Approach to Testing IoT Devices

IoT devices with applications connected to networks, especially the Internet, are often not considered to be computers because of their shape – but they are. Recently it has been popular to test/hack these devices, resulting in the discovery of many nasty vulnerabilities. The OWASP project has suggested an IoT Top Ten, as they have done before for web and mobile applications, to give testers a framework to test in. This article proposes ideas as an extension to the Penetration Testing Execution Standard (PTES) when testing IoT devices.This paper was written in 2016 as part of a research project at scip AG, Switzerland. It was initially published online at https://www.scip.ch/en/?labs.20160211 and is available in English and German. Providing our clients with innovative research for the information technology of the future is an essential part of our company culture