< NULLCON 2025 - HYDERABAD />

About The Training

Registration Schedule Training Venue
GO BACK
Hemant Sonkar
Lead Security Consultant at Payatu
Rupesh Surve
Hardware Security Researcher at Payatu
Shubham Thorat
IoT Security Reasearcher at Payatu
Ajay SK
IoT firmware security researcher at Payatu

< Training Title />

Practical IoT Hacking

< Training Schedule />

Start Date: Jun 12, 2025

End Date: Jun 14, 2025

< Training Objectives />

The great power of the Internet of Things comes with the great responsibility of security. Being the hottest technology, the developments and innovations are happening at a stellar speed, but the security of IoT is yet to catch up. Since the safety and security repercussions are serious and at times life-threatening, there is no way you can afford to neglect the security of IoT products. "Practical Internet of Things (IoT) Hacking" is a unique course that offers security professionals, a comprehensive understanding of the complete IoT Technology suite including, Radio IoT protocols, firmware, hardware, and their underlying weaknesses. The extensive hands-on labs enable attendees to identify, exploit, or fix vulnerabilities in IoT, not just on emulators but also on real smart devices. The course focuses on the attack surface on current and evolving IoT technologies in various domains such as home, enterprise Automation, etc. It covers the ground-up on various IoT protocols including internals, specific attack scenarios for individual protocols, and open-source software/hardware tools one needs to have in their IoT penetration testing arsenal. It also covers hardware attack vectors and approaches to identify respective vulnerabilities. Throughout the course, we will use Raspberry Pi which was created by us specifically for IoT penetration testing. We will also distribute DIVA – IoT, a vulnerable IoT sensor made in-house for hands-on exercises. The "Practical Internet of Things (IoT) Hacking " course is aimed at security professionals who want to enhance their skills and move to/specialize in IoT security. Godspeed!

< Training Level />

Basic - Intermediate

< Training Outlines />

Hardware:

  • Introduction to IoT - IoT Architecture and IoT Attack Surfaces
  • IoT Hardware Overview - Introduction to Hardware, Components, Memory and Packages, Hardware Tools needed for Hardware pen-testing arsenal
  • Identifying the Attack Surfaces - Hardware Recon and Analyzing the PCB board, Reading Datasheets
  • Hardware Debug Ports - Introduction and Importance
  • Attacking UART - Introduction, UART pin/pad Identification Hands-on, Accessing UART Lab, Brute-forcing custom UART console Lab, Demo on Attacking Bootloader via UART
  • Attacking JTAG Debug port - Introduction to JTAG, Identifying the JATG port hands-on Lab, Firmware Extraction from the Microcontroller Hands-on Lab, Run-time patching the firmware Hands-on Lab
  • Attacking I2C Protocol - Introduction to I2C Protocol, Interfacing with I2C-based flash chips, Data extraction from the I2C Flash chips Hands-on Lab, Patching data on the I2C flash chips Hands-on Lab, Sniffing the I2C communication Hands-on Lab
  • Attacking SPI Protocol - Introduction to SPI protocol, Interfacing with SPI protocol Lab, Firmware/Data extraction from the SPI flash chips Hands-on Lab, Patching data on the SPI flash chips Hands-on Lab, Sniffing the SPI communication Hands-on Lab

ARM:

  • Overview & Architecture
  • Processor Mode
  • Register
  • Instruction Set
  • Data Processing Instructions
  • Data Movement Instructions
  • Control Flow instructions
  • Stack Operations
  • System call convention

Firmware:

  • Basic Introduction
  • Types of firmware
  • Bare-Metal Firmware Introduction
  • Static Analysis
  • Reverse Engineering using Ghidra
  • Instruction Set Identification
  • Dynamic Analysis
  • On-Chip Debugging (JTAG)

OS-Based Firmware:

  • Introduction
  • Static Analysis
  • Firmware Extraction/Modification
  • Credential Search
  • Dynamic Analysis
  • User space binary emulation

Radio IoT Protocols:

  • BLE
  • Introduction and Protocol Overview
  • Reconnaissance (Active and Passive) with HCI tools
  • Enumeration of BLE Services and Characteristics
  • Sniffing BLE communication
  • Reversing GATT protocol communication
  • Read and write on the GATT protocol
  • Fuzzing Characteristic values
  • Walkthrough of recent BLE 5.x attacks

< WHAT TO BRING? />

  • Laptop with at least 50 GB of free space
  • Prefer Windows or Linux system (Macs on Apple chips (m1 etc) will not work)
  • 8+ GB minimum RAM (4+GB for the VM)
  • External USB access (min. 2 USB ports)
  • Administrative privileges on the system
  • Remote access and control software- Latest VNC Viewer
  • Virtualization software – Latest VirtualBox (6.X) (including VirtualBox extension pack)
  • Virtualization (Vx-t) option enabled in the BIOS settings for VirtualBox to work

< Training PREREQUISITE />

  • Basic Knowledge of Hardware
  • Knowledge of Linux OS

< WHO SHOULD ATTEND? />

  • Penetration testers tasked with auditing IoT Hardware or Analyzing Firmware
  • Bug hunters who want to find new bugs in IoT products
  • Government officials from defensive or offensive units
  • Red team members tasked with compromising the IoT devices
  • Embedded security enthusiasts
  • IoT Developers and testers
  • Anyone interested in IoT security

< WHAT TO EXPECT? />

  • Hands-on Labs
  • Reverse Engineering
  • Getting familiar with the IoT security
  • This course will give you a direction to start performing pen tests on IoT product


 

< WHAT ATTENDEES WILL GET? />

  1. Commercial IoT Devices for hands-on (only during the class)
  2. DIVA - IoT: custom vulnerable IoT target for hands-on (only during the class)
  3. Hardware tools for sensor analysis for hands-on (only during the class)
  4. Training material/slides
  5. Practical IoT Hacking Lab Manual PDF

< WHAT NOT TO EXPECT? />

Becoming a hardware/IoT hacker overnight. Use the knowledge gained in the training to start pen-testing IoT devices and sharpen your skills.

< About the Trainer />

Hemant Sonkar presently serves as the Lead Security Consultant at Payatu, demonstrating proficiency in delivering training sessions at prominent events such as NULLCON, NULL, and various internal training programs. With an impressive three-year tenure in the field, he brings extensive expertise to the domain. His professional portfolio includes the examination of a wide range of IoT devices, spanning medical devices, home automation tools, and electric vehicles. Throughout his hardware security research endeavors, he has cultivated invaluable skills in discerning attack surfaces and vulnerabilities within real-world IoT devices.

Rupesh Surve is a highly skilled Hardware Security Researcher with 8 years of Hands-on experience in the field of Embedded Electronics. A strong passion for embedded circuit designing, multilayer PCB designing, and hardware reverse engineering. Aiming to contribute to the field of Cyber Security through focused dedication and perseverance.

Shubham Thorat working as an IoT security researcher and experienced cybersecurity professional with over two years in automotive security, specializing in component-level and vehicle-level penetration testing. Proficient in in-vehicle network (IVN) protocols such as CAN, ensuring secure communication and robust threat mitigation. Additionally skilled in penetration testing of medical and IoT devices, with expertise in identifying vulnerabilities and enhancing security measures. Strong background in wireless communication protocols, embedded system security, and advanced penetration testing methodologies to address evolving cybersecurity challenges.

Ajay SK specializes in vulnerability research in desktop applications and IoT devices. By day, he is a full-time IoT firmware security researcher with extensive experience across various IoT devices and desktop applications. By night, he is a passionate CTF player, constantly expanding his knowledge of reverse engineering techniques and tackling complex binary exploitation challenges through CTF competitions.