📱 IOT Connect - Android Exploitation

---

🧠 Overview

This project demonstrates the exploitation of an insecure Broadcast Receiver in the IOT Connect Android application. The vulnerability allows an attacker to bypass authentication and trigger the master switch to control all connected IoT devices.

---

🎯 Objective

Exploit a Broadcast Receiver vulnerability to activate the master switch without proper authorization.

---

🔍 Vulnerability Details

📌 Type

• Insecure Broadcast Receiver
• Improper Authorization
• Weak Cryptographic Validation

⚠️ Root Cause

• The Broadcast Receiver is exported (android:exported="true")
• No permission protection is applied
• Sensitive functionality is exposed via broadcast
• PIN validation is performed client-side
• Weak encryption with a small key space (3-digit PIN)

---

💥 Impact

An attacker can send a crafted broadcast intent to:

• Bypass authentication restrictions
• Activate the master switch
• Control all connected IoT devices

---

🧪 Technical Analysis

1️⃣ Application Behavior

• Guest users cannot control all devices
• Master Switch requires a 3-digit PIN

---

2️⃣ Reverse Engineering

Using JADX, the following was identified:

• Broadcast Receiver listens for:

MASTER_ON

• It expects an integer extra:

key

---

3️⃣ Code Analysis

The application validates the PIN using AES decryption:

decrypt(ds, key).equals("master_on")

Where:

• ds = "OSnaALIWUkpOziVAMycaZQ=="
• The key is derived from the user-provided PIN

---

4️⃣ Cryptographic Weakness

• AES is used in ECB mode (insecure)
• Key is generated from a simple integer (PIN)
• Key space is small (100–999)
• Can be brute-forced easily

---

🧨 Exploitation

📡 Sending Malicious Broadcast

adb shell am broadcast -a MASTER_ON --ei key 345

---

🚀 Result

• Successfully triggered the master switch
• All IoT devices were activated
• Authentication mechanism bypassed

---

🛠️ Tools Used

• JADX (Reverse Engineering)
• ADB (Exploitation)
• Android Emulator / Nox
• Python (for analysis)

---

📸 Proof of Concept

Add your screenshots here:

screenshots/login.png
screenshots/jadx.png
screenshots/exploit.png

---

🔐 Recommendations

• Set android:exported="false" for sensitive receivers
• Use permission-based protection
• Avoid client-side validation for critical operations
• Use secure cryptographic practices
• Implement server-side verification

---

🎓 Conclusion

This lab highlights the risks of exposing internal components and relying on weak client-side validation. Proper access control and secure coding practices are essential to protect IoT systems from unauthorized access.

---