Automated Hardware Auditing Testbed for UART and SPI based IoT Devices

The introduction of connected devices could be seen as a big leap towards technological advancements in many areas like healthcare, smart automobiles, and intelligent sensors. However, the increase in the number of connected Internet of Things devices also introduces a new attack vector where attackers have the upper hand, as most of the devices in the consumer space are not updated and maintained regularly for security like their enterprise counterparts. The problem of efficient and automated auditing of such devices has attracted a lot of research. A lot has been done on the software side of things to analyse the firmware or automated tools that scan for open ports to exploit vulnerable devices using an internet-facing web portal, but hardware auditing is one area that is relatively untouched because of a lack of standardised hardware and software tool chains. Considering the requirement, this paper proposes a testbed combining the software tool chains with low-cost community hardware to perform hardware auditing. The testbed enables the auditor to interface with most common physical standards like UART and SPI and perform multiple automated tasks. The testbed could be used to run a wide range of experiments on IoT devices, such as signature-based scans, identifying UART consoles, investigating firmware, analysing bootloader logs, hard-coded secrets, and finding the version of software from firmware, and giving the CVE related to that version. We present the hardware audit results of a few devices with the aid of the proposed testbed.