Note: See the latest details and register for Applied Physical Attacks #1: Embedded and IoT Systems in an online, self-paced format at learn.securinghardware.com.

Overview

This course introduces and explores attacks on several different relatively accessible interfaces on embedded systems. Attendees will get hands-on experience implementing and deploying a number of low-cost hardware devices to enable access, privilege, and deception which is in some cases imperceptible from software.

The course has several modules. Each begins with an architectural overview of an interface, and follows with a series of labs for hands-on practice understanding, observing, interacting with, and exploiting the interface, finishing with either potentially exploitable crashes or directly to root shells.

Depending on allotted time, topic interest, and class pace, not all topics will be covered completely, but all materials are included for reference and individual practice.

Targets

This course primarily targets a MIPS-based network router which is representative of a wide range of embedded devices that span consumer electronics, medical devices, industrial control hardware, and mobile devices.

Length

In-person: 2 days, 16 CPEs. Custom offerings may include advanced topics and run longer

Online: 2 days, 16 CPEs for the standard set of labs, not including optional background and deeper exploration topic.

Audience

This course is geared toward pen testers, developers and others with a security background who wish to learn how to take advantage of physical access to systems to assist and enable other attacks. No hardware or electrical background is required. Computer architecture knowledge and low-level programming experience helpful but not required.

Format

All course material is now available on learn.securinghardware.com/. This course is available in self-paced online as well as in-person formats

Equipment

With the availability of self-paced online training, we have switched to assembling per-attendee toolkits.

Outline

This outline is representative of a 2-day in-person offering of the course. The online content covers 4 full days, and labs are broken into smaller units. All attendees of live courses, even 2-day classes, will have access to the additional online content.

  1. UART
    • Background: UART History, Architecture, and Uses
    • UART Lab 1: Connecting to a known UART
    • UART Lab 2: Identifying and analyzing an unknown UART
    • UART Lab 3: Escalating and persisting UART privilege
  2. JTAG
    • Background: JTAG History and Purpose
    • JTAG Lab 1: Hardware and Software Setup
    • JTAG Lab 2: Escalating Privilege via Kernel
    • JTAG Lab 3: Escalating Privilege via a Process
  3. SPI
    • Background: Flash storage and the SPI interface
    • SPI Lab 1: Accessing Flash from software
    • SPI Lab 2: Sniffing and Parsing SPI
    • SPI Lab 3: Dumping SPI from Hardware
    • SPI Lab 4: Firmware Analysis
  4. Firmware
    • Background: More types of Flash, Storage, and Firmware
    • Firmware Lab 1: Dumping Firmware from Software
    • Firmware Lab 2: Manipulating firmware images
    • Firmware Lab 3: Finding software bugs in firmware

Advanced

Applied Physical Attacks 2: Hardware Pentesting continues where this course leaves off, covering more advanced hardware hacks, as well as how to incorporate them into a formal pentesting process