ZIEN
Park Han-ryeol, Senior Researcher at ZIEN / Source: IT Dong-A
From the smartphones we use daily to household appliances, we live in an era of the Internet of Things (IoT), where countless devices are connected to networks. Various IoT devices, such as smart home devices, wearables, automotive devices, and industrial equipment, make our lives more convenient. However, behind this convenience lies a security vulnerability. Hackers target weaknesses in connected devices to steal personal data or disrupt systems.
To protect systems from malicious attacks, security professionals are known as ‘white hackers.’ At ZIEN, an XIoT Security Convergence Company, white hackers are dedicated to identifying security vulnerabilities in IoT devices. ZIEN is a leading provider of IoT security solutions, offering integrated security automation technology and consulting services. ZIEN's flagship solution, 'Z-IoT,' automatically analyzes IoT firmware to identify security vulnerabilities with precision. In addition, ZIEN is preparing to launch ‘Z-RED,’ an automated cybersecurity inspection platform, in response to the European Union's Radio Equipment Directive (RED) regulations, which will become mandatory in August 2025.
ZIEN’s white hackers not only discover vulnerabilities but also ensure that security design is validated throughout the device’s lifecycle. IT Dong-A spoke with Senior Researcher Park Han-ryeol of ZIEN to explore the importance of IoT security and the critical role of white hackers.
Why is IoT security so important and challenging?
IoT security is fundamentally different from traditional network or web security approaches. It involves a complex system where hardware (devices), software (firmware), networks, and cloud servers all interact, creating security risks at each layer. Since hackers can physically access devices to exploit firmware vulnerabilities, a comprehensive, proactive security approach that addresses all layers is essential.
Moreover, IoT devices often have limited memory and computational power, making traditional security solutions difficult to implement. This is especially true when advanced encryption algorithms or authentication methods are required, which calls for lightweight security protocols and firmware design.
Security Experts Offering Firmware Analysis and Consulting for IoT Devices
Park Han-ryeol, Senior Researcher at ZIEN, first encountered IoT security at ZIEN. He explained, “After the 2017 hacking incident involving smart home controllers, I became fascinated by how a firmware vulnerability could lead to incidents by linking with other infrastructures. Simulating actual attacks and developing interconnected attack scenarios was particularly intriguing to me.”
Park Han-ryeol, Senior Researcher at ZIEN / Source: IT Dong-A
Currently, Park supports the integration of security throughout the entire process, from product planning and design to launch and maintenance, within ZIEN’s R&D department. He analyzes IoT device firmware, identifies vulnerabilities, designs threat scenarios based on hypothetical attacks, and proactively assesses the protocols and authentication methods used in products. He is also responsible for enhancing ZIEN's security solutions, such as ‘Z-IoT’ and ‘Z-RED.’ Park commented, “Rather than just detecting vulnerabilities, our focus is on developing technology that automatically analyzes structural weaknesses and identifies and responds to abnormal behaviors.”
ZIEN provides security consulting by analyzing vulnerabilities in products requested by companies. Sometimes, they even purchase products themselves to identify vulnerabilities and report them to organizations like the Korea Internet & Security Agency (KISA). The range of products covered includes smart home devices like smart controllers, door locks, robotic vacuum cleaners, and smartwatches, as well as infotainment systems (IVI) and control systems in autonomous vehicles, and industrial OT (ICS OT) equipment. All devices connected via Wi-Fi, Bluetooth, and other communication networks are included.
IoT device manufacturers can utilize ZIEN’s solutions to test their products during initial production as well as throughout firmware updates to routinely check for vulnerabilities. Park added, “While some manufacturers aim for the highest security rating, many products still have significant security weaknesses due to the lack of enforcement, especially among foreign products with insufficient domestic regulation.”
What are the most important skills for a white hacker?
ZIEN's XIoT Firmware Vulnerability Inspection Solution 'Z-IoT' / Source: ZIEN
What does ZIEN consider the most crucial skill for a white hacker? Park emphasized the importance of ‘the ability to design reproducible attack scenarios.’ This skill involves understanding how vulnerabilities could be exploited in real-world environments. Since IoT devices can create a chain of vulnerabilities when hacked, it is vital not only to discover the vulnerabilities but also to understand the full attack path that links them.
For example, hacking an IP camera to gain administrative access is not the end of the attack. If the attacker infiltrates the home router and expands the attack range, it becomes a real threat. Therefore, reproducible scenarios with interconnected layers are essential. Park stated, “These scenarios can vary widely. By using them, we can confirm external connections and take security measures from the early stages of firmware design.”
Based on his experience in IoT security at ZIEN, Park won first place in the ‘Cybersecurity Challenge (Smart Home) 2022’ and received the IITP President’s Award at the ‘Cybersecurity Challenge (Smart City) 2023.’ He has also presented black-box security threat analysis results at the world’s largest hacking conference, ‘DEF CON 32 IoT Village’ in Las Vegas, and demonstrated remote code execution (RCE) at the ‘Pwn2Own Automotive 2025’ hacking contest.
IoT Manufacturers: The Importance of Initial Product Design
Park Han-ryeol, Senior Researcher at ZIEN / Source: IT Dong-A
Park emphasized the importance of the initial design phase for IoT device manufacturers. He said, “If security design is weak when the server automatically retrieves a device's firmware, attackers can easily extract the firmware. Therefore, security coding must be incorporated during the product planning phase. Although this may be difficult to implement and could extend development time, it will result in significant cost savings in the long term.”
He continued, “Since full firmware replacement is often necessary during security updates, the initial design must include an OTA (Over-the-Air) update system and integrity verification functions (to ensure system reliability).” He also suggested that companies establish a vulnerability disclosure program (VDP) to receive vulnerability reports from external security experts and address them accordingly.
Park added, “Even certified products can still have vulnerabilities when new features are added. Continuous security monitoring and penetration testing are essential to ensure the safety of products throughout development and operation.”
Supporting the Latest RED Regulation: “Becoming a Global Security Standard Tool”
This year, Park has been focused on enhancing ZIEN’s Z-RED analysis engine to comply with RED regulations. Starting in August 2025, manufacturers of wireless devices such as smartwatches and smartphones sold in Europe will need to meet cybersecurity requirements under the RED guidelines. Z-RED is a solution designed to help companies evaluate RED compliance, using AI to assess compliance and automatically review technical documents, such as writing templates.
Additionally, ZIEN plans to keep up with regulatory updates and provide history management, regardless of whether the regulation is passed. Park said, “By collaborating with global certification bodies, we can significantly reduce the time and costs associated with certification.” ZIEN will also provide a self-diagnosis website in advance.
Looking ahead, ZIEN plans to expand its presence from the domestic market to international markets, including the U.S. and Europe. Park expressed his ambition for ZIEN to play a leading role in IoT security. “The IoT security industry is still small, and we face challenges such as a lack of resources. I hope more security experts take an interest and become involved in this field,” he said.
Finally, he stated, “We will continue to refine ZIEN’s security analysis framework, focusing on the development of automation technologies. Our goal is to secure proactive threat detection and response capabilities, offer security consulting, and provide professional training to enhance the overall IoT security landscape across industries. We hope ZIEN’s solutions, such as Z-IoT and Z-RED, will become the global standard tools for IoT security compliance.”
Source: Dong-A Ilbo