< NULLCON 2024 - BANGALORE />

About The Training

Training Registration Schedule Sponsors Venue
GO BACK
Hemant Sonkar
Lead Security Consultant Payatu
Ranit Pradhan
Pugal Selvan
Rupesh Surve
Sold Out

< Training Title />

Practical IoT Hacking

< Training Schedule />

Start Date: Nov 07, 2024

End Date: Nov 09, 2024

< Training Objectives />

The great power of the Internet of Things comes with the great responsibility of security. Being the hottest technology, the developments and innovations are happening at a stellar speed, but the security of IoT is yet to catch up. Since the safety and security repercussions are serious and at times life-threatening, there is no way you can afford to neglect the security of IoT products. "Practical Internet of Things (IoT) Hacking" is a unique course that offers security professionals, a comprehensive understanding of the complete IoT Technology suite including, Radio IoT protocols, firmware, hardware, and their underlying weaknesses. The extensive hands-on labs enable attendees to identify, exploit, or fix vulnerabilities in IoT, not just on emulators but also on real smart devices. The course focuses on the attack surface on current and evolving IoT technologies in various domains such as home, enterprise Automation, etc. It covers the ground-up on various IoT protocols including internals, specific attack scenarios for individual protocols, and open-source software/hardware tools one needs to have in their IoT penetration testing arsenal. It also covers hardware attack vectors and approaches to identify respective vulnerabilities. Throughout the course, we will use Raspberry Pi which was created by us specifically for IoT penetration testing. We will also distribute DIVA – IoT, a vulnerable IoT sensor made in-house for hands-on exercises. The "Practical Internet of Things (IoT) Hacking " course is aimed at security professionals who want to enhance their skills and move to/specialize in IoT security. Godspeed!

< Training Level />

Basic - Intermediate

< Training Outlines />

Hardware

  • Introduction to IoT - IoT Architecture and IoT Attack Surfaces
  • IoT Hardware Overview - Introduction to Hardware, Components, Memory and Packages, Hardware Tools needed for Hardware pen-testing arsenal
  • Identifying the Attack Surfaces - Hardware Recon and Analyzing the PCB board, Reading Datasheets
  • Hardware Debug Ports - Introduction and Importance
  • Attacking UART - Introduction, UART pin/pad Identification Hands-on, Accessing UART Lab, Brute-forcing custom UART console Lab
  • Attacking JTAG Debug port - Introduction to JTAG, Identifying the JATG port hands-on Lab, Firmware Extraction from the Microcontroller Hands-on Lab, Run-time patching the firmware Hands-on Lab
  • Attacking I2C Protocol - Introduction to I2C Protocol, Interfacing with I2C-based flash chips, Data extraction from the I2C Flash chips Hands-on Lab, Patching data on the I2C flash chips Hands-on Lab, Sniffing the I2C communication Hands-on Lab
  • Attacking SPI Protocol - Introduction to SPI protocol, Interfacing with SPI protocol Lab, Firmware/Data extraction from the SPI flash chips Hands-on Lab, Patching data on the SPI flash chips Hands-on Lab, Sniffing the SPI communication Hands-on Lab

ARM

  • Overview & Architecture
  • Processor Mode
  • Register
  • Instruction Set
  • Data Processing Instructions
  • Data Movement Instructions
  • Control Flow instructions
  • Stack Operations
  • System call convention

Firmware
Introduction

  • Basic Introduction

Types of firmware

  • Bare-Metal Firmware Introduction

Static Analysis

  • Reverse Engineering using Ghidra
  • Instruction Set Identification

Dynamic Analysis

  • On-Chip Debugging (JTAG)

OS-Based Firmware

  • Introduction
  • Static Analysis
  • Firmware Extraction/Modification
  • Credential Search

Dynamic Analysis

  • User space binary emulation

Radio IoT Protocols:
BLE

  • Introduction and Protocol Overview
  • Reconnaissance (Active and Passive) with HCI tools
  • Enumeration of BLE Services and Characteristics
  • Sniffing BLE communication
  • Reversing GATT protocol communication
  • Read and write on the GATT protocol
  • Fuzzing Characteristic values
  • Walkthrough of recent BLE 5.x attacks

< WHAT TO BRING? />

  • Laptop with at least 50 GB of free space (Windows or Linux)
  • 8+ GB minimum RAM (4+GB for the VM)
  • External USB access (min. 2 USB ports)
  • Administrative privileges on the system
  • Remote access and control software- Latest VNC Viewer
  • Virtualization software – Latest VirtualBox (6.X) (including VirtualBox extension pack)
  • Virtualization (Vx-t) option enabled in the BIOS settings for VirtualBox to work

< Training PREREQUISITE />

  • Basic Knowledge of Hardware
  • Knowledge of Linux OS

< WHO SHOULD ATTEND? />

  • Penetration testers tasked with auditing IoT Hardware or Analyzing Firmware
  • Bug hunters who want to find new bugs in IoT products
  • Government officials from defensive or offensive units
  • Red team members tasked with compromising the IoT devices
  • Embedded security enthusiasts
  • IoT Developers and testers
  • Anyone interested in IoT security

< WHAT TO EXPECT? />

  • Hands-on Labs
  • Reverse Engineering
  • Getting familiar with the IoT security
  • This course will give you a direction to start performing pen tests on IoT product

< WHAT ATTENDEES WILL GET? />

  • Commercial IoT Devices for hands-on (only during the class)
  • DIVA - IoT: custom vulnerable IoT sensor tested for hands-on (only during the class)
  • Hardware tools for sensor analysis for hands-on (only during the class)
  • Training material/slides
  • Practical IoT Hacking Lab Manual PDF

< WHAT NOT TO EXPECT? />

Becoming a hardware/IoT hacker overnight. Use the knowledge gained in the training to start pen-testing IoT devices and sharpen your skills.

< About the Trainer />

Hemant Sonkar presently serves as the Lead Security Consultant at Payatu, demonstrating proficiency in delivering training sessions at prominent events such as NULLCON, NULL, and various internal training programs. With an impressive three-year tenure in the field, he brings extensive expertise to the domain. His professional portfolio includes the examination of a wide range of IoT devices, spanning medical devices, home automation tools, and electric vehicles. Throughout his hardware security research endeavors, he has cultivated invaluable skills in discerning attack surfaces and vulnerabilities within real-world IoT devices.

Ranit Pradhan is currently working as an Associate IoT Security Researcher at Payatu. Having experience working with wireless security assessments, he specializes in breaking the security of BLE, and Wi-Fi-enabled IoT devices. Currently researching complex wireless security protocols.

Pugal Selvan began his journey in binary exploitation and reverse engineering through CTFs and is now a Security Researcher at Payatu, where he specializes in firmware analysis and reversing of many IoT and embedded devices. Recently, his curiosity has led him to explore hardware attacks, an area he is passionate about. By day, Pugal serves as a dedicated Security Consultant, and by night, he delves into the world of hardware hacking, continually expanding his knowledge and skills in the field.

Rupesh Surve is a highly skilled Hardware Security Researcher with 8 years of Hands-on experience in the field of Embedded Electronics. A strong passion for embedded circuit designing, multilayer PCB designing, and hardware reverse engineering. Aiming to contribute to the field of Cyber Security through focused dedication and perseverance.