexible RF tool. This tool allows the team to quickly adapt to RF-enabled products by implementing the components that would otherwise limit a radio to a single application (via fixed mixers, exciters, modulators) in software rather than traditional hardware. The result is a powerful, yet general use RF tool. 

While having an SDR is a large component of the radio test, it’s not everything. Next, the team should explain that they will research the associated protocol for accompanying vulnerabilities; each radio protocol has their own unique quirks and research, which is largely outside the scope of this article. 

Will your team need a firmware dump?

The answer to this question depends on your goals of the assessment. You should consider if you are wanting to test how easy it is for an attacker to retrieve device firmware given device lockdown practices. If so, we would not recommend providing the firmware. However, if you are wanting more focus on the actual firmware itself to identify vulnerabilities within network services, software or configurations, we’d recommend providing the firmware. 

Will reverse engineering be performed?

A major component of every hardware assessment is the actual reverse engineering process of device firmware. This will help identify misconfigurations and vulnerabilities within the actual device image and application code that make up the device. The majority of vulnerabilities discovered in networked hardware devices arise from reverse engineering and are typically associated with interfaces virtually exposed to attackers. 

Will management interfaces be tested?

These interfaces usually include legacy telnet, SNMPv1/2, and web interfaces to name a few. And, unfortunately, these will likely serve as the largest attack surface into your device from the virtual realm. Therefore, if a client were to have a device exposed on a network, these open interfaces serve as the largest risk. As such, manual testing of these interfaces should be conducted with the assistance of the reverse engineering component of the assessment. 

Taking the Next Steps in Your Hardware Pen Test Journey

Hardware testing represents a critical yet complex aspect of penetration testing that requires specialized knowledge, tools, and expertise. As organizations continue to deploy IoT and embedded devices in various environments, the importance of thorough hardware security testing cannot be overstated.

When engaging with a penetration testing provider for a hardware assessment, it's crucial to ask the right questions and understand their capabilities, tools, and methodologies to make sure they align with your goals. If you’ve decided you're ready to start talks with providers, Schellman is here to answer all of your hardware hacking methodology questions. Please consider filling out our Penetration Testing Scoping Questionnaire and we'll be in contact soon.

In the meantime, discover additional helpful tips and insights for securing an effective pen test in more of our pen testing articles: 

• Get the Pen Test Report You Deserve: A Leader’s Guide
• Quality Penetration Tests: What Your Provider Won't Tell You 
• Don’t Buy A Network Pen Test Until You Ask These Questions 
• The Insider’s Guide on Getting A Better Web App Pen Test 
• Essential Considerations for an Effective Mobile App Pen Test