A vulnerability assessment and exploitation analysis of a powerline communication HomePlug AV network adapter

Abstract As more telecommunication network technologies emerge, and IoT devices powered by embedded systems increase, so malicious attackers have developed more techniques and critical skills to exploit known and unknown vulnerabilities of these devices. Compromised embedded system devices can provide unauthorised access and privileges to spy, control, and disable the devices, and most times third-party organizations that retail these devices can compromise these embedded system devices with backdoors or rootkits for persistent access. Most systems and technologies built with embedded hardware and software are not easily assessed for vulnerabilities due to the difficulty in finding physical debug interfaces to dump the device’s kernel root file system or firmware. With practical and technical research skills we were able to access and dump the kernel root file system of our target embedded device through the UART debug interface. In our case, the target device was a HomePlug AV powerline communications adapter, which is assessed for exploitable vulnerabilities and bugs in the embedded system software, via the UART debug interface. Detected vulnerabilities and bugs are reported as common vulnerabilities and exposures (CVEs) and as security awareness for the public that uses these embedded devices.