Hackers of India

Expl-iot: Hacking IoT like a boss

 Aseem Jakhar 

2018/09/27

Presentation Material

Abstract

IoT is getting a lot of attention these days. Lot of startups are coming up with innovative IoT based solutions. Security researchers have started to look at security of IoT. However, one of the biggest road blocks for security researchers is the toolset. Currently, there are tools both hardware and software that focus on specific work or protocol, but there are none focussing on IoT as a domain itself. Some are not mature yet, some are only PoCs etc. Also, knowledge of hardware is required to assess hardware security go the sensors. These two limitations are restricting security professionals from entering into IoT security domain. If you are among the researchers waiting to get into IoT security - Your wait is over.

The primary focus of this talk is to introduce the attendees to the open source IoT Security Testing framework - Expl-IoT and enable them to use it as well as write plugins for new IoT based exploits and analysis test cases. We are currently working on the expliot website (www.expliot.io), where we will post all news and updates about the framework. All you need to do is just download and install the framework.

As we started digging deeper into IoT security, one thing was evident that there was a lot of time being spent in understanding IoT tools and protocols. So, we decided to create a flexible and extendable framework that would help the security community and us in writing quick IoT test cases and exploits. The objectives of the framework are:

  1. Easy of use
  2. Extendable
  3. Support for hardware, radio and IoT protocol analysis

We released Expl-iot beta version (in ruby) 2017 - https://bitbucket.org/aseemjakhar/expliot_framework We are currently working on the python3 port to support more hardware/radio functionality and have deprecated the ruby version. We will release it in a month. The new beta release is envisioned to have support for UART(serial), ZigBee, BLE, MQTT, CoAP (next version will have support for JTAG, I2C and SPI) and few miscellaneous test cases. This talk would give attendees a first-hand view of the functionality, how to use it and how to write plugins to extend the framework.

The rough flow of the talk would be