Automated Penetration Testing Framework for Smart-Home-Based IoT Devices
Security testing is fundamental to identifying security vulnerabilities on smart home-based IoT devices. For this, penetration testing is the most prominent and effective solution. However, testing the IoT manually is cumbersome and time-consuming. In addition, penetration testing requires a deep kn...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2022-09-01
|
| Series: | Future Internet |
| Subjects: | |
| Online Access: | https://www.mdpi.com/1999-5903/14/10/276 |
| _version_ | 1797407223889002496 |
|---|---|
| author | Rohit Akhilesh Oliver Bills Naveen Chilamkurti Mohammad Jabed Morshed Chowdhury |
| author_facet | Rohit Akhilesh Oliver Bills Naveen Chilamkurti Mohammad Jabed Morshed Chowdhury |
| author_sort | Rohit Akhilesh |
| collection | DOAJ |
| description | Security testing is fundamental to identifying security vulnerabilities on smart home-based IoT devices. For this, penetration testing is the most prominent and effective solution. However, testing the IoT manually is cumbersome and time-consuming. In addition, penetration testing requires a deep knowledge of the possible attacks and the available hacking tools. Therefore, this study emphasises building an automated penetration testing framework to discover the most common vulnerabilities in smart home-based IoT devices. This research involves exploring (studying) different IoT devices to select five devices for testing. Then, the common vulnerabilities for the five selected smart home-based IoT devices are examined, and the corresponding penetration testing tools required for the detection of these vulnerabilities are identified. The top five vulnerabilities are identified from the most common vulnerabilities, and accordingly, the corresponding tools for these vulnerabilities are discovered. These tools are combined using a script which is then implemented into a framework written in Python 3.6. The selected IoT devices are tested individually for known vulnerabilities using the proposed framework. For each vulnerability discovered in the device, the Common Vulnerability Scoring System (CVSS) Base score is calculated and the summation of these scores is taken to calculate the total score (for each device). In our experiment, we found that the Tp-Link Smart Bulb and the Tp-Link Smart Camera had the highest score and were the most vulnerable and the Google Home Mini had the least score and was the most secure device of all the devices. Finally, we conclude that our framework does not require technical expertise and thus can be used by common people. This will help improve the field of IoT security and ensure the security of smart homes to build a safe and secure future. |
| first_indexed | 2024-03-09T03:38:21Z |
| format | Article |
| id | doaj.art-5d091bc920fb433e97f624a432ff7641 |
| institution | Directory Open Access Journal |
| issn | 1999-5903 |
| language | English |
| last_indexed | 2024-03-09T03:38:21Z |
| publishDate | 2022-09-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Future Internet |
| spelling | doaj.art-5d091bc920fb433e97f624a432ff76412023-12-03T14:44:33ZengMDPI AGFuture Internet1999-59032022-09-01141027610.3390/fi14100276Automated Penetration Testing Framework for Smart-Home-Based IoT DevicesRohit Akhilesh0Oliver Bills1Naveen Chilamkurti2Mohammad Jabed Morshed Chowdhury3Department of Cybersecurity, School of Engineering and Computer Sciences, University of Southampton, University Road, Southampton SO17 1BJ, UKDepartment of Cybersecurity, School of Engineering and Computer Sciences, University of Southampton, University Road, Southampton SO17 1BJ, UKDepartment of Computer Science and Engineering, La Trobe University, Bundoora VIC 3086, AustraliaDepartment of Computer Science and Engineering, La Trobe University, Bundoora VIC 3086, AustraliaSecurity testing is fundamental to identifying security vulnerabilities on smart home-based IoT devices. For this, penetration testing is the most prominent and effective solution. However, testing the IoT manually is cumbersome and time-consuming. In addition, penetration testing requires a deep knowledge of the possible attacks and the available hacking tools. Therefore, this study emphasises building an automated penetration testing framework to discover the most common vulnerabilities in smart home-based IoT devices. This research involves exploring (studying) different IoT devices to select five devices for testing. Then, the common vulnerabilities for the five selected smart home-based IoT devices are examined, and the corresponding penetration testing tools required for the detection of these vulnerabilities are identified. The top five vulnerabilities are identified from the most common vulnerabilities, and accordingly, the corresponding tools for these vulnerabilities are discovered. These tools are combined using a script which is then implemented into a framework written in Python 3.6. The selected IoT devices are tested individually for known vulnerabilities using the proposed framework. For each vulnerability discovered in the device, the Common Vulnerability Scoring System (CVSS) Base score is calculated and the summation of these scores is taken to calculate the total score (for each device). In our experiment, we found that the Tp-Link Smart Bulb and the Tp-Link Smart Camera had the highest score and were the most vulnerable and the Google Home Mini had the least score and was the most secure device of all the devices. Finally, we conclude that our framework does not require technical expertise and thus can be used by common people. This will help improve the field of IoT security and ensure the security of smart homes to build a safe and secure future.https://www.mdpi.com/1999-5903/14/10/276internet of things (IoT)penetration testing (PT)smart homeIoT devicesCommon Vulnerability Scoring System (CVSS) |
| spellingShingle | Rohit Akhilesh Oliver Bills Naveen Chilamkurti Mohammad Jabed Morshed Chowdhury Automated Penetration Testing Framework for Smart-Home-Based IoT Devices Future Internet internet of things (IoT) penetration testing (PT) smart home IoT devices Common Vulnerability Scoring System (CVSS) |
| title | Automated Penetration Testing Framework for Smart-Home-Based IoT Devices |
| title_full | Automated Penetration Testing Framework for Smart-Home-Based IoT Devices |
| title_fullStr | Automated Penetration Testing Framework for Smart-Home-Based IoT Devices |
| title_full_unstemmed | Automated Penetration Testing Framework for Smart-Home-Based IoT Devices |
| title_short | Automated Penetration Testing Framework for Smart-Home-Based IoT Devices |
| title_sort | automated penetration testing framework for smart home based iot devices |
| topic | internet of things (IoT) penetration testing (PT) smart home IoT devices Common Vulnerability Scoring System (CVSS) |
| url | https://www.mdpi.com/1999-5903/14/10/276 |
| work_keys_str_mv | AT rohitakhilesh automatedpenetrationtestingframeworkforsmarthomebasediotdevices AT oliverbills automatedpenetrationtestingframeworkforsmarthomebasediotdevices AT naveenchilamkurti automatedpenetrationtestingframeworkforsmarthomebasediotdevices AT mohammadjabedmorshedchowdhury automatedpenetrationtestingframeworkforsmarthomebasediotdevices |