Weaponization of Cellular Based IoT Technology

Weaponization of Cellular-Based IoT Technology

Speakers: Darrell Hyland, Principal Security Researcher, Rapid7; Carlotta Biendner, Lead Product Security Researcher, Thermo Fisher Scientific

Conference: Black Hat USA 2025 — August 6-7, 2025, Mandalay Bay, Las Vegas

YouTube: https://www.youtube.com/watch?v=eadubgujxGc

Reading time: ~9 minutes

Type: Briefing

TL;DR

Researchers Darrell Hyland and Carlotta Biendner spent two and a half years developing methods to hijack the cellular modules embedded in IoT devices — without touching the cellular network itself. By intercepting inter-chip communications over UART and USB, issuing AT commands, or establishing full PPP network connections, an attacker who gains physical access to a device can leverage its existing cellular trust relationship to pivot into cloud services, private corporate networks, or the internet — while the attack appears to originate from a legitimate IoT device.

Introduction

Cellular connectivity is increasingly the backbone of IoT deployments: security cameras, medical instruments, industrial sensors, and logistics trackers all rely on NB-IoT and LTE-M modems baked directly into their hardware. That connectivity is encrypted at the radio layer and regulated by the FCC — but between the cellular module and the device's main CPU, the communication is almost always unencrypted, and it speaks a protocol that dates to 1981.

Hyland and Biendner, who met through IoT penetration testing engagements, noticed that while security researchers had extensively studied Wi-Fi and Bluetooth IoT vulnerabilities, the cellular attack surface had been largely ignored. Their two-and-a-half-year research project set out to build testing methodologies from scratch and to answer a fundamental question: what happens when an attacker seizes control of the inter-chip communication channel between a device's CPU and its cellular modem?

AT Commands: A 1981 Protocol Still Running Critical Infrastructure

The foundation of the attack surface is the AT command set — short for "attention" commands — originally designed by Dennis Hayes for the Hayes Smart Modem in 1981 and still used universally in cellular modules today. AT commands handle everything from connecting to the cellular network, to managing configuration, running diagnostics, and updating firmware.

▶ Watch: How AT Commands Work and Why They Matter (04:00)

The 3GPP standard only mandates a subset of AT commands; every manufacturer supplements this with proprietary extensions. Quectel uses a Q prefix for its custom commands, U-Blox uses U, and so on. All of this is documented: every cellular module ships with a publicly available AT command manual that specifies every parameter, every command, and example responses. For a researcher — or an attacker — this documentation is a complete map of the module's capabilities.

Four categories of AT commands exist: test, read, write, and execute. The execute category is particularly interesting. As the researchers demonstrate, AT commands can open sockets, send HTTP requests, and manage full network sessions — essentially providing a complete networking stack through a text interface.

Getting Physical: Hardware Interception Techniques

Because the cellular radio layer is encrypted and regulated, the researchers focused on the inter-chip serial interface. Getting access to it requires hardware work, which the team documented in increasing order of complexity.

▶ Watch: Hardware Tap Techniques — UART Interception (06:00)

The first step is a transposal: photographing both sides of a PCB, overlaying the images, and cross-referencing against component datasheets to locate the land grid arrays, surface runs, and vias. From there, three escalating methods can reach the UART interface:

1. Acupuncture needles under the chip body. If the cellular module is mounted in a position that exposes the edge of its land grid array, fine acupuncture needles can be inserted beneath the chip to reach the USB and serial pads without removal.

1. Module removal and re-routing. The module is heated off the board using IR reflow, new circuit runs are laid using land-run repair kits, and the module is reflowed back. UV-set masking compound protects the new traces from shorts.

1. Sub-layer board drilling. For the most challenging cases, Hyland describes cutting into the circuit board itself to access traces on internal layers — significantly more complex but achievable with patience.

Once physical access to the UART lines is established, an FTDI device is wired in using a breakout board with switches. The switches allow the researcher to toggle between passing communication through normally (so the device behaves as intended) and taking full control of the cellular module to issue arbitrary AT commands.

Building Pentesting Tools from AT Commands

With control of the UART interface established, Hyland and Biendner built a suite of standard pentesting tools implemented entirely in AT commands — exploiting the HTTP and socket capabilities that module manufacturers document in their manuals.

▶ Watch: AT Command Tool Demo — S3 Bucket Scanner (10:00)

The toolkit includes a port scanner, an HTTP proxy, and an S3 bucket scanner. The live demo shows the S3 scanner iterating through buckets and discovering a flag.txt file, saving results to a JSON file parseable with jq. The attack surface here extends to both internal network resources accessible via the device's private APN and internet-facing services.

For more complex interactions — authentication exchanges, loading larger payloads — AT commands have limitations. The researchers turned to PPP (Point-to-Point Protocol) over UART, establishing a full network connection through the cellular module. The cellular module acts as a PPP server; the researcher's laptop acts as the client. The result: a laptop with no Wi-Fi connection receives a cellular IP address and DNS through the IoT device's SIM card. Running Nmap through this connection over NB-IoT takes 40-45 minutes versus three minutes on a home network, but it works.

USB Weaponization and the Multiplexer Attack

Some IoT devices use USB rather than UART for inter-chip communication. Hyland's work on a cellular camera system demonstrates a more sophisticated physical attack using a Texas Instruments USB multiplexer — a quarter-sized preassembled board from China that costs almost nothing.

▶ Watch: USB Multiplexer Attack — Live Demo (24:03)

The attack concept: let the CPU complete its full authentication sequence with the cellular module — including VPN negotiation, APN authentication, and cloud service connections — and then switch the USB connection from the CPU to the attacker's laptop using the multiplexer. The device has already done the hard work of establishing trust with downstream services. The attacker simply inherits it.

USB signal integrity at 2.0 speeds requires careful management of impedance matching, trace length skew (D+ and D- lines cannot differ too much in length), and signal reflection from abandoned traces. Hyland worked through these challenges methodically, ultimately wiring a standard USB plug directly into the circuit using known color-coding standards.

The live demo shows the device powering up, the multiplexer throwing over to the laptop side, and the Mac instantly detecting a new network interface card — an ECM (Ethernet Control Model) device that any operating system recognizes as a standard NIC. The demonstration then runs an SSH Metasploit brute force attack through the IoT camera's cellular connection, opening a Metasploit session.

The critical implication: if the target device connects via a private APN to an internal corporate network, the attacker now has network-layer access to that internal network from a trusted, authenticated device.

Supply Chain and Mitigation Implications

The researchers close with two dimensions of concern and a set of mitigations.

▶ Watch: Mitigations and Supply Chain Risk (28:04)

Supply chain risk. Both UART and USB communication channels are present on virtually every device, but typically only one is used. The other sits dormant. A small implant — a miniature computer system — could be installed in the supply chain to exploit the unused channel, phone home, accept command-and-control instructions, conduct surveillance, or provide remote trigger capability.

Mitigations for manufacturers:

• Case triggers (electronic or physical tamper detection that bricks the device on opening) are preferred over epoxy potting, which can be undone by a sufficiently patient attacker.
• Disable and physically terminate whichever communication channel (USB or UART) the device does not use.
• Encrypt inter-chip communications.

Mitigations for cellular providers and network operators:

• APN-level monitoring for anomalous bandwidth usage or behavioral changes.
• Behavioral baselines: a cellular camera should not be scanning the internet or internal networks.
• Network segmentation: each IoT device should only have access to its own designated endpoint, not shared resources across the device fleet.

Notable Quotes

"We wanna target this trust relationship, and we're gonna do it by controlling inter-chip communication, so we can actually control the cellular modules in whole." — Darrell Hyland ▶ 02:00

"It's not attack against the device, it's the device being used to do the attacking." — Darrell Hyland ▶ 34:04

"These devices can easily have an implant put into them, small computer system, that would open these things up to a nefarious activity. Being able to phone home and take command and control functions, do surveillance, remote triggers." — Darrell Hyland ▶ 30:04

"If you're patient enough and ready to go grab a cup of coffee while this runs, you can actually perform enumeration of cloud hosts, or run any other tool through PPP over UART." — Carlotta Biendner ▶ 16:03

Key Takeaways

• Inter-chip communications on IoT cellular devices are almost universally unencrypted and speak AT commands — a 1981-era text protocol fully documented in publicly available manufacturer manuals.
• Physical access to a cellular IoT device can yield full network access to whatever that device is connected to — cloud services, internet, or private corporate networks — by hijacking the device's existing authenticated trust relationship.
• Both UART (serial) and USB attack paths work, with USB offering much higher throughput and the ability to appear as a standard NIC to any operating system.
• Unused communication channels are an implant opportunity. Supply chain attackers can install small computers exploiting the dormant channel to create persistent, covert cellular-connected back doors.
• Defenders should implement behavioral monitoring at the cellular/APN level. Known-good traffic patterns for IoT devices should be baselined; deviation — particularly scanning activity — should trigger alerts.

No slides PDF was listed for this talk.