A Practical Method Of Finding Vulnerabilities In IoT

A Practical Method Of Finding Vulnerabilities In IoT

Speakers: IeckChae Euom, Professor, Chonnam National University

Conference: HITB Phuket

YouTube: https://www.youtube.com/watch?v=FHYQNsBHRtE

Overview

In an era where Internet of Things (IoT) devices are seamlessly integrating into every facet of daily life, the security implications of these interconnected systems have become a paramount concern. Professor IeckChae Euom, affectionately known as "Ice," from Chonnam National University, delivered a compelling talk at HITB Phuket titled "A Practical Method Of Finding Vulnerabilities In IoT." Far from focusing on the discovery of zero-day vulnerabilities, Professor Euom's presentation pivoted to a crucial, yet often overlooked, aspect of IoT security: the systematic collection and analysis of forensic artifacts from IoT devices after they have been compromised. This research is vital for understanding the scope of an attack, identifying the root cause, and ultimately bolstering defensive strategies in the rapidly expanding smart home ecosystem.

The core of Professor Euom's work lies in developing a comprehensive methodology to extract meaningful data from compromised IoT devices, specifically targeting smart home hubs and cameras. By exploring various acquisition techniques—ranging from hardware-level access to mobile application analysis, network traffic interception, and open-source intelligence—the research provides a practical roadmap for security professionals and incident responders. This approach is particularly relevant given the increasing sophistication of IoT malware, such as Mirai and Muji botnets, and the growing challenge posed by manufacturers implementing advanced security controls and encryption, making traditional forensic methods increasingly difficult. The insights gained from such post-compromise analysis are indispensable for reverse-engineering attack chains, assessing data exfiltration, and informing future security enhancements for critical infrastructure and smart city initiatives.

Background

▶ Watch: Introduction and focus: IoT artifact analysis (0:00)

The proliferation of IoT devices, particularly within the smart home sector, has seen explosive growth, with an impressive annual market increase of 20%. Major players like Xiaomi, Samsung SmartThings, LG, and Google dominate this landscape, offering a wide array of interconnected devices from smart switches and cameras to sensors and meters. This interconnectedness, while offering convenience, simultaneously expands the attack surface for malicious actors. A typical smart home ecosystem comprises various sensors, a central smart hub, cloud-based services for data storage and processing, and mobile applications for user interaction. The lightweight nature of many sensor devices means they rarely store significant data locally, pushing much of the critical information to the hub, the cloud, or the controlling mobile application.

Historically, IoT devices have been plagued by a litany of common vulnerabilities, including denial-of-service (DoS) attacks, phishing, sniffing, and spoofing. The rise of IoT-specific malware further exacerbates this problem. Professor Euom specifically highlighted the enduring threat of the Mirai botnet, which emerged nearly a decade ago. Mirai, known for its lightweight footprint, generates massive amounts of network traffic, leading to widespread DoS attacks. It operates through a command-and-control (C2) server, scanning for vulnerable devices, and loading malware to expand its network. A more recent evolution, the Muji botnet, takes this a step further by leveraging blockchain nodes to evade detection and enhance resilience. These examples underscore the critical need for advanced forensic capabilities to understand how these sophisticated threats operate and compromise devices, especially as manufacturers increasingly implement security measures like JTAG port protection and end-to-end encryption. The shift from unencrypted communication protocols (like older Zigbee or Bluetooth implementations) to ubiquitous encryption across modern near-field communication (NFC) protocols, Bluetooth, and Zigbee, presents a significant challenge for traditional network-based analysis, necessitating new approaches to artifact collection.

Key Findings

▶ Watch: Four-pronged data acquisition methodology for IoT (8:45)

Professor Euom's research centers on a multi-faceted methodology for the acquisition and analysis of forensic artifacts from compromised IoT devices. The primary "key finding" is not a specific vulnerability, but rather a practical, structured approach to gather crucial evidence post-compromise, which can then inform vulnerability identification and mitigation. This methodology addresses the challenges posed by modern IoT device security features and the distributed nature of data within smart home ecosystems.

The core of their approach is a four-pronged data acquisition methodology:

1. Hardware Artifacts: This involves direct physical access to the device's internal components. The team demonstrated success in extracting data from memory (RAM, eMMC) and firmware via UART (Universal Asynchronous Receiver-Transmitter) ports. While JTAG (Joint Test Action Group) ports are often protected by manufacturers, UART often remains accessible, providing a shell interface to the device's operating system. This allows for direct inspection of firmware versions, configuration files, and even cryptographic keys, though finding "magic keys" can still be challenging.
2. Application Artifacts: Focusing on the mobile applications used to control smart home devices, the research highlights the wealth of information stored locally on the user's smartphone. By rooting the smartphone, researchers can access application databases. For instance, Samsung SmartThings applications utilize SQLite databases containing over ten tables, storing sensitive data such as camera switch states, location information, thumbnail images, launch times, firmware details, user profiles, and device event logs. Xiaomi applications, while not using SQLite, store similar information in XML-based file databases.
3. Network Artifacts: While traditional packet capture remains a foundational technique, the research emphasizes the significant challenge posed by ubiquitous encryption in modern IoT communication protocols (Bluetooth, Zigbee, Wi-Fi). Unlike five to ten years ago where many near-field communications lacked encryption, today, most traffic is encrypted, severely limiting the utility of simple packet sniffing for content analysis. This observation points to the need for alternative or complementary analysis methods.
4. Open-Source Intelligence (OSINT): This less conventional but highly effective approach involves leveraging publicly available information. The team successfully utilized open APIs offered by manufacturers for developers to gather general device data and understand interface parameters. Platforms like GitHub can also yield valuable insights. Professor Euom specifically mentioned finding smart command interfaces (e.g., for Samsung CI) that, with mechanisms to bypass account requirements, could offer significant data about device types and artifacts.

These findings collectively demonstrate that despite increasing security measures, a diligent and multi-pronged forensic approach can still yield critical intelligence from compromised IoT devices. The ability to access internal device shells via UART, extract detailed user and device data from mobile application databases, and glean insights from public developer resources provides a robust framework for understanding the intricacies of IoT attacks and their impact.

Technical Deep Dive

▶ Watch: Extracting application data from Samsung SmartThings devices (12:00)

The technical depth of Professor Euom's research is exemplified by the practical application of diverse data acquisition techniques across various smart home devices. The methodology is not theoretical but demonstrated with tangible results from popular platforms like Samsung SmartThings Hub, Xiaomi Smart Hub, and Hi-Vision cameras.

At the hardware level, the initial challenge is identifying the components (Bill of Materials - BoM) and then determining the most effective acquisition method. While JTAG ports are frequently protected, UART often remains exposed, offering a debug shell. The process involves physically locating the UART pins on the PCB (Printed Circuit Board), connecting a serial adapter, and then meticulously identifying the correct baud rate, data bits, and stop bits through trial and error. Once connected, a shell interface provides access to the device's internal file system. For instance, the talk showed shell access to a Samsung Smart Hub, enabling the extraction of firmware versions and other system information. Similar success was achieved with a Xiaomi Smart Hub. For a Hi-Vision camera, which Professor Euom noted as being particularly vulnerable, firmware extraction was achieved with relative ease, allowing for subsequent analysis using open-source hardware tools like Arduino to convert and dump data for deeper inspection. This low-level access allows for the acquisition of the entire firmware image, which can then be analyzed for embedded credentials, cryptographic keys, and vulnerabilities. Beyond firmware, direct memory extraction from RAM and eMMC (embedded MultiMediaCard) storage provides a snapshot of the device's operational state and stored data.

On the application side, the focus shifts to the controlling mobile applications. This requires rooting the smartphone to gain privileged access to the application's data directories. For Samsung SmartThings, the researchers successfully extracted data from its SQLite database. They reported finding more than ten tables containing a wealth of information. Specific data points included:

• camera_switches: Records of camera activation and deactivation.
• location_data: Geographic coordinates associated with device usage.
• thumbnail_images: Preview images captured by connected cameras.
• application_status: Launch times and firmware information of the application itself.
• user_information: Details about the registered user.
• device_event_logs: A chronological record of device activities.

Xiaomi's application, while not using SQLite, stores similar data in XML-based file databases, which can also be parsed post-extraction. This detailed data provides crucial forensic evidence, revealing user behavior, device interactions, and potential privacy breaches.

The network analysis component highlights a significant evolution in IoT security. While capturing network traffic is straightforward, the pervasive use of encryption (for protocols like Bluetooth and Zigbee) renders much of the captured data unintipherable without breaking the encryption or having access to the device's keys. This shift, from largely unencrypted communication five to ten years ago to predominantly encrypted traffic today, necessitates new analytical paradigms.

Recognizing the limitations of direct network analysis, Professor Euom introduced the strategic use of Open-Source Intelligence (OSINT). This involves exploring publicly available resources such as developer APIs and GitHub repositories. Developers often publish APIs to allow third-party integrations, and these APIs can expose details about device commands, data structures, and vulnerabilities. The team demonstrated how they could find smart command interfaces and identify parameters to handle devices, even exploring mechanisms to bypass account requirements for certain manufacturer-specific interfaces (e.g., Samsung CI). This highlights that even seemingly benign public information can be weaponized for intelligence gathering in a forensic context.

Looking forward, Professor Euom concluded by outlining their ongoing research into AI and Machine Learning (ML) algorithms for analyzing encrypted network traffic. By capturing encrypted near-field communication data (Bluetooth, Zigbee) and applying classification algorithms like Support Vector Machine (SVM), they aim to:

• Identify devices present in a given network area.
• Classify device manufacturers (e.g., Samsung, Xiaomi, Hi-Vision).
• Determine intrusion types (e.g., DoS, port scanning, malware activity).
• Categorize traffic types (e.g., sensor data, actuator commands, image/video streaming).

This cutting-edge approach seeks to overcome the encryption barrier by analyzing traffic patterns and metadata, rather than content, to infer device behavior and detect anomalies, promising to unlock new avenues for IoT forensics in an increasingly encrypted world.

Demo / Proof of Concept

▶ Watch: Hardware artifact acquisition and shell access via UART (14:40)

While Professor Euom's presentation did not feature a live, interactive demonstration in the traditional sense, the talk provided compelling evidence and visual proofs of concept for each aspect of their methodology. Instead of a step-by-step live hack, the presentation showcased screenshots and output logs from actual device interactions and data extractions, effectively demonstrating the feasibility and results of their practical methods.

For instance, the hardware artifact acquisition was supported by images of the internal PCBs of devices like the Samsung Smart Hub, highlighting exposed UART interfaces. Crucially, screenshots of a shell session via UART were displayed, demonstrating successful access to the device's operating system. These images showed commands being executed (e.g., ls for directory listing, cat for file content) and the resulting output, confirming that the researchers had achieved privileged access to the device's firmware and file system. The speaker also showed a screenshot of extracted firmware information and keys, illustrating the depth of information obtainable through this method. Similar results were presented for the Xiaomi Smart Hub and the Hi-Vision camera, where the process of dumping firmware using open-source hardware tools was described, and the subsequent analysis of the extracted data was confirmed.

Regarding application artifacts, the presentation included clear screenshots of SQLite database outputs from a rooted smartphone running the Samsung SmartThings application. These images explicitly showed tables and entries containing sensitive information such as camera_switches and thumbnail_images with their associated data descriptions. This visual evidence underscored the wealth of forensic data residing within mobile applications and the effectiveness of their extraction technique. The distinction between Samsung's SQLite and Xiaomi's XML-based databases was also noted, with similar data types shown to be extractable from both.

The discussion on OSINT also included a proof of concept, showing how publicly available developer APIs could reveal details about smart command interfaces and parameters. While not a direct "demo" of bypassing an account, the speaker described the discovery of such interfaces and the ongoing research into methods for account bypass, implying that the initial reconnaissance phase had yielded actionable intelligence.

In essence, the "demo" aspect of this talk was a robust presentation of empirical results derived from their research, providing concrete evidence that their proposed practical methods are effective in acquiring critical forensic artifacts from real-world IoT devices. These visual confirmations served as strong proofs of concept for their comprehensive data acquisition methodology.

Defensive Implications

▶ Watch: Future research: AI/ML for encrypted IoT traffic analysis (19:00)

The insights presented by Professor Euom offer critical defensive implications for manufacturers, security professionals, and end-users of IoT devices. Understanding where and how forensic artifacts can be collected post-compromise is not merely an academic exercise; it directly informs strategies to prevent, detect, and respond to future attacks.

First and foremost, manufacturers must prioritize security by design. The fact that UART ports often remain accessible and can provide a shell interface, even when JTAG is protected, highlights a persistent vulnerability. While debug ports are essential during development, they should be securely disabled or removed in production devices to prevent unauthorized access. Implementing robust firmware integrity checks and ensuring secure boot mechanisms are critical to prevent malicious firmware modifications. Furthermore, the reliance on mobile application databases for storing sensitive user and device data necessitates stronger application-level security. Data stored locally on smartphones, even in databases, should be encrypted at rest, and access controls should be rigorously enforced.

For security defenders and incident responders, Professor Euom's methodology provides a valuable framework for post-incident analysis. When an IoT device is suspected of compromise, this talk outlines practical steps to:

1. Prioritize data collection: Determine whether to focus on hardware, application, network, or OSINT based on the nature of the incident and device.
2. Utilize diverse acquisition tools: Be prepared to use serial adapters for UART, forensic tools for mobile application data extraction (requiring rooted devices), and network sniffers (understanding the limitations of encryption).
3. Anticipate encryption challenges: Recognize that most modern IoT traffic is encrypted. This means defenders should invest in methods to analyze traffic metadata or explore techniques for decryption if device keys can be extracted. The proposed AI/ML approach for classifying encrypted traffic patterns offers a promising future defense mechanism.
4. Leverage OSINT: Proactively monitor public developer APIs and forums for intelligence that could reveal potential attack vectors or misconfigurations in deployed devices.

The detailed forensic data—such as camera switch logs, location data, and device event timelines—is invaluable for reconstructing attack chains, determining the extent of data exfiltration, and assessing the impact on user privacy. This information is crucial for compliance reporting and for informing users about potential breaches. Finally, the research underscores the importance of continuous monitoring and threat intelligence sharing within the IoT ecosystem. Understanding the tactics, techniques, and procedures (TTPs) of botnets like Mirai and Muji, combined with the ability to forensically analyze compromised devices, empowers defenders to develop more resilient security architectures and proactive threat hunting strategies, moving beyond reactive patching to a more holistic security posture.

Key Takeaways

• Multi-faceted Forensic Approach: Effective IoT forensic analysis requires a combination of hardware-level access (UART, memory dumps), mobile application data extraction (rooted devices, SQLite/XML databases), network traffic analysis (with encryption challenges), and open-source intelligence.
• Challenges of Modern IoT Security: Manufacturers are increasingly protecting debug ports (JTAG) and encrypting all near-field communications (Bluetooth, Zigbee), making traditional forensic methods significantly more difficult than in previous years.
• Importance of Post-Compromise Artifacts: The talk emphasizes that understanding the aftermath of a compromise—what data was accessed, how the device behaved, and what internal system details reveal—is crucial for identifying root causes, assessing impact, and improving future defenses, rather than solely focusing on zero-day discovery.
• Rich Data in Mobile Applications: User smartphones contain a wealth of sensitive forensic data related to IoT devices, including camera logs, location data, user information, and device event histories, which can be extracted from application databases like SQLite or XML files.
• OSINT as a Forensic Tool: Publicly available developer APIs and resources like GitHub can provide valuable intelligence about device interfaces, commands, and potential vulnerabilities, serving as an often-overlooked source of forensic information.
• Future of Encrypted Traffic Analysis: Advanced techniques, such as applying AI/ML algorithms (e.g., Support Vector Machine) to encrypted network traffic metadata, are being developed to classify devices, manufacturers, intrusion types, and traffic types, overcoming the limitations of content-based analysis.

About the Speaker(s)

Professor IeckChae Euom, also known as "Ice," is a distinguished academic from Chonnam National University in South Korea. He is an integral part of the SEC System Security Research Center, where his work focuses on critical areas of cybersecurity. His research spans the security of vital infrastructure, including nuclear power plants and the energy sector, as well as vulnerabilities in IoT devices and Smart City initiatives. Professor Euom's expertise is evident in his practical, hands-on approach to investigating complex security challenges in interconnected systems. The SEC System Security Research Center actively recruits motivated international students, reflecting Professor Euom's commitment to advancing cybersecurity research and fostering new talent in the field.