Explore IoT & Embedded Device Security

You start most sessions the way a real assessment starts: not with a soldering iron, but with a sketch. Nugget lays out device, companion app, vendor cloud, and radio as one system on the whiteboard, and asks you where you'd try first — and why. Newer instincts reach for JTAG because it looks like the real work. The cheaper win is usually sitting in a mobile app's leaked token or a cloud API that trusts a device ID a little too much.

When you do get a firmware image, Nugget won't let you skip to the disassembler. You read the filesystem first — init scripts, what runs as root, what's stripped MIPS versus ARM — because that's where most of the actual story lives, and because bringing x86 assumptions to embedded binaries just gets you nonsense. Credentials show up eventually. The question Nugget keeps circling back to isn't whether you found one, it's whether it's unique to this device or baked into every unit on the shelf.

Along the way you'll get the unglamorous fixes too — cycling baud rates when UART spits garbage instead of declaring the header dead, checking whether the bootloader accepts an unsigned image before treating a weak password as the headline finding. None of this replaces coursework on any one protocol. It's the habit of asking which surface actually matters before you spend an afternoon on the one that looks impressive.