Metasploit security kit now hacks IoT devices, hardware
The popular Metasploit hacking kit has been upgraded to tackle today's Internet of Things (IoT) devices, granting researchers the opportunity to scour for bugs in modern vehicles.
Rapid7 Research director of transportation security Craig Smith announced on February 2 that the Metasploit framework can now link directly to hardware, permitting users to develop exploits to test their hardware and conduct penetration testing with less time wasted.
It is hoped that researchers will no longer have to build multiple tools to test today's modern devices and overcome previous network limitations.
"Metasploit condensed a slew of independent software exploits and tools into one framework and now we want to do the same for hardware," Smith says.
The open-source penetration testing software, available for free or as an extended, paid-for edition, is over a decade old but is still utilized by thousands of researchers worldwide. The framework currently boasts roughly 1,600 exploits and 3,300 penetration testing modules.
Due to the fresh update to the Hardware Bridge API, users are no longer limited to Ethernet network connections. Instead, researchers can build support directly into firmware or create a relay service through a REST API, which is necessary for some hardware tools including Software Defined Radio (SDR) that cannot communicate over Ethernet.
"Every wave of connected devices, regardless of whether you're talking about cars or refrigerators, blurs the line between hardware and software. As we like to say, this hardware bridge lets you exit the Matrix and directly affect real, physical things," said Smith. "We're working to give security professionals the resources they need to test and ensure the safety of their products, no matter what side of the virtual divide they are on."
The initial release focuses on IoT, with a particular slant towards automotive penetration testing. The bridge now includes modules for testing vehicle Controller Area Network (CAN) buses and users are also offered interactive commands for gathering information on vehicles being tested, such as speed and inbuilt security systems.
"If you are in security at an automaker, you are challenged to test things that are not exposed to traditional networks," Smith told Dark Reading. "The hardware bridge allows security teams to add hardware testing to their QA process. It also allows red teams to have a central user interface to all of their hardware tools."
Additional modules which target embedded, industrial, and hardware devices, including SCADA systems for industrial applications, will be added over time. Rapid7 also plans to add additional BUS systems, such as K-Line, in the future.
Rapid7 is asking users of the initial Metasploit release to provide feedback and suggest new automotive features for future versions.
Free ways to learn about IT, security and hacking online
This compact security gadget watches over your entire house: