Vulnerability Assessment for IoT Nodes Using OpenBTS and Software Defined Radios

Large-scale cyber attacks using IoT devices have increased in recent years. One of the strategies to deal with this problem is the use of penetration test techniques. The aim of this study was to develop a vulnerability assessment for an IoT M2M node that uses GSM technology. A test scenario was designed consisting of a GMS network created using USRP N210 and OpenBTS radios in a multicell configuration. An IoT-GSM node was designed from a sim8001 radio module, used in several M2M devices. The IoT node stores the measurements of the radio bases operational parameters that make up the GSM network. An algorithm for controlling an attacking base radio was designed using the OpenBTS API, which allows the deployment of a “man in the middle” attack. The entire test deployment can be carried out remotely. Analysis of the results of the measurements obtained lets us understand the attack's behavior in detail and determine the IoT-GSM node's vulnerability. The results obtained show the potential of SDR and OpenBTS technology as penetration test tools to analyze vulnerabilities of IoT systems.