Open-Source Intelligence (OSINT)

Open-Source Intelligence (OSINT) is the collection and analysis of data gathered from publicly available sources in order to build knowledge about a target. In the context of embedded device security assessments, OSINT represents a natural starting point since manufacturers routinely publish product specifications, user manuals, firmware updates, and regulatory filings, all of which can provide valuable insight into a device’s architecture and potential attack surface before any physical interaction takes place.

Beyond manufacturer-published material, publicly disclosed vulnerabilities and prior research on the same or similar devices can help identify the most valuable areas of focus. An attacker who invests time in OSINT arrives at the hardware phase with a significantly clearer picture of what to look for.

In this assessment, publicly available sources were consulted using search engines including Google and Yandex, alongside specialised repositories, in order to gather as much relevant information about the target as possible prior to hands-on analysis.

Manufacturer’s website

On the TP-Link website it is possible to find the following information:

No firmware was found available for download for any version of the target, although the GPL code for the previous version of the device was found.

Federal Communications Commission (FCC)

Products that employ radio communications, such as Bluetooth or Wi-Fi, must comply with national regulations in order to be authorized for use in a given country. In the case of the United States, this authorization is determined by the Federal Communications Commission (FCC).

Searching the FCC database for the specific target or similar ones is a common way to obtain knowledge of the system. However, in order to do so, the FCC ID of the device must first be obtained. In this case, the FCC ID was not found to be present on the target’s box or label, therefore it was searched for online and found to be 2BCGWC210V2.

This FCC ID was subsequently searched for in the FCC database having returned relevant results for the target in question (see here). The most interesting of which included internal and external photos of the device, exemplified in the figures below.

With this information, an attacker can gain knowledge regarding the target’s internal components as well as external communication interfaces without requiring direct physical access to a device.

National Vulnerability Database (NVD)

Vulnerabilities concerning the device were also searched for in the National Vulnerability Database website.

Three CVEs were found to be directly associated with the device (see here) and concern the ability for an attacker to cause denial of service (DoS), execute code and bypass authentication mechanisms on the device. This has been added as finding INFO-01.

YouTube

The IoT Village YouTube channel was found to contain a three part video specific to this device, as listed below:

  • Part 1: IoT Network Analysis

  • Part 3: Static Analysis of IoT Binaries

As the titles suggest, the contents of the videos involve the analysis of network traffic with Wireshark, identifying the UART port and gaining a root shell, and reverse engineering firmware binaries with Ghidra, respectively.

This site uses Just the Docs, a documentation theme for Jekyll.