Don't ship your shell command history

When analyzing embedded and IoT devices, check for the presence of a shell command history. The results are sometimes surprising. Likewise, if you're preparing for a pentest engagement with a device vendor and can get your hands on their product, the command history can provide useful insights into the client's network and security practices.

I recently came across a good example of this after performing a chip-off flash dump of a popular wireless access product. The product shipped with a firmware image containing the bash_history used in its initial provisioning. This leaked some interesting artefacts such as:

- Internal vendor IP addresses

- Weak internal vendor FTP credentials

- Internal CA private key (KEK) used for certificates

Vendors - always delete the shell history in your firmware before you ship!

#hacking #reverseengineering #computersecurity