Hunting Zero-Days in Embedded Devices - From electrical pins to root shells
Pedro Ribeiro & Radek Domanski
Dates
22nd-25th of May 2023Capacity
20Price
4.000€Course Description
Hunting Zero-Days in Embedded Devices is a unique, hands-on training course that teaches students how to find and exploit vulnerabilities in embedded devices such as routers, cameras, industrial devices, televisions, microcontrollers, automotive, etc.
As a student, you will be taught the essential tips and tricks on how to debug an embedded device and extract firmware, and you will also be taught some exploitation techniques for ARM and MIPS. But the main aim of this course is to provide students with the necessary knowledge to find a zero day vulnerability in a device and exploit it.
The course will go in depth into several classes of vulnerabilities, with practical exercises on real and emulated devices of different CPU architectures. Each vulnerability class will be described, studied and then exploited in a variety of different ways.
Students will be given unique and publicly unknown tips from the trainers, which have a proven and public track record of finding and exploiting hundreds of zero days in embedded devices and other commercial products, as well as winning several prizes in Pwn2Own competitions.
Have you ever wondered how real hackers are finding and exploiting vulnerabilities in embedded devices? Would you like to include those methodologies into your own product security testing? Are you an enthusiast that loves taking things apart, understanding and breaking them? Or are you a security specialist in another area that wants to dip your toes into embedded device hacking?
If you answered yes to any of the above, this is the right course for you.
There are many hardware hacking and exploit development courses in the market. But none of them provide a full top down view of how to find, understand and exploit vulnerabilities in embedded devices.
This course aims to bridge the gap between hardware hacking and exploitation, giving students the necessary knowledge they need to become product security experts, embedded device reverse engineers and / or vulnerability researchers.
Our mottos are “NO FAKE VULNS” and “PoC || GTFO”!
Course Outline
Day 1: Hardware Hacking and Firmware Extraction
On the first day of the course, students will be introduced to embedded devices, which are omnipresent these days, and how to access and understand the hardware that they run on. Students will have an opportunity to experiment with different techniques for hardware analysis, firmware extraction and control.
- Course Introduction
- Embedded Device Landscape
- Intro to Hardware Hacking, Hardware / Software Tools and Storage Media
- Identifying and Making Use of Debug Interfaces (UART, JTAG, etc)
- Analysing Analog and Digital Signals
- Firmware Extraction Techniques (Internal Flash, NOR, NAND, eMMC)
Day 2: Firmware Analysis and Emulation
The second day of the course focuses on understanding how embedded devices work with regards to their firmware. Common and advanced techniques for analysing firmware will be shown, as well as approaches to identifying suitable targets for exploitation. We will present and practice ways to root a device, as well as teach you the power of emulation when a device is not present, or you wish to perform intrusive analysis which is difficult to do on-device.
- Understanding Firmware
- Bare Metal: Loading and Analysing
- RTOS: Loading and Analysing
- Embedded Device File Systems and Formats
- Emulating and Debugging Firmware
- Rooting Devices for Debug Access
Day 3: Finding and Exploiting Vulnerabilities - Part I
On the third day, we go full on into how we discover and exploit vulnerabilities. We will teach a generic approach and techniques that can be applied to any target, but focusing our efforts on common vulnerability classes in embedded devices which lead to remote code execution. The vulnerabilities will be exploited on actual physical devices, with emulation being used for certain unique devices which are very hard to acquire.
- Introduction to MIPS and ARM
- Knowing Your Target (Reconnaissance)
- Embedded Device Fuzzing
- Introduction to Vulnerability Hunting
- Buffer and Integer Over / Underflows
- Owning Parsers
Day 4: Finding and Exploiting Vulnerabilities - Part II
On the fourth and final day, we continue our journey learning techniques and methodologies to find and exploit common vulnerabilities classes on embedded devices, with unique tips from the accumulated years of real world experience that the trainers have.
- Directory Traversal
- Information Leaks and Logic Flow Bypasses
- Command Injection
- Insecure Configuration, Hardcoded Accounts and Backdoors
- Research Challenges and Ideas for the Future
What a Typical Day Looks Like
- 55% Practical hands on exercises in real and emulated hardware
- 40% Theory
- 5% Live demonstrations of advanced techniques
Requirements
Please bring a laptop with a “bare metal” Linux install. We highly recommend Ubuntu 22.04+, Debian 11+ or the latest Kali Linux, unless you are very familiar with other distros and can fulfil the requirements below and fix problems yourself. Note that Linux really needs to be installed on the computer natively (either as the only operating system or as "dual boot").
This is a hard requirement, as the hardware tools we will be using do not work properly with Linux virtual machines. We will NOT BE ABLE TO HELP YOU if you encounter any problems and don’t have a native Linux installation. You have been warned!
Further requirements will be provided by email before the start of the course.
Warning
This is an Intermediate level course. You are not required to have experience in vulnerability discovery, exploitation or hardware hacking.
However we recommend knowledge in the following topics:
- Linux command line
- Python and / or Ruby scripting
- Assembly language (x86 or any other architecture)
- Basic understanding of buffer overflows and other security vulnerability concepts
- Basic working proficiency with Ghidra (preferably) or IDA
The course will be difficult at times, but the trainers will make sure no-one is left behind.
Embrace the lifestyle of a vulnerability researcher, where one minute you are crying out of desperation and the other you are jumping around because you just owned your target!
Bio
Pedro Ribeiro is a vulnerability researcher and reverse engineer with over 16 years of commercial experience. Pedro has found and exploited hundreds of vulnerabilities in software, hardware and firmware. He has over 160 CVE ID attributed to his name (most resulting in unauthenticated remote code execution) and has authored over 60 Metasploit modules that have been released publicly.
Besides his vulnerability research activities, he is the founder and director of a penetration testing and reverse engineering consultancy based in London, with a variety of clients worldwide. More information about Pedro’s publicly disclosed vulnerabilities can be found at https://github.com/pedrib/PoC
Pedro regularly provides training courses on Secure Coding, Code Review, Penetration Testing, Vulnerability Research, Exploitation and Fuzzing to a variety of private clients, as well as free courses in Portuguese universities.
- pedrib@gmail.com
- Twitter: @pedrib1337
Pedro Ribeiro
Radek Domanski started his professional career over 15 years ago securing large networks and systems and transitioned afterwards into offensive security. He worked on high profile projects within the largest Internet Service Provider in Europe, in the research centre of one of the world's largest telecommunications equipment companies and in the vehicle development department of a premium car manufacturer.
Radek found a number of critical vulnerabilities in real products and systems that are used by millions of users worldwide. Throughout the years of working on offensive product security Radek developed a unique methodology and honed his skills of vulnerability hunting.
At the moment Radek is working as a vulnerability researcher focusing on Android and embedded devices.
- radek.domanski@gmail.com
- Twitter: @RabbitPro
Radek Domanski
Pedro and Radek regularly compete in the famous Pwn2Own hacking competitions as the Flashback Team, and have won several prizes by hacking a variety of targets, including an outright win (Master of Pwn) at Pwn2Own Tokyo 2020.
You watch videos about their exploits at https://www.youtube.com/c/FlashbackTeam
