This module covers security vulnerabilities in mobile platforms (Android, iOS) and IoT devices. Topics include jailbreaking/rooting, malicious applications, RFID/NFC cloning, Bluetooth attacks, smartwatch vulnerabilities, and IoT device exploitation.
The CEHStudy app carries 12 flashcards for Module 17 across 3 sections — split the domain while you study it: the mobile side (sandboxing, jailbreak/root, MDM, smishing) and the embedded side (default credentials, firmware analysis, RFID/NFC), because exam stems test each half with its own toolset.
Mobile malware: trojans, spyware, ransomware, rootkits
RFID cloning and NFC skimming attacks
Bluetooth attacks: BlueBorne, bluesnarfing, bluejacking
IoT device vulnerabilities and firmware analysis
Mobile device lost/stolen procedures and data protection
Important Terms & Concepts
Jailbreaking (iOS): Removing manufacturer restrictions on iOS devices. Enables app sideloading but voids warranty, bypasses sandbox, and creates security risks.
Rooting (Android): Gaining elevated privileges on Android devices. Similar to jailbreaking — enables full system access but compromises security model.
RFID Cloning: Capturing and replicating RFID card data (access cards, payment cards). Low-frequency RFID (125 kHz) is easily cloned with inexpensive devices.
NFC Skimming: Using near-field communication readers to steal contactless payment or access card data. Requires close proximity but is harder to detect than RFID cloning.
BlueBorne: Critical Bluetooth vulnerability affecting Android and iOS. Allows takeover of devices through protocol stack exploits without pairing. Affects Bluetooth Classic and BLE.
Mobile Malware Vectors: Sideloading apps, SMS/phishing links (smishing), malicious QR codes (quishing), compromised third-party app stores, and drive-by downloads.
How to Study This Module
Differentiate Android vs iOS security models and attack vectors
What is the biggest mobile security threat? Malicious apps (sideloading), phishing/smishing attacks, and unpatched OS vulnerabilities. For organizations: BYOD policies with proper MDM/MAM solutions.
How do you secure IoT devices? Change default credentials, disable unnecessary services, keep firmware updated, segment on separate VLAN, and monitor for unusual network behavior.
What is Mobile and IoT Security in Ethical Hacking?
Mobile Platforms & IoT Security covers two interconnected attack surfaces on the Certified Ethical Hacker v13 (CEH v13) exam administered by EC-Council: mobile devices (Android, iOS, tablets) and the broader Internet of Things (smart home devices, wearables, connected sensors). BYOD (Bring Your Own Device) gives mobile devices a corporate role and makes them high-value targets for data theft. IoT multiplies the attack surface further — a single household may contain dozens of connected devices, many with no patching mechanism and weak authentication. On the CEH v13 exam, questions related to Module 17 account for approximately 6% of total questions.
Key Concepts in Mobile & IoT Security
Android Security Model & APK Attack Surface: Android's model rests on four controls: (1) application sandboxing — each app runs under its own Linux UID with isolated data directories; (2) permission system — apps declare permissions at install, users grant/deny them; (3) code signing — APKs signed with developer keys; (4) SELinux policy enforcement. CEH-tested attack surface: sideloading unsigned or repackaged APKs from outside the Play Store, permission escalation through vulnerable system services, IPC attacks via Intent hijacking, APK decompilation with apktool. Android is open-source (AOSP), iOS closed: Android vulnerabilities get public analysis and faster patching, but custom ROMs and rooted devices widen the attack surface. Mobile malware on Android: banking trojans (FakeBank), spyware (SpyEye mobile), ransomware (device locked until payment), SMS-forwarding malware that intercepts 2FA codes.
RFID vs NFC: Frequency, Range & Cloneability: RFID operates at three frequency bands: Low Frequency (125-134 kHz, range ~10 cm), High Frequency (13.56 MHz, range ~1 meter — most access cards and contactless payment), and Ultra-High Frequency (860-960 MHz, range up to 12 meters — inventory/logistics). NFC is a subset of HF RFID at 13.56 MHz with range limited to ~4 cm — the short range is itself a security feature (prevents remote skimming). LF cards (125 kHz proximity badges like HID Prox) hold static IDs trivially cloned with $20 Proxmark devices; HF/NFC payment cards use cryptographic authentication (EMV Contactless, ISO 14443), making cloning much harder but not impossible (Mifare Classic DESFire vulnerabilities). The primary NFC payment attack is a relay attack — two RFID readers extend the range between the victim's card and the terminal — rather than direct cloning.
IoT Device Attack Patterns & Firmware Analysis: The IoT vulnerabilities CEH tests most: (1) default/weak credentials — admin/admin or no password, never changed; (2) unencrypted administrative interfaces — HTTP instead of HTTPS web panels, Telnet instead of SSH; (3) no patching mechanism — without OTA updates, known CVEs stay exploitable indefinitely; (4) insecure cloud connectivity — devices phoning home with weak or no TLS; (5) firmware backdoors — debug shells, hidden telnet, hardcoded API keys. Firmware analysis: extract the image (JTAG/SWD hardware, or vendor website download), identify and extract filesystems with binwalk, check configuration files for hardcoded credentials, review web application code for SQLi/XSS, and look for debug interfaces. Mirai is the most commonly referenced IoT attack — it exploits default credentials to build a DDoS botnet of 250,000+ compromised cameras and routers.
BlueBorne: Bluetooth Attack Without Pairing: BlueBorne (CVE-2017-0781 through CVE-2017-0949) let unauthenticated attackers hijack Android, iOS, Windows, Linux, and BlackBerry devices and spread via the air — proximity alone was sufficient. It exploited the Bluetooth stack itself — SDP (Service Discovery Protocol), L2CAP (Logical Link Control and Adaptation Protocol), ATT (Attribute Protocol) — to execute arbitrary code with full user privileges, access camera/microphone, steal paired data, and infect other in-range devices worm-style. Its criticality: no pairing required, all major OSes affected at once, chainable, exploit public and reliable before most patches shipped. Mitigation: patch the Bluetooth stack firmware, disable Bluetooth when not in use, note the ~10-meter effective range of Classic Bluetooth.
Common Exam Mistakes in Module 17
Treating jailbreaks and rooting as mere policy violations: removing the vendor lock voids the real security boundaries — code signing and sandboxing on iOS, the permission model on Android — and can block updates, multiplying malware exposure. On the exam, an enterprise detects this via MDM policy checks for jailbreak/root state across devices, not an app-store ban list.
Forgetting that IoT risk at scale is a credentials problem: Mirai needed no zero-day — it scanned for and brute-forced default Telnet/SSH logins on cameras and routers, then powered a roughly 1-terabit DDoS against Dyn. The exam's remediation list starts where the failures began: change default credentials, disable unnecessary services (telnet especially), patch firmware, segment IoT onto its own VLAN.
Stopping at static APK analysis: apktool and JADX unpack resources and decompile DEX to reveal hardcoded keys, insecure local storage (SQLite, shared preferences), and plaintext HTTP calls — but runtime stems need the dynamic side: Frida and Objection hook a running app to bypass SSL pinning, call functions, and dump live data, with Burp or mitmproxy standing in for the traffic.
Tools Used in Mobile & IoT Hacking
Mobile and embedded attack tools the CEH v13 exam references, by job:
Airspy: software-defined radio for intercepting and analyzing RF signals — RFID frequency identification, passive surveillance of wireless device traffic, cloning low-frequency proximity cards
apktool (with JADX): Android APK decompilation — unpacks resources, disassembles smali/DEX into readable Java so hardcoded API keys, insecure storage, and permission problems surface in static analysis
Frida & Objection: dynamic instrumentation pair for mobile pentesting — hooks the running app to bypass SSL pinning, dump data, and call functions directly
binwalk (with firmware-mod-kit): firmware carving and extraction — finds the embedded filesystems and archives in a flash image and unpacks them for review of CGI code, stored credentials, update mechanisms
OWASP Mobile Security Testing Guide: free test-case framework for mobile app assessments — 50+ checks spanning platform security, cryptography, data storage, code quality
Netcat / ncat: basic network utilities for testing IoT port exposure and interacting manually with services like the default telnet console
Worked Example: From APK to Cloned Badge, One Audit Loop at a Time
The mobile half starts static: apktool decompiles the corporate banking APK, and the read finds plaintext SQLite storage, an exported component any app can call, and API calls over unencrypted HTTP — the classic triad of mobile findings. Runtime work confirms it: Frida hooks the app in place, bypasses its SSL pinning so mitmproxy can see the traffic, and Objection dumps what the app keeps on disk. The embedded half runs the same loop on hardware: binwalk -e carves the camera's flash image into a readable filesystem, recursive grep surfaces admin/admin defaults and an unencrypted telnet service, and Ghidra finds the debug interface no one documented.
The twist: access-control hardware is where the two worlds meet — Proxmark3 reads the Mifare Classic badge's UID in cleartext, and because Crypto-1 was broken in 2008, a known-answer attack needs only about 20,000 authentication attempts. The nested-authentication flaw cascades: cracking one sector's Key A yields that sector's Key B and the next sector's Key A, rolling through all 16 sectors until the full card state — permissions included — is cloned. Exam's closing fact: Mifare Classic never belongs in high-security access control; DESFire (AES-128) or iCLASS SE (3DES with anti-clone features) replace it.
How to Study Mobile & IoT Security for the CEH v13 Exam
To effectively study Module 17 for the Certified Ethical Hacker exam:
Create a mobile platform comparison: Android vs iOS | Sandboxing mechanism | Permission model | Malware distribution channel | Root/Jailbreak method | Enterprise MDM support. Stems ask which security feature belongs to which platform — e.g., "Which platform uses code signing to enforce app integrity?" (Answer: Both, but iOS enforces it more strictly; Android allows sideloading by default). iOS is a closed ecosystem (all apps must be signed by Apple); Android is open (users can install from any source)
Hands-on exercise: decompile a vulnerable Android app from a CTF platform with apktool — identify hardcoded API keys (strings.xml), insecure storage (SharedPreferences), cleartext HTTP calls, unnecessary permissions (AndroidManifest.xml). For IoT: extract a firmware image from a public dataset with binwalk, then grep for default credentials
Memorize the RFID frequency classification and cloneability: LF (125 kHz) — static ID, trivially cloned; HF (13.56 MHz) — cryptographic auth, harder to clone, where NFC operates; UHF (860-960 MHz) — long range, inventory not security. Proxmark3 handles LF/HF; Airspy covers the broader RF spectrum including ZigBee (2.4 GHz) and sub-GHz IoT communications
Review related modules: Module 16 (Wireless Networks) for wireless attacks that apply to mobile devices (evil twin, deauth) — phones are wireless clients — and Module 18 (OT & IoT Attacks) for SCADA/ICS attacks beyond consumer IoT. Module 17 covers consumer/smart-device IoT; Module 18 covers critical infrastructure IoT
Frequently Asked Questions About Mobile & IoT Security
What is a Mifare Classic card and why is it vulnerable to cloning?
Mifare Classic (MIFARE 1K) is a 13.56 MHz HF RFID chip from NXP Semiconductors, used for access control cards, transit passes, and loyalty programs. Its 4 KB of memory is organized into 16 sectors, each protected by its own Key A and Key B under the proprietary Crypto-1 cipher. Crypto-1 was broken in 2008 by Radboud University Nijmegen researchers: a known-answer attack needs only about 20,000 authentication attempts — minutes on a Proxmark3. The nested-authentication flaw cascades: cracking one sector's Key A yields that sector's Key B and the next sector's Key A, rolling through all 16 sectors. Hence Mifare Classic should never be used for high-security access control; Mifare DESFire (AES-128) and iCLASS SE (3DES with anti-clone features) replace it. Practical attack: Proxmark3 reads the UID in cleartext, then cracks the Crypto-1 keys to clone the full card state including access permissions.
How do you perform a firmware analysis on an IoT device for a CEH exam?
IoT firmware analysis workflow: (1) Acquire — vendor website, serial console (UART), or JTAG/SWD flash dump; (2) Identify format — file and binwalk show compressed (gzip, lzma, squashfs) vs raw flash layout; (3) Extract filesystems — binwalk -e firmware.bin recursively pulls embedded archives/filesystems (CramFS, JFFS2, UBI, squashfs); (4) Analyze web interface code — check CGI scripts for SQL injection, command injection, path traversal; (5) Search credentials — grep -r 'password\|passwd\|admin' across extracted files for hardcoded defaults, API keys, secrets; (6) Examine binaries — Ghidra or IDA Pro on main executables for debug interfaces (hidden telnetd, netcat backdoors), insecure randomness, buffer overflows; (7) Check updates — OTA process present, and is firmware signed? If not, an attacker can push malicious firmware; (8) Document findings with CVE references. Most commonly found: default credentials (admin/admin), unencrypted telnet, hardcoded encryption keys, no update mechanism.
Related CEH v13 Modules
Module 16: Hacking Wireless Networks — mobile devices are wireless clients exposed to the same evil twin, deauthentication, and rogue AP attacks
Module 18: Attacks on OT & IoT — extends into OT environments: SCADA systems, PLCs, HMI panels, industrial protocols (Modbus, DNP3, OPC)