Mirage: towards a Metasploit-like framework for IoT

Romain Cayre (1, 2) , Vincent Nicomette (2) , Guillaume Auriol (2) , Eric Alata (2) , Mohamed Kaâniche (2) , Geraldine Marconato (1)

1 APSYS (Blagnac)
2 LAAS-TSF - Équipe Tolérance aux fautes et Sûreté de Fonctionnement informatique

Internet of Things (IoT) devices are nowadays widely used in individual homes and factories. Securing these new systems becomes a priority. However, conducting security audits of these connected objects based on experimental evaluation is a challenging task: it requires the use of heterogeneous hardware components leading to a set of specialised software tools, generally incompatible with each other and often complex to use. In this paper, we present a security audit and penetration testing framework called Mirage. This framework, written in Python, is dedicated to the analysis of wireless communications commonly used by IoT devices, and provides a generic, modular, unified and low level audit environment that is easy to adapt to new protocols. The paper describes the software architecture of Mirage, its goals and main features, and presents a concrete example of security audit performed with this framework.

Mots clés: IoT; wireless; audit; security; framework

Domaines: Cryptographie et sécurité [cs.CR]; Réseaux et télécommunications [cs.NI]

Romain Cayre, Vincent Nicomette, Guillaume Auriol, Eric Alata, Mohamed Kaâniche, et al.. Mirage: towards a Metasploit-like framework for IoT. 2019 IEEE 30th International Symposium on Software Reliability Engineering (ISSRE), Oct 2019, Berlin, Germany. ⟨hal-02346074⟩