CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
In an IoT environment, a researcher finds that the firmware of a smart lock can be extracted via UART and reversed to reveal hardcoded encryption keys. Which type of vulnerability is this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hardcoded backdoor credentials
Hardcoded keys in firmware are a classic example of a backdoor or hardcoded credential vulnerability, allowing attackers to decrypt traffic or authenticate without proper authorization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Insecure firmware update mechanism
Why it's wrong here
An insecure firmware update mechanism refers to vulnerabilities in the process of delivering and installing firmware, such as lack of signature verification or unencrypted transmission. However, the discovery of a hardcoded key within existing firmware is a static vulnerability, inherent to the software itself, rather than a flaw in the dynamic update procedure. The question describes finding a key, not observing a faulty update process.
- ✗
Insufficient entropy in random number generation
Why it's wrong here
Insufficient entropy in random number generation primarily impacts the strength and unpredictability of dynamically generated cryptographic keys or session tokens. Since the problem describes a key that is already hardcoded and embedded directly into the firmware, its value is fixed and not subject to real-time generation. Therefore, the randomness quality of a system's entropy source is irrelevant to the security of a pre-existing, static key.
- ✗
Use of deprecated cryptographic algorithm
Why it's wrong here
The use of a deprecated cryptographic algorithm implies that the mathematical method itself is no longer considered secure against modern cryptanalysis, regardless of key strength. However, the core issue here is the exposure of a key, which compromises security even if it's used with a robust and current algorithm. The question does not provide any information suggesting the algorithm in use is weak or outdated, focusing solely on the key's discoverability.
- ✓
Hardcoded backdoor credentials
Why this is correct
A hardcoded encryption key embedded directly into device firmware functions as a universal master key, effectively creating an intentional or unintentional backdoor. Its discovery allows any attacker to decrypt communications, authenticate as a legitimate device, or gain unauthorized control, bypassing standard security protocols. This vulnerability provides persistent, privileged access, much like a set of secret credentials known only to the firmware developer, but now exposed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.