إنتقل إلى المحتوى الرئيسي

Week 12 — Cloud, mobile and IoT security

Learning objectives​

  • Position a cloud pentest inside the shared responsibility model.
  • Identify the attack vectors specific to mobile applications.
  • Understand IoT surfaces and why they are often more vulnerable than the rest.

Cloud — The real risk is configuration​

Software vulnerabilities remain, but the overwhelming majority of cloud incidents come from overly permissive IAM configurations, exposed storage and secrets in clear in Git repositories.

What we look at first:

  • IAM policies with Action: "*" or Resource: "*".
  • S3 buckets / blob containers accessible anonymously.
  • Long-lived access keys, with no rotation.
  • Instance metadata reachable from applications (SSRF → role theft).

Tools: pacu, prowler (AWS), scoutsuite (multi-cloud), azure-hound (AAD).

Mobile​

Key difference with the web: the client runs on the user's device, so on hardware an attacker fully controls if they want to.

Classic vectors:

  • Hard-coded secrets in the APK (API key, signed token).
  • Unencrypted local storage (SharedPreferences, plist).
  • Missing certificate pinning → trivial TLS interception.
  • Android components exported without a need.

Tools: apktool, jadx, frida, objection.

IoT​

Connected devices stack it all up: old firmware, rare updates, default accounts, unencrypted services. An IoT pentest rarely goes beyond the fundamentals:

  • Default accounts, unchangeable passwords.
  • Admin interfaces exposed over HTTP.
  • Firmware downloadable and decryptable, containing secrets.
  • Serial ports physically accessible.

On this kind of engagement, the report insists on the organizational remediations: inventory, network segmentation, update cycle.

Bonus chapter — WPA2 and hacked cameras​

After the quiz, a full chapter dedicated to WiFi and IoT cameras covers why WPA2-PSK is still crackable in 2026, how cameras get compromised in practice (Mirai, default passwords, RTSP, ONVIF), and which defenses actually hold on the home, enterprise and manufacturer sides. Forty-five minutes of reading, with the exact commands (airodump-ng, hcxdumptool, hashcat -m 22000) and the 2018-2026 attack techniques (PMKID, evil twin, Dragonblood).