Exam objective 10.1 asks you to identify security issues in IoT and OT environments and understand the attack vectors specific to these systems. It matters because the number of connected devices is exploding, and securing them is a core responsibility for any ethical hacker. You need to know why a smart lightbulb or a factory robot can be a bigger risk than a traditional computer.
Jump to a section
A simple way to picture IoT and OT Hacking
Because a smart thermostat is connected to the internet, someone can hack it. This leads to them controlling your home's heating and cooling from anywhere in the world. Imagine you install a smart thermostat to save on energy bills. It connects to your home Wi-Fi and a cloud service so you can adjust the temperature from your phone. Now, think about how a burglar might case your house. They notice you leave for work at 8 AM and come home at 6 PM. They could break in during that window. But with a smart thermostat, the hacker doesn't need to be physically present. They find a vulnerability in the thermostat's software—like a default password you never changed—and log in remotely. Once inside, they can see your schedule, when the house is empty, and can even turn the heat up to damage your pipes in winter or turn it off to freeze you out. This is exactly how IoT (Internet of Things) hacking works: because a device is connected to a network, a weakness in that device's security allows an attacker to take control. The attacker doesn't need to touch the device; they just need a path through the internet and a single flaw. In the OT (Operational Technology) world, the stakes are even higher. Instead of your thermostat, imagine a smart valve at a water treatment plant. Because that valve is connected to a network, a hacker could remotely open it and flood a city. The cause-and-effect chain is the same: connectivity plus a vulnerability equals a remote takeover with potentially catastrophic consequences.
IoT stands for the Internet of Things. This refers to everyday physical objects that are connected to the internet. Think of smart lightbulbs, connected fridges, fitness trackers, and smart speakers. These devices have sensors, software, and network connectivity that allow them to collect and exchange data. OT stands for Operational Technology. This is hardware and software that monitors or controls physical devices, processes, and events in an industrial setting. Think of the systems that run a power plant, a water treatment facility, or a manufacturing assembly line. OT includes things like Programmable Logic Controllers (PLCs), which are ruggedised computers that control machinery, and Supervisory Control and Data Acquisition (SCADA) systems, which are central software platforms that monitor and control entire industrial processes.
The core reason these systems are vulnerable is the same: they were never designed with security as a primary goal. IoT devices were designed for convenience and low cost. Manufacturers often rush them to market with default passwords like 'admin' or 'password,' outdated software, and no way to update them securely. For OT, the focus was always on reliability and safety. A factory line must run 24/7 without interruption. Applying a security patch might require a reboot, which could cost millions in lost production. So, OT systems often run on old, unpatched operating systems like Windows XP or custom firmware that has known vulnerabilities. The convergence of IoT and OT is a major trend. This is when internet-connected sensors and smart devices are added to traditional industrial environments to improve efficiency and data collection. For example, a factory might add Wi-Fi-connected temperature sensors to its legacy PLCs. This creates a new attack surface. An attacker can now potentially hack the sensor (an IoT device) and use it as a stepping stone to reach the PLC (an OT device) on the same network.
The main attack vectors for IoT and OT hacking are:
Weak or default credentials: Most IoT devices ship with usernames and passwords like 'admin/admin'. Hackers scan the internet for devices still using these defaults and take control.
Insecure network services: Many IoT devices run unnecessary services like Telnet (an unencrypted remote access protocol) or HTTP (the unencrypted web protocol) that can be exploited.
Lack of secure update mechanisms: If a device cannot be patched remotely and securely, any vulnerability found in its software will remain exploitable forever.
Insecure firmware: The software baked into the device's hardware can often be extracted, reverse-engineered, and modified by an attacker to install malware.
Physical tampering: In OT environments, an attacker might gain physical access to a PLC and connect a laptop directly to it to upload malicious code.
Man-in-the-Middle (MitM) attacks: An attacker intercepts and potentially alters communication between devices. For example, between a sensor and the control system, sending fake readings.
A classic example is the Mirai botnet. Hackers scanned the internet for IoT devices like security cameras and routers still using default passwords. They infected these devices with malware that turned them into 'bots'—zombie computers under the hacker's control. They then used thousands of these compromised devices to launch a massive DDoS (Distributed Denial of Service) attack, overwhelming a major internet infrastructure company and taking large parts of the internet offline.
For OT, the most famous example is Stuxnet. This was a highly sophisticated piece of malware that targeted Iranian nuclear centrifuges. It exploited multiple zero-day vulnerabilities (flaws unknown to the software vendor) in Windows systems and then specifically targeted Siemens PLCs. It caused the centrifuges to spin at unsafe speeds while sending normal operating readings back to the control room, physically destroying the equipment while the operators saw nothing wrong. This showed the world that OT systems could be targeted and destroyed remotely.
Why does this matter for the CEH exam? You need to recognise that IoT and OT are not just 'computers'—they are embedded systems with different constraints. An IoT device may run on a tiny battery and have a weak processor, meaning it cannot run traditional antivirus software. An OT system may prioritise uptime over patching, meaning vulnerabilities persist for years. As an ethical hacker, you must assess these unique risks and test for them using specialised tools like Shodan (a search engine for internet-connected devices) or by analysing firmware.
Reconnaissance and Discovery
The attacker scans the internet using specialised search engines like Shodan to find exposed IoT devices such as cameras, thermostats, or industrial controllers. They are looking for devices that are accessible from the internet without a firewall.
Credential Exploitation
The attacker attempts to log into the discovered device using a list of common default credentials (e.g., 'admin/admin', 'root/1234'). This is the most common initial access vector because manufacturers rarely force users to change defaults.
Network Pivoting
Once inside the IoT device, the attacker uses it as a foothold. They scan the device's internal network (the network the IoT device is connected to) to find other devices, such as OT systems like PLCs or SCADA servers.
Exploiting OT Vulnerabilities
The attacker identifies an OT device running old, unpatched firmware or software. They use a known exploit for that specific vulnerability to gain unauthorised control of the OT device, such as a PLC controlling a robotic arm.
Achieving the Objective
The attacker manipulates the OT device to cause a desired physical effect, such as stopping a production line, altering sensor readings to hide a problem, or causing catastrophic damage like spinning a turbine too fast.
An IT professional, often called a penetration tester or ethical hacker, is hired by a manufacturing company to assess the security of their new 'smart factory'. The company has just installed hundreds of IoT sensors to monitor machine vibration, temperature, and energy usage across the factory floor. They have also connected these sensors to their existing OT network, which controls the robotic assembly arms and conveyor belts (the PLCs).
The penetration tester's first step is reconnaissance. They use Shodan (a search engine that indexes internet-connected devices) to see if any of the company's IoT sensors or OT interfaces are directly exposed to the internet. They find a web interface for a temperature sensor that is accessible from the internet using a default IP address range. The manufacturer did not put it behind a firewall.
Next, the tester tries to log in. Using a common list of default credentials, the tester tries 'admin/admin' on the sensor's web interface. It works. The tester is now inside the sensor's management dashboard. From here, they can see the sensor's data and, more importantly, the network configuration. The sensor is on the same network as the factory's main SCADA system.
The tester then uses the sensor as a pivot point. They upload a small script that scans the internal network for other devices. The script finds several PLCs that control the robotic arms. One of these PLCs is running an old version of its firmware with a known vulnerability that allows an attacker to upload new code without authentication. The tester exploits this vulnerability and uploads a harmless proof-of-concept program that causes the robotic arm to pause for one second every hour.
The actions the tester takes in this scenario include:
Using Shodan to discover internet-facing devices.
Attempting default credentials on IoT device interfaces.
Exploiting the IoT device to gain a foothold on the network.
Scanning the internal network from a compromised IoT device.
Using a known exploit against an unpatched PLC firmware.
Demonstrating a physical impact (stopping the arm) without causing real damage.
The final report to the company details the entire chain of attack. It recommends: placing all IoT devices behind a firewall and not exposing them directly to the internet, changing all default passwords immediately, implementing network segmentation to separate IoT devices from critical OT systems, and establishing a mandatory firmware update policy. The tester's work directly prevents a real attacker from taking control of the factory floor, which could have caused physical damage, halted production, or endangered workers.
The 312-50 exam tests your understanding of the specific vulnerabilities and attack vectors unique to IoT and OT environments, not general network hacking. They love to ask questions that differentiate between IoT and OT, and to test your knowledge of real-world attacks like Mirai and Stuxnet.
Specifically, the exam focuses on:
The definition of IoT and OT and the key differences. Be able to state that IoT focuses on convenience and connectivity, while OT focuses on control and safety.
Common IoT vulnerabilities: weak passwords, insecure network services, lack of encryption, insecure firmware, and lack of an update mechanism.
The 'Mirai botnet' attack: Know that it targeted devices with default credentials and created a DDoS botnet.
The 'Stuxnet' attack: Know that it targeted Siemens PLCs, used multiple zero-day exploits, and caused physical damage to centrifuges.
The concept of 'air-gapped' networks. An air-gapped network is physically isolated from the internet and other unsecured networks. Stuxnet famously infected an air-gapped network via a USB drive.
The 'attack surface' of IoT devices. The exam will ask why these devices are vulnerable (e.g., limited processing power, constrained battery life, no user interface for security updates).
The difference between 'HAVOC' (HMI, Application, Vendor, Other, Controller) and other attack trees is less relevant, but you should understand the roles of HMI (Human-Machine Interface) and PLCs.
The traps they set include:
Confusing IoT with general web hacking. A question might describe a vulnerability in a web application and ask if it's specific to IoT. The answer is no—it's a general web application vulnerability. An IoT-specific vulnerability would be one that exploits the device's physical limitations, like a side-channel attack that monitors power consumption.
Asking about 'bluejacking' or 'bluesnarfing'—these are Bluetooth-specific attacks, not broad IoT/OT issues.
Testing the difference between SCADA and PLC. Know that SCADA is the overarching system that controls multiple PLCs, while a PLC is the individual controller for a specific machine.
To memorise key concepts:
IoT = Internet of Things (consumer devices).
OT = Operational Technology (industrial control systems).
PLC = Programmable Logic Controller (controls a machine).
SCADA = Supervisory Control and Data Acquisition (monitors and controls multiple PLCs).
HMI = Human-Machine Interface (the screen and controls a human operator uses).
Default credentials are the number one initial attack vector for IoT.
Air-gapped networks are not safe from USB-based attacks (Stuxnet).
Convergence of IoT and OT creates new attack paths from accessible sensors to critical control systems.
Be prepared to answer a scenario-based question: 'A penetration tester finds a smart thermostat on the same network as a building's HVAC control system. What is the tester's best next step?' The answer is to attempt to exploit the thermostat to gain a foothold and pivot to the HVAC system, because the thermostat is a less secure IoT device that shares a network with a critical OT system.
IoT devices are often vulnerable because they use default credentials and have no secure update mechanism, making them easy targets for botnets like Mirai.
OT systems are prioritised for reliability and safety, not security, which is why they often run unpatched software for years.
The Stuxnet attack proved that a nation-state can cause physical destruction by hacking OT systems, even those on air-gapped networks.
Convergence of IoT and OT increases the attack surface because a vulnerable sensor can be a pivot point into the core industrial control network.
A penetration tester must use tools like Shodan to discover internet-facing IoT devices and test default passwords as a first step.
Default credentials are the single most common entry point for hacking IoT devices in the real world.
These come up on the exam all the time. Here's how to tell them apart.
IoT (Internet of Things)
Focuses on convenience, connectivity, and data collection.
Devices are typically low-cost consumer products (cameras, thermostats).
Primary risk is data exposure or being used in a botnet.
OT (Operational Technology)
Focuses on control, safety, and reliability of physical processes.
Devices are specialised industrial controllers (PLCs, SCADA systems).
Primary risk is physical damage, production loss, or safety hazards.
Default Credentials Attack
Exploits the fact that devices use 'admin/admin' or similar default passwords.
Is a simple, brute-force or guess-based attack.
Often grants full administrative access with minimal effort.
Firmware Exploit Attack
Exploits a software bug or vulnerability in the device's firmware.
Requires knowledge of the specific vulnerability and a crafted exploit payload.
Can lead to remote code execution even if passwords are strong.
Mirai Botnet
Targeted consumer IoT devices globally.
Goal was to create a massive botnet for DDoS attacks.
Used simple default credential scanning to infect devices.
Stuxnet Worm
Targeted industrial OT systems in a specific Iranian facility.
Goal was to physically destroy nuclear centrifuges.
Used multiple sophisticated zero-day exploits and was spread via USB.
Mistake
IoT devices are not a big security risk because they don't store sensitive personal data.
Correct
IoT devices are a huge risk because they are often insecure gateways into a network, and can be used to launch attacks on other systems or cause physical harm.
Beginners focus on the data inside a device, but experienced hackers focus on what the device can access on the network.
Mistake
OT systems like those in power plants are not connected to the internet, so they are safe from remote hacking.
Correct
Many OT systems are now connected for remote monitoring and maintenance. Even air-gapped systems can be infected via removable media like USB drives, as demonstrated by Stuxnet.
People assume 'air-gapped' means completely invulnerable, forgetting that humans still interact with these systems and can introduce malware physically.
Mistake
If an IoT device uses strong encryption for its web interface, it is secure.
Correct
Encryption is just one layer. The device might still have weak default credentials, insecure firmware that can be reverse-engineered, or unpatched software vulnerabilities that allow remote code execution.
People often equate 'uses HTTPS' with 'secure', ignoring the other layers of security like authentication, patching, and physical hardening.
Mistake
The Mirai botnet was a sophisticated attack that required advanced skills.
Correct
The Mirai botnet succeeded largely because it used a simple technique: scanning the internet for devices with default usernames and passwords. It was a massive attack built on a very basic vulnerability.
Beginners often overestimate the complexity of real-world hacks. It is humbling but true that many huge breaches exploit the simplest mistakes.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
IoT (Internet of Things) refers to everyday connected devices like smart lightbulbs and fitness trackers. OT (Operational Technology) refers to industrial systems that control physical processes, like the PLCs and SCADA systems in a power plant.
They are often made cheaply and rushed to market without security features. Common problems include hardcoded default passwords, no way to install security updates, and unencrypted communications.
PLC stands for Programmable Logic Controller. It is a ruggedised computer used in industrial settings to control machinery like conveyor belts, robotic arms, or valves.
Stuxnet was a highly sophisticated piece of malware believed to have been created by the US and Israel. It targeted Iranian nuclear centrifuges by infecting Siemens PLCs and causing them to spin out of control while reporting normal readings to operators.
An air-gapped network is a computer or network that is physically isolated from the internet and any other unsecured networks. It is considered very secure, but can still be infected via removable media like USB drives.
Shodan is a search engine that lets you find devices connected to the internet, including IoT devices like security cameras, routers, and industrial control systems. Attackers and ethical hackers use it to identify exposed and potentially vulnerable systems.
You've finished IoT and OT Hacking. Continue through the 312-50 study guide to build a complete picture of the exam.
Done with this chapter?