  Attackers may attempt exploiting Internet of Things (IoT) devices to operate
them unduly as well as to gather personal data of the legitimate device
owners'. Vulnerability Assessment and Penetration Testing (VAPT) sessions help
to verify the effectiveness of the adopted security measures. However, VAPT
over IoT devices, namely VAPT targeted at IoT devices, is an open research
challenge due to the variety of target technologies and to the creativity it
may require. Therefore, this article aims at guiding penetration testers to
conduct VAPT sessions over IoT devices by means of a new cyber Kill Chain (KC)
termed PETIoT. Several practical applications of PETIoT confirm that it is
general, while its main novelty lies in the combination of attack and defence
steps. PETIoT is demonstrated on a relevant example, the best-selling IP camera
on Amazon Italy, the TAPO C200 by TP-Link, assuming an attacker who sits on the
same network as the device's in order to assess all the network interfaces of
the device. Additional knowledge is generated in terms of three zero-day
vulnerabilities found and practically exploited on the camera, one of these
with High severity and the other two with Medium severity by the CVSS standard.
These are camera Denial of Service (DoS), motion detection breach and video
stream breach. The application of PETIoT culminates with the proof-of-concept
of a home-made fix, based on an inexpensive Raspberry Pi 4 Model B device, for
the last vulnerability. Ultimately, our responsible disclosure with the camera
vendor led to the release of a firmware update that fixes all found
vulnerabilities, confirming that PetIoT has valid impact in real-world
scenarios.
