REVERSE ENGINEERING & HACKING HARDWARE TRAINING

OVERVIEW:

Underlying hardware is often the forgotten weak point of systems, which are otherwise considered secure. This makes the hardware a valuable target for attackers and this is why it is important to be aware of potential related issues and vulnerabilities. Whether you are on blue team or red team side, you can benefit from this class and develop your skills to understand your target, analyze and interface with its communication channels, manipulate the electronics, identify and to exploit issues.

In this three-day comprehensive class, we will cover the tools, reverse engineering and hacking techniques commonly used in the hardware hacking process. The training contains lectures, however the main focus will be on the practical hands-on exercises. During the lab exercises, you will work on a custom hardware hacking training badge (which you can keep after the class) and other COTS devices.

The course contains a final hardware hacking challenge, where trainees have to apply what they have learned, to find weaknesses in the targeted system and to circumvent the applied security implementation. No electrical background or hardware hacking experience is required. The main aim of the training and the tailored agenda is to provide valuable hardware hacking knowledge to trainees, even in a limited timeframe.

Topics covered, but not limited to:

Reconnaissance

• Product teardown and component identification
• Data sheets
• Schematics
• PCB reverse engineering

Signal measuring / analysis, tools and techniques

• Multimeter
• Logic analyzer
• Oscilloscope

Soldering and desoldering

Generic communication interfaces and buses (analysis, manipulation, attack)

• UART
• I2C
• SPI

Identifying and using debug interfaces (debugging, coding, firmware extraction)

• JTAG
• SWD

Interfacing and manipulating external memory chips (extraction, manipulation, attack)

• Flash
• EEPROM
• eMMC

Basic side channel and fault injection attacks

• Power glitching
• Timing attacks

Typical issues and pitfalls in HW security

Using combination of SW/HW tools to attack hardware

Hardware hacking challenges for different topics

WHO SHOULD TAKE THIS COURSE

• Penetration testers who want to open to hardware hacking
• Security professionals who want to build hardware hacking skills
• Red team members with embedded/IoT/other electronic components in focus
• Bug hunters who want to find vulnerabilities in IoT or embedded systems
• Embedded / IoT developers
• Embedded / IoT security enthusiasts
• Anyone interested in hardware hacking

STUDENT REQUIREMENTS

• No electrical background or hardware hacking experience is required.
• Generic knowledge on digital electronics, MCUs, prototyping platforms (e.g. Arduino) are helpful, but not necessary.
• Expect to make simple code (with every help and guidance) in C, Python or other script languages.

WHAT STUDENTS SHOULD BRING

Students must bring their own laptop with administrative access and containing fully functional USB, Ethernet and WiFi interfaces. The laptop must be prepared to run VMWare virtual machine (min. 30GB HDD, 4GB RAM).

WHAT STUDENTS WILL BE PROVIDED WITH

• Training slides
• Custom hardware hacking training badge (one for each participant to keep)
• Linux virtual machine, prepared for the hands-on exercises
• Every necessary tool and equipment (e.g. multimeter, logic analyzer, soldering iron, interfaces, electronic components, breadboard, cables) during the course, for the hands-on exercises