Device Testing

Device security presents unique challenges like limited processing power, complex technology stacks, and attacks against physical interfaces. Our team has years of experience and has developed a holistic testing methodology, informed by accurate threat modelling.

“Our goal is to make the digital lives of millions of people more secure.”

Threat modelling
We accurately determine a device’s threat model, gaining an understanding of how it is used, what data it handles, and identify realistic attack vectors.
Flexible security testing
No matter what technologies were used to build it, we can identify the issues in the security-critical parts of a device by performing code reviews, reverse engineering, and debugging.
Support
We support our clients with mitigation suggestions for the issues we’ve discovered and answer any questions that may arise during implementation.

Our Approach

A device test is executed in five steps:
1
Information gathering
  • Provided firmware, documentation
  • OSINT
  • Explore device physical interfaces and functionality
2
Threat modelling
  • Decompose device stack
  • Determine and rank threats based on incentive, strengthened by damage it may cause, versus effort to exploit

Threat modelling is what we base our test on. We continuously adjust the threat model as we develop a better understanding of the device.

3
Artifact analysis
  • Firmware analysis
  • Scan device surface
  • Develop understanding of security-critical functionality
  • Deep component exploration, reverse engineering
4
Vulnerability exploitation
  • Try attack ideas generated at the artifact analysis step
  • Develop Proof-of-Concept
5
Collect and report vulnerabilities
  • Create findings report
  • Specify risk and mitigation suggestion for each finding

Why it matters

Devices have become a part of our life. Whether it’s IP cameras, connected car adapters, SIM card vending machines, smart phones, or routers, their security issues can lead to severe invasions of privacy, identity theft, fraud, information leaks, and more.

We perform a holistic security assessment identifying all relevant risks to our clients and to the end users, and we help mitigate them.

Our research

Some ideas generated while testing one device proved interesting when looking towards a larger group of devices. Our ability to apply technical findings at scale has led to us writing state of the art tooling, and creating cutting-edge research.

Research done by our team like BadUSB and our Android patch analysis tool can be found on our blog.

Explore more

aLL articles
USB peripherals can turn against their users
USB peripherals can turn against their users
device hacking
hacking projects
31/7/2014
Smart Spies: Alexa and Google Home expose users to vishing and eavesdropping
Smart Spies: Alexa and Google Home expose users to vishing and eavesdropping
device hacking
IoT
20/10/2019
Smarter is not always wiser: How we hacked a smart payment terminal
Smarter is not always wiser: How we hacked a smart payment terminal
hacking projects
device hacking
16/8/2022