43. IoT and OT Security – Cameras, Smart Devices, Plant Networks
43.10 Project, Ethics, IT Act and Purple Interview Lines
Allowed pattern:
- Build a weak IoT-style target you own
- From Kali, show the weakness (anonymous MQTT or default web login)
- Fix (auth, TLS or at least password + bind, firewalld, VLAN story)
- Re-test; prove anonymous fails
- Snapshot / revert
Banned: scanning society cameras, Modbus writes to a live factory, Mirai builders, Shodan mass maps, "testing" a shop DVR without written permission.
Ethics: written permission + own lab; IT Act awareness (sections such as 43 and 66 – verify current text); CERT-In / company IR for production; safety review before any OT change.
Interview model (clean English): "I treat IoT and OT as high-impact connectivity. In the lab I stand up my own Mosquitto broker, demonstrate anonymous publish as the failing control, then enforce authentication, tighten firewalld, and keep the service on a host-only network. I do not scan third-party cameras or practise control-protocol attacks against plants I do not own."
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Ignores scope; probes random CCTV | Written scope; host-only; legal reminder |
| Shares Mirai or plant-exploit kits | Refuses; teaches hardening + IT Act instead |
| Leaves MQTT on bridged adapter | Host-only / NAT lab; check ip a before demo |
Ravindra Bagale's Tip
"Bas ekda society chi camera check" = legal + career risk. CEH exam modules pan authorization first. Own VM. He lakshat theva.
Lab
Pair ethics drill: one builds MQTT; other only tests the agreed IP. Both write 4-line IT Act reminder. Switch. No bridged LAN.
Project: Build it, hack it, fix it
Build: On YOUR host-only VM (Amazon Linux / Ubuntu e.g. 192.168.56.50) for fictional Sahyadri Traders (Pune warehouse cameras + Nashik packing-line MQTT telemetry): (1) install Mosquitto (sudo yum install mosquitto mosquitto-clients or apt on Ubuntu), (2) deliberate weak start – allow_anonymous true, listen on 0.0.0.0:1883, no ACL, firewalld off or public wide open, (3) optional tiny HTTP page titled "Sahyadri Cam 1" with a trivial password, (4) chrony on, (5) snapshot pre-weak-iot. Document that Kali is 192.168.56.10 and Metasploitable .20 stays available but is not required for MQTT. Hack (lab only): From Kali, nmap -sS -T2 -p 1883,80,22 192.168.56.50; mosquitto_sub -h 192.168.56.50 -t '#' -v and mosquitto_pub ... -m 'intruder' – prove anonymous traffic works; if Path B, open the fake cam UI with the weak password. Never point tools at WAN cameras, never download Mirai, never speak Modbus writes to a real PLC. Fix: Set allow_anonymous false; create a password file (mosquitto_passwd); bind listener to the host-only IP; add ACL so sahyadri/warehouse/# is least-privilege; sudo service mosquitto restart; enable firewalld – allow 1883/tcp only from 192.168.56.10 (or only from a broker-client lab IP); disable the weak HTTP UI or put basic auth + HTTPS story; write the VLAN segregation note for Raja/Rani (IoT ≠ IT billing VLAN). Re-verify: Anonymous mosquitto_pub fails; authed client works; nmap from a non-allow IP (if you have a second lab host) does not get 1883; sudo service mosquitto status clean. Purple note: Red proved default-open MQTT is enough for fake telemetry; Blue proved auth + allow-list + zone thinking without touching the internet or any plant.
Thodkyaat sangaycha tar
- IoT = cameras/sensors; OT/ICS/SCADA = process control – add safety to CIA.
- Defaults, Telnet/HTTP, UPnP, cloud support planes = everyday SME camera surface.
- MQTT needs auth/TLS/ACL; Modbus/DNP3 stay inside trusted zones – no WAN, no write recipes here.
- Mirai-class lesson: weak IoT becomes outbound DDoS cannon (Dyn 2016 reporting).
- Segregate IT / IoT / OT; jump hosts; firewalld allow-lists – VLAN alone is not enough.
- Exposure search only for your authorized IPs; never mass-map strangers.
- Firmware: signed vendor updates, isolate EOL, supply-chain hygiene; TRITON = why SIS isolation matters.
- Detect odd IoT egress, login bursts, forbidden IT→OT protocol flows.
- Lab: Mosquitto or fake cam UI on OWN
.50;sudo yum/sudo service; Kali host-only. - Ethics / IT Act; Project Build-Hack-Fix for Sahyadri Traders Pune / Nashik.
Samjla ka? IoT ani OT security shiklo – pan pratyek sobat bachav, segregation, ani safe lab. Pudhchya chapter madhe **mobile device security** (phones, MDM, still ethics-first) – CEH modules pudhe. Chala pudhe, mitrano!