A Mobile Application for Security Assessment Towards the Internet of Thing Devices

摘要

The Internet of Things or IoT is one of the disruptive technologies which has been grown its attention rapidly. However, because of the neglect of security awareness of vendors and users, this technology is vulnerable to be leveraged as a cyber weapon by malicious attackers. Therefore, we develop an IoT security solution, called MASai, which encourages general users who are not expert in cybersecurity to perform penetration testing on their IoT devices so that they can be aware of these problems and gain security awareness. MASai is comprised of MASai application on Android phones, MASai box, and MASai server. MASai application allows users to execute penetration testing on targeted IoT devices and targeted mobile applications controlling the devices throughouta mobile interface. MASai application works along with MASai Box, a Raspberry Pi embedded with Kali Linux distribution, to find vulnerabilities of the targeted IoT devices. Several techniques such as information gathering, wireless attacks, and vulnerability scanning are integrated for the assessment. MASai server allows users to perform Android reverse engineering and static code analysis for the mobile application security assessment. All vulnerability assessments and penetration testing are based on OWASP Top 10 IoT Vulnerabilities and OWASP Mobile Top 10. By using MASai, we expect users to gain security awareness and can prevent the unexpected consequences of IoT technology.