IoT Penetration Testing Full Guide

IoT pentesting is a new domain that have entered in penetration testing. With the growing risk of IoT security, attack on various IoT devices, often pentesters are asked by various companies to check their systems. But the problem is that most security service providers don't yet have IoT specialist for testing, it is usually done by regular security team. In this article we will try to see what exactly is IoT penetration testing.

The difficulty level and the steps to perform the testing is almost similar to that of regular testing but if you are discovering flaws via analyzing firmware or via analyzing wireless communications then its going to be difficult.

The benefits to pen testing Iot include strengthening device security, protecting against unauthorized usage, avoiding Elevation of Privileges, Lower reducing the risk of compromise, better user and data privacy, and setting strong Encryption to avoid man-in-the-middle (MTM) attacks.

Most of the currenct research focus on vulnerabilities on the device but it is important to have a look at other areas too. Areas pentesters needs to focus

  • The devices themselves
  • The operating system that runs on the devices
  • The software on the devices
  • The mobile application
  • The servers themselves
  • The build on the servers

Basic IoT Architecture

An attacker gets many ways to breach an IOT system as its architecture compromises a number of elemets that becomes potential hacker's target

IoT architecture consists of the following components :

Things: Smart devices equipped with sensors and actuators.

IoT field Gateways: Border elements that provide connectivity between things and the cloud part of an IoT solution.

Cloud gateways: Components facilitating data compression and transmission between the gateways and cloud servers.

Streaming data processor: An element ensuring a smooth transition of input data to a big data warehouse and control applications.

Data storage: Consists of a data lake (stores unprocessed data in the form of “streams”) and a big data warehouse (stores filtered and structured data, as well as context information about smart devices, sensors, commands from control applications).

Data analytics: A unit that uses information from the big data warehouse to establish data patterns and gain meaningful insights.

Machine learning: Generates and regularly updates models based on the historical data accumulated in a big data warehouse which is used by control applications.

Control applications: Components that send automatic commands and alerts to actuators.

Client-server system: Consists of a user business logic component (the server side), a mobile application and a web application (the client side).

Penetration testing is executed on the following elements of things:

  • UART, JTAG, SWD ports. Exposed ports allow a pentester to get root access, view and modify sensitive data.
  • Flash memory chips to detect a possibility to dump firmware.
  • Bus sniffing. Hackers may sniff clear text data between components and get access to sensitive information.

Book to follow

IoT is interesting and yet a hard topic to follow. Here is a book which i recommend which you can use to learn more about IoT . here is a book by popular security researcher Aditya Gupta who is an expert in Iot Pentesting

Here is how Gentoo Linux Github Account was hacked

If you are someone who are read lot of infosec news then i'm sure you must have heard of how Popular linux distribution Gentoo Linux official github account was hacked last week . After the account was hacked, hacker changed some codes and added some malicious scripts in it that delete’s all the user files.

Gentoo is a free operating system with Pre compiled binaries and it is an ideal secure server for development workstation, professional desktop, gaming system, embedded solution.

The incident took place on 28 June at approximately 20:20 UTC and Gentoo regained control by 2018-06-28 23:10 UTC.

According to gentoo, the hack has not affected the code hosted on the the gentoo infrastructure and the code hosted in github is just a mirror . was not compromised.

How they got hacked ?

Gentoo developers have revealed that the attackers were able to gain administrative privileges for its github account after guessing the account password. Its 2018 and i don't know why organisations like Gentoo does not use 2 factor authentication.

The organisation could have been saved if it was using a two-factor authentication, which requires an additional passcode besides the password in order to gain access to the account.

Steps taken to improve future attacks

After this incident, gentoo took the following steps to protect themselves from future attacks :

  • Making frequent backups of its GitHub Organization.
  • Enabling two-factor authentication by default in Gentoo's GitHub Organization, which will eventually come to all users the project's repositories.
  • Working on an incident response plan, particularly for sharing information about a security incident with users.
  • Tightening up procedures around credential revocation.
  • Reducing the number of users with elevated privileges, auditing logins, and publishing password policies that mandate password managers.
  • Introducing support for hardware-based 2FA for Gentoo developers

Xiaomi's Mi 8 flagship sells out in 1 minute and 37 seconds

Currently in china Huawei is the biggest smartphone brand but Xiaomi's new flagship Mi8 has created a storm in China. Mi 8 went on sale on 5th june and according to Xiaomi, the phone sold out in just 1 minute and 37 seconds. A lot of people are interested in this device because it is providing a lot of high-end specs in a minimal price. As a matter of fact, the Mi 8 starts off at just CNY 2,699  (approx Rs 28,000) which makes it the cheapest smartphone to come with a Snapdragon 845 SoC. This phone can really bring the competition to the OnePlus 6.

Here are the specs of MI 8

Xiaomi Mi 8 Specifications
Dimensions and weight 154.9 x 74.8 x 7.6 mm, 175g
Software MIUI 10 on top of Android 8.1 Oreo
CPU Octa-core Qualcomm Snapdragon 845 (4x 2.8GHz Kryo 385 Gold + 4x 1.8GHz Kryo 385 Silver cores)
GPU Adreno 630
RAM and storage 6GB of RAM with 64GB/128GB/256GB of storage; Mi 8 Explorer Edition: 8GB of RAM with 128GB of storage
Battery 3400mAh, Quick Charge 4.0+ (Quick Charge 3 adapter bundled in the box)
Display 6.21-inch Full HD+ (2248×1080) AMOLED, 600 nits brightness, supports HDR10, DCI-P3 gamut
Wi-Fi 802.11ac
Bluetooth Bluetooth 5.0
Ports USB Type-C port, dual nano SIM slots
Bands GSM: 850/900/1800/1900MHz
WCDMA: 850/900/1700/1900/2100MHz
FDD-LTE: Bands 1/2/3/4/5/7/8/12/17/20
TDD-LTE: Bands 34/38/39/40/41
Rear camera 12MP camera with 1.4μm pixels, f/1.8 aperture, Dual Pixel autofocus, 4-axis OIS
12MP telephoto camera with f/2.4 aperture, 2x optical zoom
Video recording up to 4K at 60FPS, Slow motion at 1080p240
Front-facing camera 20MP front-facing camera, uses pixel binning to simulate 1.8μm pixels, f/1.8 aperture

Xiaomi states that the Mi 8 is the world’s first smartphone to support dual-frequency GPS. It uses the newer, more powerful L5 band on top of the common L1 band to increase navigation accuracy by three to five times.

The Xiaomi Mi 8 will be available in three variants: 6GB of RAM with 64GB/128GB/256GB of storage. The 64GB storage variant costs CNY 2699 ($420), while the 128GB storage and 256GB storage variants will be available for CNY 2999 ($468) and CNY 3299 ($515) respectively.

What is cryptocurrency airdrop : The Complete Guide

What is airdrop

If you are into cryptocurrency I'm sure you must have heard about airdrops. And you are someone new then you might probably thing what is an airdrop. During natural disaster, war time airdrops are carried out to provide essential supplies to people trapped in those area. But in cryptocurrency airdrop have a totally different meaning and today we will see what exactly is an airdrop and how we can make money from cryptocurrency airdrops . Yes you can make a lot of money by airdrops so keep reading.

Airdrop in cryptocurrency world means distribution of cryptocurrency tokens to the wallets of some users for free. These are mostly done up new tokens.

How cryptocurrency Airdrop works ?

There are basically two types of airdrops, one where the tokens are distributed to all the wallets and one where you need to perform some task in order to get some tokens. Most of the time a company will announce their airdrop in their website and ask their users to do certain task like sharing about their project in social media, or inviting their friends to join the airdrop etc.

After you perform their task then they will give you their tokens which might be of worth $5- $10 etc. You might say that it is a very low amount but once the project grows you value too increases. For example few months back a company did an airdrop . Initially its value was low but after few days their airdrop value was more than $2000. Yes that’s the power Airdrop.

Reasons for carrying out an airdrop

There are a lot of reasons why companies does airdrops. It can be for creating hype around their new project which is very much needed if they are doing an ICO  or may be to reward their loyal customers.

Here are some of the reasons why companies carry out cryptocurrency airdrops

1. As a Reward for Loyal Customers
2. To Generate Lead Database
3. To Create Awareness About a New Cryptocurrency
4. Promotion in the Community

How to take part in airdrops

Now here comes the important part. How to exactly take part in cryptocurrency airdrops ? Here is a step by step guide on how you can join airdrops and what are the things that you need to have.

1. An Ethereum Wallet: The wallet cannot be one that is on an exchange. It has to be a personal address that is ERC20 compatible because most of the tokens that are airdropped are ERC20 tokens, which are or were originally Ethereum-based ICOs. I suggest using MetaMask or MyEtherWallet to get started immediately, but in the long-term I always recommend getting a hardware wallet like the Ledger Nano S.

2. A Telegram Account : I’m sure there are amazing reasons why Telegram is the chatting tool of choice for many of these ICOs. The coins want to boost the audience count. Usually, these airdrop coins will also require you to sign up for their Telegram accounts. Until you receive the coin in your Ethereum wallet, do not leave the Telegram accounts or you risk disqualification for the airdrop.

3. A Twitter Account : Similar to the reasons behind the Telegram account, many of the airdrop coins will also require you to follow them on Twitter. Some of them will even ask you to retweet some tweet.

4. An email address :  Sometimes airdrops will ask for your email, too. If you don’t feel comfortable with giving them your real email, just create a spam one. Remember the password, though; some of them actually ask you to confirm your email.

Airdrops are a great way to make some money without much of work. You never know which token will rise and give you good returns so it is advisable to join many airdrops.


If you have made it till the end then i'm sure you are fully interested in airdrops and want to join one. So you might be asking how to know know which tokens are doing airdrops ? So we at TheCoinmill have created a telegram channel where we share updates related to airdrops, cryptocurrency news etc daily. Go join it. :

List of must have security apps for your mobile [ 2018 ]

Mobile security is increasingly important. We all keep plenty of data on our phones, and some of that data is either personal or sensitive. From the credit card info that’s attached to your Amazon app, to the login data from your banking app, there stuff that we just don’t want other people to know. Or maybe your web browsing history isn’t quite as squeaky clean as it should be. Getting the right kind of security apps for your mobile is essential, but which ones should you choose?

What We’re Looking For.

We’re looking for apps that increase the security on your phone. Useful apps. We’ve dismissed anti-virus or malware apps from this list, since there are tons of them as well as plenty of resources telling you which are the best. So we’re looking at more specialised apps. In addition, a couple of our choices aren’t marketed as security apps as such, they simply have a side effect of increasing security. But if you’re looking to make your data secure, then these are the apps you should think about downloading.

Find My Device

We’re starting out with a no brainer here. Find My Device is by far one of the most useful security apps around. Originally using the name Android Device Manager, Find My Device is a simply little app that tracks your phone. That’s useful if you’ve lost your mobile, had it stolen, or simply can’t remember where it is. You just head to the Find My Device web page on your computer and you’ll get a little blip on a map telling you where your phone is.

But that’s not the real reason we’ve chosen Find My Device. Because the app also has extra features. It allows you to remotely lock your phone, so if you happen to have left it at the office no one can pick it up and get your data. It also allows you to remotely wipe your phone, so if it has been stolen you can erase all that personal data with the press of a button and thieves will never get hold of it. Find My Device is free, and is an absolute essential if you’ve got a mobile phone.

DuckDuckGo Privacy Browser

We all know how much data websites collect about us, and if that thought bothers you, then DuckDuckGo should be one of the first apps that you download. It’s a free, super secure web browser that doesn’t track your web history. It’s sort of like constantly browsing in incognito mode. Once you exit the app, it will no longer remember anything about your last web session. It’s a basic browser and doesn’t have many features other than privacy, but it’s great at what it does. It’s also free, though there are some (non-intrusive) ads.


Haven is a very unique addition to this list, but also a very cool one. Essentially, it lets you turn a secondary device into a security phone. You download Haven onto an old mobile that you no longer use and that mobile will become your security device (you will need a SIM card for certain notifications so your best bet is looking for a low cost rolling sim only deal). It will record sound through the phone’s microphone, it detects light (if someone opens a door, or opens your luggage, for example). And if you stick that secondary phone into your suitcase or handbag it will set off an alarm when that case or bag is moved. Okay, it’s pretty specialised, but it’s also free and could be a great addition for frequent travellers.


If you’re serious about security, then a password manager is a must, and LastPass is the grand-daddy of them all. It stores your individual passwords, so you don’t have to remember all of them (thus encouraging you to use different passwords for different sites, as well as longer, more complicated and therefore more secure passwords). It will also generate super secure passwords for you. It syncs across platforms, so it’ll work on your computer too. And it’s free. There’s a pro version available, but the free version should do everything that the average user needs. Having a password isn’t enough to ensure security. Having a password manager is.


A VPN isn’t just an excuse to be able to watch US Netflix from the UK, or to hide your illegal streaming activity. A good VPN will hide everything you do, from inputting a password into a site, to your web browser history. And ProtonVPN, despite being pretty new, is an excellent choice. It’s free, and has full encryption, so anything you do on your mobile whilst the VPN is switched on will be scrambled. The disadvantage here is that speeds on your phone will be a little slower with a VPN switched on, but that’s a small price to pay for complete privacy.

Resilio Sync

Resilio Sync is another fairly unique app. In basic terms, it allows you to create your own cloud storage system. Let’s say that someone sends you a sensitive document on your phone. You want to be able to back up that document, but you don’t want to send such sensitive info to your DropBox or G Drive account. Resilio Sync creates a cloud of storage on your home computer. So you can back up that document from your phone straight to your own PC without it going through the cloud first. Now that’s security. Resilio Sync is free.

Signal Private Messenger

Finally, if you want to send text messages in absolute privacy you actually have a few options. But with the drama surrounding Facebook, WhatsApp (owned by FB) might not be your first choice anymore. And that’s where Signal Private Messenger comes in. Complete end to end encryption of your messages, group messaging, the ability to have messages disappear after a certain amount of time, and absolutely zero data storing in the app, this is the king of private messaging. It’s free, and the only real downside is that you’ll have to persuade all your friends to download the app too.

PoC Code published for instant Blue Screen of Death [ Flaw unfixed ]

If you are a windows user than I'm sure you are familiar with blue screen of death. A Romanian hardware expert has published a proof-of-concept code that crashes most of the Windows computer within seconds. , even if the computer is in a lock state.

This interesting code exploits a vulnerability in Microsoft's handling of NTFS filesystem images and was discovered by Marius Tivadar, a security researcher with Bitdefender.

Affected Systems

1. Windows 7 Enterprise
2. Windows 10 Pro
3. Windows 10 Enterprise

The researcher only tested on the above mentioned system so there is a high chance that other systems too are affected by it.

What exactly is the flaw ?

The  PoC contains a malformed NTFS image that users can take and place it on a USB thumb drive. Inserting this USB thumb drive in a Windows computer crashes the system within seconds, resulting in a Blue Screen of Death (BSOD).

"Auto-play is activated by default," Tivadar wrote in a PDF document detailing the bug and its impact.

"Even with auto-play [is] disabled, [the] system will crash when the file is accessed. This can be done for [example,] when Windows Defender scans the USB stick, or any other tool opening it."

Microsoft declined to fix !

Yes you read it right, Microsoft declined to fix the flaw stating that it requires physical access / social engineering. Tivadar contacted Microsoft about the issue in July 2017, but published the PoC code today after the OS maker declined to classify the issue as a security bug. What makes it more dangerous is that it works even when the PC is locked. So imagine the situation when you lock your system and so somewhere hoping no one can access or cause any damage to your PC, someone can come and plug their pendrive and crash your system completely.

"I strongly believe that this behavior should be changed, [and] no USB stick/volume should be mounted when the system is locked," the researcher said. "Generally speaking, no driver should be loaded, no code should get executed when the system is locked and external peripherals are inserted into the machine."