Certified Ethical Hacker (CEH) Wireless, Mobile, IoT, and OT Hacking Syllabus

Define rooting (Android) versus jailbreaking (iOS).

Both remove vendor-imposed restrictions to gain privileged/root access. Rooting gains superuser on Android; jailbreaking removes Apple's restrictions on iOS to allow unsigned apps and system modification. Both weaken the security model.

What are the techniques (types) of iOS jailbreaking by boot persistence?

Tethered (needs a computer to reboot), Semi-tethered (boots without computer but jailbreak features need a computer), Semi-untethered (re-jailbreak via on-device app after reboot), and Untethered (persists across reboots with no computer).

What is the Android Debug Bridge (ADB) and how is it abused?

ADB is a command-line tool for communicating with Android devices. If ADB is enabled over network/USB without authorization, attackers can install apps, pull data, run shell commands, and bypass restrictions on the device.

What is app repackaging (trojanizing) on Android?

Attackers decompile a legitimate APK, inject malicious code, recompile and re-sign it, then distribute it via third-party stores. Users install a functional-looking app that also performs malicious actions.

What is the purpose of Mobile Device Management (MDM)?

MDM centrally enforces security policies on mobile devices: remote configuration, app/patch management, encryption enforcement, passcode policy, remote lock/wipe, and compliance monitoring across a device fleet.

Compare BYOD, COPE, and CYOD device ownership models.

BYOD (Bring Your Own Device) - employee-owned. COPE (Corporate-Owned, Personally Enabled) - company-owned but allows personal use. CYOD (Choose Your Own Device) - employee picks from a company-approved list of company-owned devices.

What is containerization in mobile security?

Separating corporate apps/data from personal apps/data into an encrypted, policy-controlled container on the device, so the enterprise can manage and wipe only corporate data without touching personal data.

What does the iOS Secure Enclave provide?

A dedicated hardware-based coprocessor that handles cryptographic key management and biometric data (Touch ID/Face ID) in isolation, so keys never leave the secure hardware even if the main OS is compromised.

What is SMS phishing and what is its variant using voice?

SMS phishing is 'smishing' - fraudulent text messages tricking users into clicking malicious links or revealing data. The voice-based variant is 'vishing' (voice phishing via phone calls).

What three things define IoT architecture's core layers?

Commonly: Edge/Perception layer (sensors/devices), Network/Access & Internet layer (gateways/connectivity), Middleware/Data layer (storage/processing), and Application layer (user services). Some models also add a Business layer.

Name common IoT communication protocols.

Application: MQTT, CoAP, AMQP, XMPP, HTTP. Network/short-range: Zigbee, Z-Wave, BLE, 6LoWPAN, LoRaWAN, NFC, RFID, Wi-Fi, cellular (LTE-M/NB-IoT).

What is MQTT and why does its security matter in IoT?

MQTT is a lightweight publish/subscribe messaging protocol over TCP using a broker. If misconfigured (no TLS, no authentication, anonymous access), attackers can subscribe to or publish on topics, intercepting or injecting device data/commands.

List the OWASP IoT Top 10 (top risks) starting with the most common.

1) Weak/guessable/hardcoded passwords, 2) Insecure network services, 3) Insecure ecosystem interfaces, 4) Lack of secure update mechanism, 5) Use of insecure/outdated components, 6) Insufficient privacy protection, 7) Insecure data transfer/storage, 8) Lack of device management, 9) Insecure default settings, 10) Lack of physical hardening.

What are the phases of the IoT hacking methodology?

1) Information gathering, 2) Vulnerability scanning, 3) Launching attacks (exploitation), 4) Gaining remote access, 5) Maintaining access (persistence).

What was the Mirai botnet and why is it significant in IoT security?

Mirai is malware that infected IoT devices (cameras, DVRs, routers) by brute-forcing default/hardcoded credentials, building a massive botnet used for record-breaking DDoS attacks (e.g., the 2016 Dyn attack). It highlighted weak default credentials in IoT.

What tool is the 'Shodan' of IoT reconnaissance and what does it do?

Shodan is a search engine that indexes Internet-connected devices and services (banners, open ports, IoT/ICS systems), letting attackers/researchers discover exposed devices, cameras, and SCADA systems.

What is a Sybil attack in the IoT/sensor network context?

An attack where a single malicious node forges multiple fake identities (Sybil nodes) to gain disproportionate influence over the network, disrupting routing, voting, or trust mechanisms.

Name four IoT security countermeasures (best practices).

Change default credentials, disable unused services/ports, enable secure firmware/OTA updates with signing, encrypt data in transit (TLS) and at rest, segment IoT on separate VLANs, use strong authentication, and harden physical access.

What does OT stand for and how does it differ from IT?

OT = Operational Technology: hardware/software that monitors and controls physical processes/devices (e.g., industrial machinery). IT manages data/information. OT prioritizes availability and safety; IT prioritizes confidentiality/data integrity.

What is ICS and what are its main component types?

ICS (Industrial Control System) controls industrial processes. Main types: SCADA (Supervisory Control and Data Acquisition), DCS (Distributed Control Systems), and basic components like PLCs, RTUs, HMIs, and IEDs.

Differentiate a PLC, RTU, and HMI in an ICS.

PLC (Programmable Logic Controller) is a ruggedized industrial computer controlling machinery. RTU (Remote Terminal Unit) is a microprocessor device interfacing remote field sensors to SCADA. HMI (Human-Machine Interface) is the operator dashboard for monitoring/control.

What does the Purdue Model define in OT/ICS security?

A reference architecture segmenting ICS into hierarchical levels (Level 0 field devices, Level 1 controllers/PLCs, Level 2 supervisory/SCADA, Level 3 operations/site, Level 3.5 DMZ, Levels 4-5 enterprise IT), guiding network segmentation between OT and IT.

Name common OT/ICS protocols.

Modbus, DNP3 (Distributed Network Protocol 3), PROFINET/PROFIBUS, EtherNet/IP, OPC, BACnet, and IEC 61850. Many are legacy protocols lacking built-in authentication or encryption.

Why is the Modbus protocol inherently insecure?

Modbus has no authentication, no encryption, and no integrity checking by design. Any device on the network can read/write registers and coils, allowing spoofing, command injection, and replay attacks.

What was Stuxnet and why is it a landmark OT attack?

Stuxnet was a worm (discovered 2010) that targeted Siemens PLCs in Iran's uranium enrichment centrifuges, manipulating their speed while feeding normal readings to operators. It was the first known malware to cause physical destruction of industrial equipment.

What is a HMI/SCADA man-in-the-middle attack in OT?

An attacker intercepts communication between the HMI/SCADA server and field controllers (PLCs/RTUs), altering control commands or sensor data so operators see false readings while the process is manipulated.

List key OT security countermeasures.

Network segmentation (IT/OT separation, DMZ per Purdue Model), strict access control and least privilege, monitoring with OT-aware IDS, patch/change management, disable unused services, secure remote access (VPN/jump hosts), and physical security of field devices.

What is the role of an air gap in OT security and its limitation?

An air gap physically isolates the OT network from external/IT networks to prevent remote attacks. Limitation: it is often breached by removable media (USB), maintenance laptops, or convenience connections (e.g., Stuxnet spread via USB).

What is bluejacking versus bluesnarfing?

Bluejacking sends unsolicited messages to nearby Bluetooth devices (relatively harmless). Bluesnarfing is unauthorized access to and theft of data (contacts, messages, files) from a Bluetooth device.

What is an aLTEr / IMSI-catcher (Stingray) attack against mobile devices?

An IMSI-catcher (e.g., Stingray) is a fake cell tower that forces nearby phones to connect to it, allowing the attacker to capture the device's IMSI, track location, and intercept or downgrade communications (man-in-the-middle on cellular).