Internet of Things Stack Exchange is a question and answer site for builders and users of networked sensors and control devices in the contexts of smart homes, industry automation, or environmental sensors. It only takes a minute to sign up.
Sign up to join this community
Searching the archives for "fuzz" and "pentest" only results in 2-3 relevant threads on this topic and they are all from 2016/2017.
I would really like to subject my IoT devices (e.g. surveillance cameras) to severe testing to uncover bugs and other security issues.
How would you advice a beginner in this field to perform such tests? I have a bit of experience in embedded programming (C, currently learning Rust), but have not really done any fuzzing before.
This really depends on how you are connecting to the IoT network in the first place. I am assuming you mean via TCP/IP.
Depending on how far you wish to go with this, you may want to look into a bootable Kali Linux USB to run the pentests. (Its literally what that OS was designed to do)
You can use Nmap in linux/Windows to determine ports that are open/answering on the LAN. (this will expose services that are answering to client probes.) it comes pre-installed in kali.
Once you have found open services/ports you can use something like metasploit to try and exploit the vulnerabilities your devices may or may not have.
unfortunately explaining how to use these programs or operating systems is outside the scope of this question. I hope it points you in the right direction.
You might consider using static program analysis techniques, e.g. with Frama-C or Clang analyzer. Read also this draft report for more, and consider using Bismon after september 2020. See also Chariot and Decoder and Vessedia European projects.
Another approach would be a metaprogramming approach : you would write (or use) your own C code generator from some higher level domain specific language (perhaps of your invention, but then read the Dragon book and Programming Language Pragmatics). This has been used in SWIG and you could use tools like Coq to prove some safety properties (e.g. of your C code generator, or sometimes and partly of the generated C code)
If you compile your IoT code with a recent GCC compiler, consider writing your own GCC plugin to check some safety properties. Be of course aware of Rice's theorem (and see also the ambitious RefPerSys project).
Look also inside the CompCert project.
