IoT & Hardware hacking

  Hello guys,

I am a newbie IoT  and hardware hacker and i would like to share some of resources and findings as i  learnt Router exploitation and other hardware hacking.

My journey

I wanted some challenge for something new for research. I thought for sometime then i decided to start do IoT hacking.I have some IoT and embedded  devices on My house such as smart Tvs and router.

so i started to look at smart Tv exploitation.There are a few writeups or videos out there.

After watching  the videos i noted key points such as attack surface on the TVs and some key points while hacking smart TVs

After some weeks i found some vulnerabilities that i will talk about in another writeup.

After some few months i decided to look at router exploitation.I had read of high payouts by ZDI on pwn2own competitions on router exploits.So i searched for their writeups. I found advisories on  vulnerabilities affecting different routers but  no clear step to step to hacking routers.

so i decided to go on youtube and watch videos, noted down the attack surfaces and some attacks.

I also looked for disclosed router CVEs and exploit-db writeups.

With some knowledge on where and what to look for i started hacking the routers.As a web hacker,i first proxied the admin panel to burpsuite and started looking for web vulnerabilities such as xss,ATO etc

After few hours i got CSRF,xss and Auth bypass.I was amazed at how easy it was or maybe my router is shit!

Rested then i started thinking of  serious bugs such as RCE and other firmware vulnerabilities.

I downloaded the router firmware from the vendor's website .Extracted the firmware and started looking for vulnerabilities.I got default credentials and other memory bug classes.

I also took apart the router and tried extracting firmware via UART.I searched on google what the different components on the router were.Luckily, the components were labelled.

Attack surfaces on the Router

I will list some attack surfaces i looked at while hacking the routers.

1.Open ports

2.Firmware

3.Admin panel

4.check exported logs

5.Default creds

6.Transmission protocol

7.Remote management feature

8.Chips on the router board

My Findings On two Routers;

Insecure Http transmission of sensitive data

Backdoor account found on  firmware

one router had open web admin panel :)

CSRF to change DNS settings,port forward and enabling Remote web management

DOS

XSS

AUTH bypass

RCE

Memory bugs in firmware 

Resources

search router on title search bar of exploit-db

https://www.exploit-db.com/search?q=router

https://www.youtube.com/watch?v=2ev4t_uOg38

https://www.youtube.com/watch?v=vhR9gcTtx0g

https://www.youtube.com/watch?v=bGe1DBfy76g

Google

https://www.youtube.com/watch?v=yBK_2fApGgg

https://www.youtube.com/watch?v=ZmZuKA-Rst0

The bugs were submitted to the vendor and got feedback that some will be fixed.When fixed i will write the technical analysis of the vulnerabilities found.Currently i cannot name the vendor.