Penetration testing IoT devices to discover critical vulnerabilities

The proliferation of Internet of Things (IoT) devices has introduced numerous benefits across various domains but also raises significant security concerns. This paper presents a penetration testing study on a Wi-Fi smart bulb to identify critical vulnerabilities. The testing revealed severe susceptibilities to Denial of Service (DoS) attacks, including ICMP flooding, TCP SYN flooding, and UDP flooding, which disrupted the device’s functionality. Additionally, a man-in-the-middle attack using ARP spoofing exposed weak encryption practices, specifically the use of TLSv1.2 with a pre-shared key cipher suite lacking Perfect Forward Secrecy (PFS). These findings highlight the urgent need for improved security protocols in IoT devices to ensure their safe and reliable operation.