312-50 Question 415
Single answer▪ IoT Hacking MethodologyDuring an authorized assessment of a smart building, you are asked to evaluate an IP-based security camera that is suspected of exposing services beyond its normal web interface. The camera is online, responds to pings, and its admin portal is reachable over HTTPS. To follow a sound IoT hacking methodology and minimize disruption, what should you do FIRST to identify additional attack surface on the device?
- A
Perform network reconnaissance against the camera to identify open ports, running services, and exposed management interfaces before attempting authentication attacks
- B
Immediately launch a password brute-force attack against the HTTPS admin portal because web logins are the most common weak point in IoT devices
- C
Physically disassemble the camera to extract firmware from flash memory before conducting any network-based enumeration
- D
Send crafted malformed packets to the camera to determine whether its firmware is vulnerable to denial-of-service conditions
Show answer and explanation
Correct answer: A
Explanation
For CEH-style IoT assessments, a sound methodology begins with reconnaissance and enumeration before exploitation. In real environments, IoT devices such as cameras often expose additional services beyond the visible web portal, including RTSP for streaming, SSH or Telnet for administration, SNMP for monitoring, or proprietary services. Identifying these services first allows the assessor to choose the safest and most relevant testing path. This approach aligns with general penetration testing best practices such as those reflected in NIST SP 800-115, which emphasizes planning, discovery, and enumeration prior to exploitation. It also reflects common IoT assessment workflow: identify the device, enumerate interfaces, map attack surface, assess authentication and service configuration, and only then move to controlled exploitation or firmware analysis if permitted by scope.
- A. Correct.
Correct. In a standard IoT hacking methodology, the first practical step after scoping and identifying the target is reconnaissance and enumeration. For an IP-based camera, that means identifying open ports, listening services, protocols, banners, and management interfaces such as RTSP, Telnet, SSH, UPnP, SNMP, or vendor-specific services. This approach is low impact and helps the tester build an accurate attack surface before choosing the appropriate next step.
- B. Incorrect.
Incorrect. Although weak credentials are common in IoT devices, immediately brute-forcing the login is not the best first step. It is noisier, may trigger lockouts or monitoring, and ignores other exposed services that may provide easier or more appropriate assessment paths. Good methodology starts with enumeration before active exploitation.
- C. Incorrect.
Incorrect. Firmware extraction and hardware teardown can be valid IoT testing techniques, but they are not the first step in this scenario. The device is reachable over the network, and the goal is to identify additional exposed services with minimal disruption. Physical disassembly is more invasive and should typically follow when justified by scope and after less intrusive enumeration methods.
- D. Incorrect.
Incorrect. Sending malformed packets to test for denial-of-service issues is an active exploitation technique and can disrupt operations. It does not align with the stated need to minimize disruption, nor is it the first step in a disciplined methodology. The tester should first understand what services are exposed and then assess them in a controlled manner.