Saltar al contenido principal

Week 12 — Cloud, mobile and IoT security

Learning objectives​

  • Position a cloud pentest inside the shared responsibility model.
  • Identify the attack vectors specific to mobile applications.
  • Understand IoT surfaces and why they are often more vulnerable than the rest.

Cloud — The real risk is configuration​

Software vulnerabilities remain, but the overwhelming majority of cloud incidents come from overly permissive IAM configurations, exposed storage and secrets in clear in Git repositories.

What we look at first:

  • IAM policies with Action: "*" or Resource: "*".
  • S3 buckets / blob containers accessible anonymously.
  • Long-lived access keys, with no rotation.
  • Instance metadata reachable from applications (SSRF → role theft).

Tools: pacu, prowler (AWS), scoutsuite (multi-cloud), azure-hound (AAD).

Mobile​

Key difference with the web: the client runs on the user's device, so on hardware an attacker fully controls if they want to.

Classic vectors:

  • Hard-coded secrets in the APK (API key, signed token).
  • Unencrypted local storage (SharedPreferences, plist).
  • Missing certificate pinning → trivial TLS interception.
  • Android components exported without a need.

Tools: apktool, jadx, frida, objection.

IoT​

Connected devices stack it all up: old firmware, rare updates, default accounts, unencrypted services. An IoT pentest rarely goes beyond the fundamentals:

  • Default accounts, unchangeable passwords.
  • Admin interfaces exposed over HTTP.
  • Firmware downloadable and decryptable, containing secrets.
  • Serial ports physically accessible.

On this kind of engagement, the report insists on the organizational remediations: inventory, network segmentation, update cycle.