Finding vulnerabilities in connected devices

Sammanfattning

This thesis covers the security testing of a system with connected devices. In a world with an ever-growing number of connected devices, it is crucial to be mindful of the consequences unprotected systems can cause. The thesis aim to shine light on the issues of not having sufficient security measures in place. The test target was a system with a battery charger, gateway and cloud service. The testing was done with two different approaches, penetration testing and threat modelling, covering different parts of the system. Only a small fraction of the system was exploited in the report and overall the security was deemed to be alright. The main vulnerabilities found were that the username and password were found unencrypted when attempting to log into the gateway. The traffic between the battery charger and the gateway was also unencrypted and possibly vulnerable to replay attacks. For evaluation of the penetration testing and threat modelling there were found to be advantages and disadvantages to both methods. For a thoroughly analysis of the methods it would have needed further investigation. The system itself has potential for valuable findings with further investigations as well.