Skip to main content

Particle.io Access Token

Particle.io Access Tokens are credentials used to authenticate and authorize access to the Particle Cloud, which is a platform for managing IoT devices. These tokens allow applications and devices to interact with Particle services, such as sending and receiving data, managing devices, and executing functions. Exposure of these tokens can lead to unauthorized access to IoT devices and data, posing significant security risks.

How Does It Look​

Access Tokens can appear in various contexts, such as:

  • Environment variables:

    export PARTICLE_ACCESS_TOKEN="pk_live_XXXXXXXXXXXXXXXXXXXXXXXX"

  • Configuration files (JSON):

    {
      "particle": {
        "accessToken": "pk_live_XXXXXXXXXXXXXXXXXXXXXXXX"
      }
    }

  • Code snippets:

    const particle = new Particle();
    particle.login({ token: 'pk_live_XXXXXXXXXXXXXXXXXXXXXXXX' });

  • Connection strings:

    particle://api.particle.io/v1/devices?access_token=pk_live_XXXXXXXXXXXXXXXXXXXXXXXX

Severity​

  • 🔴 Critical

The severity is critical because the access token provides full access to the Particle Cloud account, allowing control over all connected IoT devices. The blast radius includes potential unauthorized device management, data manipulation, and service disruption.

What Can an Attacker Do?​

With immediate access to the Particle Cloud, an attacker can control IoT devices and access sensitive data.

Key actions an attacker can perform:

  • Control Devices: Remotely control or disable IoT devices (if the token has device management permissions)
  • Access Data: Retrieve or manipulate data from devices (if data access permissions are granted)
  • Execute Functions: Trigger functions on devices (if function execution is allowed)
  • Modify Device Configurations: Change device settings or firmware (if configuration permissions are enabled)

An attacker could potentially escalate their access by exploiting other vulnerabilities within the IoT ecosystem or moving laterally to other connected systems.

Real-World Impact​

Exposure of a Particle.io Access Token poses significant business risks, including unauthorized control over IoT devices.

Potential consequences include:

  • Data Exposure: Sensitive device data could be accessed or leaked (if the token has read access to device data)
  • Financial Loss: Costs incurred from unauthorized device usage or service disruptions (if billing/resource creation is permitted)
  • Operational Disruption: IoT services could be interrupted, affecting business operations (if the attacker has control over device functions)
  • Reputational Damage: Loss of customer trust and brand reputation due to compromised device security

In a worst-case scenario, widespread device manipulation could lead to cascading operational failures and significant financial and reputational damage.

Prerequisites for Exploitation​

  • Network access requirements: Internet access to reach the Particle Cloud API
  • Additional context needed: Knowledge of device IDs or endpoints to target specific devices
  • Rate limits or restrictions: API rate limits may apply, but they can be circumvented with multiple tokens

How to Verify If It's Active​

To verify if a Particle.io Access Token is active, use the following command:

curl -X GET "https://api.particle.io/v1/devices?access_token=[TOKEN]"

Valid credential response: A list of devices associated with the account, including device IDs and statuses.

Invalid/expired credential response: An error message indicating invalid or expired token.

Detection Patterns​

Common Variable Names:

  • PARTICLE_ACCESS_TOKEN
  • PARTICLE_TOKEN
  • ACCESS_TOKEN
  • TOKEN
  • PARTICLE_API_KEY
  • API_KEY

File Locations:

  • .env
  • config.json
  • settings.yaml
  • credentials.js
  • particle-config.json

Regex Pattern:

pk_live_[a-zA-Z0-9]{24,}

Remediation Steps​

  1. Revoke immediately - Go to Particle Console > Settings > Access Tokens and delete the compromised token.
  2. Audit access logs - Review Particle Cloud logs for unauthorized device interactions during the exposure window.
  3. Assess blast radius - Identify all devices and applications that used the exposed token.
  4. Rotate credential - Generate a new access token in the Particle Console with least-privilege permissions.
  5. Update dependent systems - Deploy the new token to all applications and update CI/CD pipelines securely.
  6. Harden access controls - Enable IP allowlisting in the Particle Console and require secure connections.
  7. Implement secrets management - Migrate tokens to a secrets manager (HashiCorp Vault, AWS Secrets Manager) to prevent hardcoding.
  8. Add detection controls - Set up pre-commit hooks and repository scanning to catch token leaks before they reach production.

Credential exposures often go undetected for extended periods, increasing the window for exploitation. As a long-term strategy, plan to establish an internal process or engage an external vendor for continuous external exposure monitoring. This helps identify leaked secrets across public repositories, paste sites, dark web forums, and other external sources before attackers can leverage them. Proactive detection and rapid response are essential to minimizing the impact of credential leaks.

References​