IoT Security Testing Checklist

Request physical devices, firmware binaries, mobile companion apps, and cloud API documentation.

Document all wireless and wired protocols used by the device for communication.

Prepare SDR equipment, logic analyzers, JTAG/SWD debuggers, and network capture tools.

Document data flows between all components to identify the full attack surface.

Understand applicable regulations such as medical device, automotive, or industrial control standards.

Use binwalk, firmware-mod-kit, or FACT to extract filesystem and search for secrets.

Check versions of embedded Linux, BusyBox, OpenSSL, and other common IoT components.

Test whether firmware updates are cryptographically signed and validated before installation.

Search for enabled SSH, Telnet, debug consoles, and test scripts in the firmware.

Check if secure boot is enforced and whether the bootloader can be interrupted or modified.

Inject OS commands into management interface inputs that may be passed to system calls.

Use SDR or protocol-specific tools to sniff BLE, Zigbee, or Wi-Fi traffic for cleartext data.

Check for anonymous access, weak credentials, and missing TLS on IoT messaging protocols.

Record and replay device commands to test for replay attack protections.

Enumerate BLE services and characteristics, test for unauthenticated read/write access.

Intercept cloud API calls for authentication tokens, certificate validation, and data encryption.

Physically inspect the PCB for debug headers and test pads to gain console access.

Read SPI/NAND flash chips using hardware programmers to extract firmware and stored data.

Check whether the device detects and responds to case opening or component removal.

Perform factory reset and check if credentials, keys, and user data are fully erased.

Monitor power consumption or electromagnetic emissions during cryptographic operations.

Reference OWASP IoT categories and compliance framework requirements for each finding.

Include recommendations for secure boot, encrypted storage, and protocol-level fixes.

Illustrate how device compromise could lead to cloud, network, or user data compromise.

Provide annotated PCB photos showing debug interfaces and points of physical access.

Address secure provisioning, OTA update security, and end-of-life device decommissioning.