From 6b68467cf0fc5991c9a6bbd69f51fea53c8ceb13 Mon Sep 17 00:00:00 2001 From: Peter Weidenbach Date: Wed, 18 Dec 2019 08:32:54 +0100 Subject: [PATCH 01/13] deadly sins talk added and linter errors fixed --- readme.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/readme.md b/readme.md index 88c1195..41d4c63 100644 --- a/readme.md +++ b/readme.md @@ -102,7 +102,8 @@ Software tools for analyzing embedded/IoT firmware. - 2016, Costin et al: [Automated Dynamic Firmware Analysis at Scale: A Case Study on Embedded Web Interfaces](http://s3.eurecom.fr/docs/asiaccs16_costin.pdf) - 2015, Shoshitaishvili et al:[Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities in Binary Firmware](https://seclab.cs.ucsb.edu/media/uploads/papers/firmalice.pdf) - 2015, Papp et al: [Embedded Systems Security: Threats, Vulnerabilities, and Attack Taxonomy](http://www.cse.psu.edu/~pdm12/cse597g-f15/readings/cse597g-embedded_systems.pdf) -- 2014, Zaddach et al: [Avatar: A Framework to Support Dynamic Security Analysis of Embedded Systems’ Firmwares](http://www.eurecom.fr/en/publication/4158/download/rs-publi-4158.pdf) + +- 2014, Zaddach et al: [Avatar: A Framework to Support Dynamic Security Analysis of Embedded Systems' Firmwares](http://www.eurecom.fr/en/publication/4158/download/rs-publi-4158.pdf) - 2014, Alimi et al: [Analysis of embedded applications by evolutionary fuzzing](http://ieeexplore.ieee.org/document/6903734/) - 2014, Costin et al: [A Large-Scale Analysis of the Security of Embedded Firmware s](http://www.s3.eurecom.fr/docs/usenixsec14_costin.pdf) @@ -111,9 +112,11 @@ s](http://www.s3.eurecom.fr/docs/usenixsec14_costin.pdf) ## Case Studies - [Binary Hardening in IoT products](https://cyber-itl.org/2019/08/26/iot-data-writeup.html) +- [Deadly Sins Of Development](https://youtu.be/nXyglaY9N9w) - Conference talk presenting several real world examples on real bad implementations (video). - [Hacking the DSP-W215, Again](http://www.devttys0.com/2014/05/hacking-the-dspw215-again/) - [Multiple vulnerabilities found in the D-link DWR-932B](https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html) - [Pwning the Dlink 850L routers and abusing the MyDlink Cloud protocol](https://pierrekim.github.io/blog/2017-09-08-dlink-850l-mydlink-cloud-0days-vulnerabilities.html) + - [PWN Xerox Printers (...again)](https://www.fkie.fraunhofer.de/content/dam/fkie/de/documents/xerox_phaser_6700_white_paper.pdf) From 8df5e4e75460d0ad41dd8fe39890c8376aba4711 Mon Sep 17 00:00:00 2001 From: Peter Weidenbach Date: Wed, 18 Dec 2019 08:38:34 +0100 Subject: [PATCH 02/13] (video) -> :tv: --- readme.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/readme.md b/readme.md index 41d4c63..0674de8 100644 --- a/readme.md +++ b/readme.md @@ -112,7 +112,7 @@ s](http://www.s3.eurecom.fr/docs/usenixsec14_costin.pdf) ## Case Studies - [Binary Hardening in IoT products](https://cyber-itl.org/2019/08/26/iot-data-writeup.html) -- [Deadly Sins Of Development](https://youtu.be/nXyglaY9N9w) - Conference talk presenting several real world examples on real bad implementations (video). +- [Deadly Sins Of Development](https://youtu.be/nXyglaY9N9w) - Conference talk presenting several real world examples on real bad implementations:tv:. - [Hacking the DSP-W215, Again](http://www.devttys0.com/2014/05/hacking-the-dspw215-again/) - [Multiple vulnerabilities found in the D-link DWR-932B](https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html) - [Pwning the Dlink 850L routers and abusing the MyDlink Cloud protocol](https://pierrekim.github.io/blog/2017-09-08-dlink-850l-mydlink-cloud-0days-vulnerabilities.html) From f68dc302c49a34e17e5e302613cb43c6df318ca2 Mon Sep 17 00:00:00 2001 From: Peter Weidenbach Date: Wed, 18 Dec 2019 11:37:10 +0100 Subject: [PATCH 03/13] some minur visual fixes --- readme.md | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/readme.md b/readme.md index 0674de8..be88ef1 100644 --- a/readme.md +++ b/readme.md @@ -92,7 +92,7 @@ Software tools for analyzing embedded/IoT firmware. ## Research Papers - + - 2018, Muench et al: [What You Corrupt Is Not What You Crash: Challenges in Fuzzing Embedded Devices](http://www.eurecom.fr/en/publication/5417/download/sec-publi-5417.pdf) - 2017, O'Meara et al: [Embedded Device Vulnerability Analysis Case Study Using Trommel](https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=509271) - 2017, Jacob et al: [How to Break Secure Boot on FPGA SoCs through Malicious Hardware](https://eprint.iacr.org/2017/625.pdf) @@ -102,7 +102,6 @@ Software tools for analyzing embedded/IoT firmware. - 2016, Costin et al: [Automated Dynamic Firmware Analysis at Scale: A Case Study on Embedded Web Interfaces](http://s3.eurecom.fr/docs/asiaccs16_costin.pdf) - 2015, Shoshitaishvili et al:[Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities in Binary Firmware](https://seclab.cs.ucsb.edu/media/uploads/papers/firmalice.pdf) - 2015, Papp et al: [Embedded Systems Security: Threats, Vulnerabilities, and Attack Taxonomy](http://www.cse.psu.edu/~pdm12/cse597g-f15/readings/cse597g-embedded_systems.pdf) - - 2014, Zaddach et al: [Avatar: A Framework to Support Dynamic Security Analysis of Embedded Systems' Firmwares](http://www.eurecom.fr/en/publication/4158/download/rs-publi-4158.pdf) - 2014, Alimi et al: [Analysis of embedded applications by evolutionary fuzzing](http://ieeexplore.ieee.org/document/6903734/) - 2014, Costin et al: [A Large-Scale Analysis of the Security of Embedded Firmware @@ -110,13 +109,12 @@ s](http://www.s3.eurecom.fr/docs/usenixsec14_costin.pdf) - 2013, Davidson et al: [FIE on Firmware: Finding Vulnerabilities in Embedded Systems using Symbolic Execution](https://www.usenix.org/system/files/conference/usenixsecurity13/sec13-paper_davidson.pdf) ## Case Studies - + - [Binary Hardening in IoT products](https://cyber-itl.org/2019/08/26/iot-data-writeup.html) -- [Deadly Sins Of Development](https://youtu.be/nXyglaY9N9w) - Conference talk presenting several real world examples on real bad implementations:tv:. +- [Deadly Sins Of Development](https://youtu.be/nXyglaY9N9w) - Conference talk presenting several real world examples on real bad implementations :tv:. - [Hacking the DSP-W215, Again](http://www.devttys0.com/2014/05/hacking-the-dspw215-again/) - [Multiple vulnerabilities found in the D-link DWR-932B](https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html) - [Pwning the Dlink 850L routers and abusing the MyDlink Cloud protocol](https://pierrekim.github.io/blog/2017-09-08-dlink-850l-mydlink-cloud-0days-vulnerabilities.html) - - [PWN Xerox Printers (...again)](https://www.fkie.fraunhofer.de/content/dam/fkie/de/documents/xerox_phaser_6700_white_paper.pdf) From 4fb188eb9cbf167f61c4b625867e465f41c96812 Mon Sep 17 00:00:00 2001 From: Christopher Krah Date: Wed, 18 Dec 2019 15:50:17 +0100 Subject: [PATCH 04/13] updated list of research papers --- readme.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/readme.md b/readme.md index be88ef1..0c59c8c 100644 --- a/readme.md +++ b/readme.md @@ -93,6 +93,9 @@ Software tools for analyzing embedded/IoT firmware. ## Research Papers +- 2019, Alrawi et al: [SoK: Security Evaluation of Home-Based IoT Deployments](https://alrawi.github.io/static/papers/alrawi_sok_sp19.pdf) +- 2019, Abbasi et al: [Challenges in Designing Exploit Mitigations for Deeply Embedded Systems](https://ieeexplore.ieee.org/abstract/document/8806725) +- 2019, Song et al: [PeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary](https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04A-1_Song_paper.pdf) - 2018, Muench et al: [What You Corrupt Is Not What You Crash: Challenges in Fuzzing Embedded Devices](http://www.eurecom.fr/en/publication/5417/download/sec-publi-5417.pdf) - 2017, O'Meara et al: [Embedded Device Vulnerability Analysis Case Study Using Trommel](https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=509271) - 2017, Jacob et al: [How to Break Secure Boot on FPGA SoCs through Malicious Hardware](https://eprint.iacr.org/2017/625.pdf) From 9b65822a5fa0c3e4ba3c982c0aa2b415677ef4d1 Mon Sep 17 00:00:00 2001 From: Peter Weidenbach Date: Thu, 19 Dec 2019 07:58:28 +0100 Subject: [PATCH 05/13] fact intro video added --- readme.md | 1 + 1 file changed, 1 insertion(+) diff --git a/readme.md b/readme.md index be88ef1..ac30f15 100644 --- a/readme.md +++ b/readme.md @@ -37,6 +37,7 @@ Software tools for analyzing embedded/IoT firmware. - [EXPLIoT](https://gitlab.com/expliot_framework/expliot) - Pentest framework like Metasploit but specialized for IoT. - [FACT - The Firmware Analysis and Comparison Tool](https://fkie-cad.github.io/FACT_core/) - Full-featured static analysis framework including extraction of firmware, analysis utilizing different plug-ins and comparison of different firmware versions. + - [Improving your firmware security analysis process with FACT](https://passthesalt.ubicast.tv/videos/improving-your-firmware-security-analysis-process-with-fact/) - Conference talk about FACT :tv:. - [FwAnalyzer](https://github.com/cruise-automation/fwanalyzer) - Analyze security of firmware based on customized rules. Intended as additional step in DevSecOps, similar to CI. ### Analysis Tools From 642c8e9a22a3cb5b6c8fdeb8f8fdd0fb1d3718b1 Mon Sep 17 00:00:00 2001 From: 0xricksanchez <17012133+0xricksanchez@users.noreply.github.com> Date: Wed, 12 Feb 2020 13:22:13 +0100 Subject: [PATCH 06/13] fixed dead links --- readme.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/readme.md b/readme.md index 8229d72..82b8a24 100644 --- a/readme.md +++ b/readme.md @@ -79,7 +79,7 @@ Software tools for analyzing embedded/IoT firmware. ## Books - 2020, Jasper van Woudenberg, Colin O'Flynn: [The Hardware Hacking Handbook: Breaking Embedded Security with Hardware Attacks](https://www.amazon.com/Hardware-Hacking-Handbook-Breaking-Embedded-ebook/dp/B077WZBFYL) -- 2019, Yago Hansen: [The Hacker's Hardware Toolkit: The best collection of hardware gadgets for Red Team hackers, Pentesters and security researchers](https://www.amazon.com/Hackers-Hardware-Toolkit-collection-researchers/dp/1099209463) +- 2019, Yago Hansen: [The Hacker's Hardware Toolkit: The best collection of hardware gadgets for Red Team hackers, Pentesters and security researchers](https://github.com/yadox666/The-Hackers-Hardware-Toolkit/blob/master/TheHackersHardwareToolkit.pdf) - 2019, Aditya Gupta: [The IoT Hacker's Handbook: A Practical Guide to Hacking the Internet of Things](https://www.apress.com/us/book/9781484242995) - 2018, Mark Swarup Tehranipoor: [Hardware Security: A Hands-on Learning Approach](https://www.elsevier.com/books/hardware-security/bhunia/978-0-12-812477-2) - 2017, Aditya Gupta, Aaron Guzman: [IoT Penetration Testing Cookbook](https://www.packtpub.com/networking-and-servers/iot-penetration-testing-cookbook) @@ -101,7 +101,7 @@ Software tools for analyzing embedded/IoT firmware. - 2017, O'Meara et al: [Embedded Device Vulnerability Analysis Case Study Using Trommel](https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=509271) - 2017, Jacob et al: [How to Break Secure Boot on FPGA SoCs through Malicious Hardware](https://eprint.iacr.org/2017/625.pdf) - 2017, Costin et al: [Towards Automated Classification of Firmware Images and Identification of Embedded Devices](http://s3.eurecom.fr/docs/ifip17_costin.pdf) -- 2016, Kammerstetter et al: [Embedded Security Testing with Peripheral Device Caching and Runtime Program State Approximation](http://www.seclab.tuwien.ac.at/papers/kammerstetter_secuware2016_peripheralCache.pdf) +- 2016, Kammerstetter et al: [Embedded Security Testing with Peripheral Device Caching and Runtime Program State Approximation](https://www.thinkmind.org/download.php?articleid=securware_2016_2_10_30082) - 2016, Chen et al: [Towards Automated Dynamic Analysis for Linux-based Embedded Firmware](https://www.dcddcc.com/docs/2016_paper_firmadyne.pdf) - 2016, Costin et al: [Automated Dynamic Firmware Analysis at Scale: A Case Study on Embedded Web Interfaces](http://s3.eurecom.fr/docs/asiaccs16_costin.pdf) - 2015, Shoshitaishvili et al:[Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities in Binary Firmware](https://seclab.cs.ucsb.edu/media/uploads/papers/firmalice.pdf) From ca6ca196aab3407765aced61774a4c1c229bf870 Mon Sep 17 00:00:00 2001 From: Christopher Krah Date: Wed, 12 Feb 2020 13:29:18 +0100 Subject: [PATCH 07/13] fixed another dead link --- readme.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/readme.md b/readme.md index 82b8a24..a5c2a2f 100644 --- a/readme.md +++ b/readme.md @@ -71,7 +71,7 @@ Software tools for analyzing embedded/IoT firmware. - [Saleae](https://www.saleae.com/) - Easy to use Logic Analyzer that support many protocols :euro:. - [Ikalogic](https://www.ikalogic.com/pages/logic-analyzer-sp-series-sp209) - Alternative to Saleae logic analyzers :euro:. - [HydraBus](https://hydrabus.com/hydrabus-1-0-specifications/) - Open source multi-tool hardware similar to the BusPirate but with NFC capabilities. -- [ChipWhisperer](https://newae.com/tools/chipwhisperer/) - Detects Glitch/Side-channel attacks. +- [ChipWhisperer](https://newae.com/chipwhisperer/) - Detects Glitch/Side-channel attacks. - [Glasgow](https://github.com/GlasgowEmbedded/Glasgow) - Tool for exploring and debugging different digital interfaces. - [J-Link](https://www.segger.com/products/debug-probes/j-link/models/model-overview/) - J-Link offers USB powered JTAG debug probes for multiple different CPU cores :euro:. From 8337cd72dee7143a7aa9475ac9a9d7b2c606846c Mon Sep 17 00:00:00 2001 From: 0xricksanchez Date: Tue, 31 Mar 2020 19:28:13 +0200 Subject: [PATCH 08/13] updated multiple categories --- readme.md | 42 ++++++++++++++++++++++++++++++------------ 1 file changed, 30 insertions(+), 12 deletions(-) diff --git a/readme.md b/readme.md index a5c2a2f..e891f95 100644 --- a/readme.md +++ b/readme.md @@ -31,7 +31,7 @@ They are easy to use and you do not need to be an expert to get first meaningful ## Software Tools -Software tools for analyzing embedded/IoT firmware. +Software tools for analyzing embedded/IoT devices and firmware. ### Analysis Frameworks @@ -39,12 +39,17 @@ Software tools for analyzing embedded/IoT firmware. - [FACT - The Firmware Analysis and Comparison Tool](https://fkie-cad.github.io/FACT_core/) - Full-featured static analysis framework including extraction of firmware, analysis utilizing different plug-ins and comparison of different firmware versions. - [Improving your firmware security analysis process with FACT](https://passthesalt.ubicast.tv/videos/improving-your-firmware-security-analysis-process-with-fact/) - Conference talk about FACT :tv:. - [FwAnalyzer](https://github.com/cruise-automation/fwanalyzer) - Analyze security of firmware based on customized rules. Intended as additional step in DevSecOps, similar to CI. +- [HAL – The Hardware Analyzer](https://github.com/emsec/hal) - A comprehensive reverse engineering and manipulation framework for gate-level netlists. +- [IoTSecFuzz](https://gitlab.com/invuls/iot-projects/iotsecfuzz) - Framework for automatisation of IoT layers security analysis: hardware, software and communication. +- [Killerbee](https://github.com/riverloopsec/killerbee) - Framework for Testing & Auditing ZigBee and IEEE 802.15.4 Networks. +- [PRET](https://github.com/RUB-NDS/PRET) - Printer Exploitation Toolkit. +- [Routersploit](https://github.com/threat9/routersploit) - Framework dedicated to exploit embedded devices. ### Analysis Tools - [Binwalk](https://github.com/ReFirmLabs/binwalk) - Searches a binary for "interesting" stuff. - [Firmadyne](https://github.com/firmadyne/firmadyne) - Tries to emulate and pentest a firmware. -- [firmwalker](https://github.com/craigz28/firmwalker) - Searches extracted firmware images for interesting files and information. +- [Firmwalker](https://github.com/craigz28/firmwalker) - Searches extracted firmware images for interesting files and information. - [Firmware Slap](https://github.com/ChrisTheCoolHut/Firmware_Slap) - Discovering vulnerabilities in firmware through concolic analysis and function clustering. - [Ghidra](https://ghidra-sre.org/) - Software Reverse Engineering suite; handles arbitrary binaries, if you provide CPU architecture and endianness of the binary. - [Radare2](https://github.com/radare/radare2) - Software Reverse Engineering framework, also handles popular formats and arbitrary binaries, has an extensive command line toolset. @@ -57,12 +62,13 @@ Software tools for analyzing embedded/IoT firmware. - [Firmware Mod Kit](https://github.com/rampageX/firmware-mod-kit/wiki) - Extraction tools for several container formats. - [The SRecord package](http://srecord.sourceforge.net/) - Collection of tools for manipulating EPROM files (can convert lots of binary formats). +### Exploitation Tools + ### Support Tools - [JTAGenum](https://github.com/cyphunk/JTAGenum) - Add JTAG capabilities to an Arduino. - [OpenOCD](http://openocd.org/) - Free and Open On-Chip Debugging, In-System Programming and Boundary-Scan Testing. - ## Hardware Tools - [Bus Blaster](http://dangerousprototypes.com/docs/Bus_Blaster) - Detects and interacts with hardware debug ports like [UART](https://en.wikipedia.org/wiki/Universal_asynchronous_receiver-transmitter) and [JTAG](https://en.wikipedia.org/wiki/JTAG). @@ -75,14 +81,13 @@ Software tools for analyzing embedded/IoT firmware. - [Glasgow](https://github.com/GlasgowEmbedded/Glasgow) - Tool for exploring and debugging different digital interfaces. - [J-Link](https://www.segger.com/products/debug-probes/j-link/models/model-overview/) - J-Link offers USB powered JTAG debug probes for multiple different CPU cores :euro:. - ## Books - 2020, Jasper van Woudenberg, Colin O'Flynn: [The Hardware Hacking Handbook: Breaking Embedded Security with Hardware Attacks](https://www.amazon.com/Hardware-Hacking-Handbook-Breaking-Embedded-ebook/dp/B077WZBFYL) - 2019, Yago Hansen: [The Hacker's Hardware Toolkit: The best collection of hardware gadgets for Red Team hackers, Pentesters and security researchers](https://github.com/yadox666/The-Hackers-Hardware-Toolkit/blob/master/TheHackersHardwareToolkit.pdf) - 2019, Aditya Gupta: [The IoT Hacker's Handbook: A Practical Guide to Hacking the Internet of Things](https://www.apress.com/us/book/9781484242995) - 2018, Mark Swarup Tehranipoor: [Hardware Security: A Hands-on Learning Approach](https://www.elsevier.com/books/hardware-security/bhunia/978-0-12-812477-2) -- 2017, Aditya Gupta, Aaron Guzman: [IoT Penetration Testing Cookbook](https://www.packtpub.com/networking-and-servers/iot-penetration-testing-cookbook) +- 2017, Aditya Gupta, Aaron Guzman: [IoT Penetration Testing Cookbook](https://www.packtpub.com/networking-and-servers/iot-penetration-testing-cookbook) - 2017, Andrew Huang: [The Hardware Hacker: Adventures in Making and Breaking Hardware](https://nostarch.com/hardwarehackerpaperback) - 2016, Craig Smith: [The Car Hacker's Handbook: A Guide for the Penetration Tester](https://nostarch.com/carhacking) - 2015, Nitesh Dhanjan: [Abusing the Internet of Things: Blackouts, Freakouts, and Stakeouts](https://shop.oreilly.com/product/0636920033547.do) @@ -94,6 +99,7 @@ Software tools for analyzing embedded/IoT firmware. ## Research Papers +- 2019, Almakhdhub et al: [BenchIoT: A Security Benchmark for the Internet of Things](https://nebelwelt.net/publications/files/19DSN.pdf) - 2019, Alrawi et al: [SoK: Security Evaluation of Home-Based IoT Deployments](https://alrawi.github.io/static/papers/alrawi_sok_sp19.pdf) - 2019, Abbasi et al: [Challenges in Designing Exploit Mitigations for Deeply Embedded Systems](https://ieeexplore.ieee.org/abstract/document/8806725) - 2019, Song et al: [PeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary](https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04A-1_Song_paper.pdf) @@ -115,29 +121,41 @@ s](http://www.s3.eurecom.fr/docs/usenixsec14_costin.pdf) ## Case Studies - [Binary Hardening in IoT products](https://cyber-itl.org/2019/08/26/iot-data-writeup.html) +- [Cracking Linksys “Encryption”](http://www.devttys0.com/2014/02/cracking-linksys-crypto/) - [Deadly Sins Of Development](https://youtu.be/nXyglaY9N9w) - Conference talk presenting several real world examples on real bad implementations :tv:. - [Hacking the DSP-W215, Again](http://www.devttys0.com/2014/05/hacking-the-dspw215-again/) +- [Hacking the PS4](https://cturt.github.io/ps4.html) - Introduction to PS4's security - [Multiple vulnerabilities found in the D-link DWR-932B](https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html) - [Pwning the Dlink 850L routers and abusing the MyDlink Cloud protocol](https://pierrekim.github.io/blog/2017-09-08-dlink-850l-mydlink-cloud-0days-vulnerabilities.html) - [PWN Xerox Printers (...again)](https://www.fkie.fraunhofer.de/content/dam/fkie/de/documents/xerox_phaser_6700_white_paper.pdf) - +- [Reversing Firmware With Radare](https://www.bored-nerds.com/reversing/radare/automotive/2019/07/07/reversing-firmware-with-radare.html) +- [Reversing the Huawei HG533](http://jcjc-dev.com/2016/04/08/reversing-huawei-router-1-find-uart/) ## Free Training +- [CSAW Embedded Security Challenge 2019](https://github.com/TrustworthyComputing/csaw_esc_2019) - CSAW 2019 Embedded Security Challenge (ESC). +- [Embedded Security CTF](https://microcorruption.com) - Microcorruption: Embedded Security CTF. - [Hardware Hacking 101](https://github.com/rdomanski/hardware_hacking/tree/master/my_talks/Hardware_Hacking_101) - Workshop @ BSides Munich 2019. - [IoTGoat](https://github.com/scriptingxss/IoTGoat) - IoTGoat is a deliberately insecure firmware based on OpenWrt. -- [Rhme-2017/2018](https://github.com/Riscure/Rhme-2017) - Riscure Hack Me 3 embedded hardware CTF 2017-2018. -- [Rhme-2016](https://github.com/Riscure/Rhme-2016) - Riscure Hack me 2 is a low level hardware CTF challenge. - [Rhme-2015](https://github.com/Riscure/RHme-2015) - First riscure Hack me hardware CTF challenge. -- [Embedded Security CTF](https://microcorruption.com) - Microcorruption: Embedded Security CTF. - +- [Rhme-2016](https://github.com/Riscure/Rhme-2016) - Riscure Hack me 2 is a low level hardware CTF challenge. +- [Rhme-2017/2018](https://github.com/Riscure/Rhme-2017) - Riscure Hack Me 3 embedded hardware CTF 2017-2018. ## Websites +- [Hacking Printers Wiki](http://hacking-printers.net/wiki/index.php/Main_Page) - All things printer. - [OWASP Embedded Application Security Project](https://www.owasp.org/index.php/OWASP_Embedded_Application_Security) - Development best practices and list of hardware and software tools. - [OWASP Internet of Things Project](https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project) - IoT common vulnerabilities and attack surfaces. -- [Hacking Printers Wiki](http://hacking-printers.net/wiki/index.php/Main_Page) -- [Router Passwords](https://www.routerpasswords.com) - Default login credential database sorted by manufacturer. +- [Router Passwords](https://192-168-1-1ip.mobi/default-router-passwords-list/) - Default login credential database sorted by manufacturer. +- [Siliconpr0n](https://siliconpr0n.org/) - A Wiki/Archive of all things IC reversing + +## Blogs + +- [/dev/ttyS0's Embedded Device Hacking](http://www.devttys0.com/blog/) +- [Exploiteers](https://www.exploitee.rs/) +- [Hackaday](https://hackaday.com) +- [jcjc's Hack The World](https://jcjc-dev.com/) +- [Quarkslab](https://blog.quarkslab.com/) ## Conferences Conferences focused on embedded and/or IoT security. From 51ed4d075aee84aa16d06886900c62a2feb9ff37 Mon Sep 17 00:00:00 2001 From: 0xricksanchez Date: Tue, 31 Mar 2020 19:35:14 +0200 Subject: [PATCH 09/13] linter issues, dead links --- readme.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/readme.md b/readme.md index e891f95..290a791 100644 --- a/readme.md +++ b/readme.md @@ -27,6 +27,7 @@ They are easy to use and you do not need to be an expert to get first meaningful - [Case Studies](#case-studies) - [Free Training](#free-training) - [Websites](#websites) + - [Blogs](#blogs) - [Conferences](#conferences) @@ -62,8 +63,6 @@ Software tools for analyzing embedded/IoT devices and firmware. - [Firmware Mod Kit](https://github.com/rampageX/firmware-mod-kit/wiki) - Extraction tools for several container formats. - [The SRecord package](http://srecord.sourceforge.net/) - Collection of tools for manipulating EPROM files (can convert lots of binary formats). -### Exploitation Tools - ### Support Tools - [JTAGenum](https://github.com/cyphunk/JTAGenum) - Add JTAG capabilities to an Arduino. @@ -110,7 +109,7 @@ Software tools for analyzing embedded/IoT devices and firmware. - 2016, Kammerstetter et al: [Embedded Security Testing with Peripheral Device Caching and Runtime Program State Approximation](https://www.thinkmind.org/download.php?articleid=securware_2016_2_10_30082) - 2016, Chen et al: [Towards Automated Dynamic Analysis for Linux-based Embedded Firmware](https://www.dcddcc.com/docs/2016_paper_firmadyne.pdf) - 2016, Costin et al: [Automated Dynamic Firmware Analysis at Scale: A Case Study on Embedded Web Interfaces](http://s3.eurecom.fr/docs/asiaccs16_costin.pdf) -- 2015, Shoshitaishvili et al:[Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities in Binary Firmware](https://seclab.cs.ucsb.edu/media/uploads/papers/firmalice.pdf) +- 2015, Shoshitaishvili et al:[Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities in Binary Firmware](https://www.ndss-symposium.org/wp-content/uploads/2017/09/11_1_2.pdf) - 2015, Papp et al: [Embedded Systems Security: Threats, Vulnerabilities, and Attack Taxonomy](http://www.cse.psu.edu/~pdm12/cse597g-f15/readings/cse597g-embedded_systems.pdf) - 2014, Zaddach et al: [Avatar: A Framework to Support Dynamic Security Analysis of Embedded Systems' Firmwares](http://www.eurecom.fr/en/publication/4158/download/rs-publi-4158.pdf) - 2014, Alimi et al: [Analysis of embedded applications by evolutionary fuzzing](http://ieeexplore.ieee.org/document/6903734/) @@ -124,7 +123,7 @@ s](http://www.s3.eurecom.fr/docs/usenixsec14_costin.pdf) - [Cracking Linksys “Encryption”](http://www.devttys0.com/2014/02/cracking-linksys-crypto/) - [Deadly Sins Of Development](https://youtu.be/nXyglaY9N9w) - Conference talk presenting several real world examples on real bad implementations :tv:. - [Hacking the DSP-W215, Again](http://www.devttys0.com/2014/05/hacking-the-dspw215-again/) -- [Hacking the PS4](https://cturt.github.io/ps4.html) - Introduction to PS4's security +- [Hacking the PS4](https://cturt.github.io/ps4.html) - Introduction to PS4's security. - [Multiple vulnerabilities found in the D-link DWR-932B](https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html) - [Pwning the Dlink 850L routers and abusing the MyDlink Cloud protocol](https://pierrekim.github.io/blog/2017-09-08-dlink-850l-mydlink-cloud-0days-vulnerabilities.html) - [PWN Xerox Printers (...again)](https://www.fkie.fraunhofer.de/content/dam/fkie/de/documents/xerox_phaser_6700_white_paper.pdf) @@ -147,9 +146,9 @@ s](http://www.s3.eurecom.fr/docs/usenixsec14_costin.pdf) - [OWASP Embedded Application Security Project](https://www.owasp.org/index.php/OWASP_Embedded_Application_Security) - Development best practices and list of hardware and software tools. - [OWASP Internet of Things Project](https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project) - IoT common vulnerabilities and attack surfaces. - [Router Passwords](https://192-168-1-1ip.mobi/default-router-passwords-list/) - Default login credential database sorted by manufacturer. -- [Siliconpr0n](https://siliconpr0n.org/) - A Wiki/Archive of all things IC reversing +- [Siliconpr0n](https://siliconpr0n.org/) - A Wiki/Archive of all things IC reversing. -## Blogs +### Blogs - [/dev/ttyS0's Embedded Device Hacking](http://www.devttys0.com/blog/) - [Exploiteers](https://www.exploitee.rs/) From cc32cb03729fa46b32267cc57de9d84358308ac0 Mon Sep 17 00:00:00 2001 From: 0xricksanchez Date: Tue, 31 Mar 2020 20:37:11 +0200 Subject: [PATCH 10/13] linter issues, dead links --- readme.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/readme.md b/readme.md index 290a791..880668d 100644 --- a/readme.md +++ b/readme.md @@ -168,7 +168,7 @@ Contributions welcome! Read the [contribution guidelines](contributing.md) first ## License -[![CC0](https://mirrors.creativecommons.org/presskit/buttons/88x31/svg/cc-zero.svg)](https://creativecommons.org/publicdomain/zero/1.0) +[![CC0](https://mirrors.creativecommons.org/presskit/buttons/88x31/svg/cc-zero.svg)](https://creativecommons.org/publicdomain/zero/1.0/) To the extent possible under law, Fraunhofer FKIE has waived all copyright and related or neighboring rights to this work. From e3b0365e2669ea994a5ecaa73b803b66205e894c Mon Sep 17 00:00:00 2001 From: 0xricksanchez Date: Thu, 9 Apr 2020 10:43:02 +0200 Subject: [PATCH 11/13] fixed linter issues --- readme.md | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/readme.md b/readme.md index e891f95..dcf36b4 100644 --- a/readme.md +++ b/readme.md @@ -27,6 +27,7 @@ They are easy to use and you do not need to be an expert to get first meaningful - [Case Studies](#case-studies) - [Free Training](#free-training) - [Websites](#websites) + - [Blogs](#blogs) - [Conferences](#conferences) @@ -62,8 +63,6 @@ Software tools for analyzing embedded/IoT devices and firmware. - [Firmware Mod Kit](https://github.com/rampageX/firmware-mod-kit/wiki) - Extraction tools for several container formats. - [The SRecord package](http://srecord.sourceforge.net/) - Collection of tools for manipulating EPROM files (can convert lots of binary formats). -### Exploitation Tools - ### Support Tools - [JTAGenum](https://github.com/cyphunk/JTAGenum) - Add JTAG capabilities to an Arduino. @@ -110,7 +109,7 @@ Software tools for analyzing embedded/IoT devices and firmware. - 2016, Kammerstetter et al: [Embedded Security Testing with Peripheral Device Caching and Runtime Program State Approximation](https://www.thinkmind.org/download.php?articleid=securware_2016_2_10_30082) - 2016, Chen et al: [Towards Automated Dynamic Analysis for Linux-based Embedded Firmware](https://www.dcddcc.com/docs/2016_paper_firmadyne.pdf) - 2016, Costin et al: [Automated Dynamic Firmware Analysis at Scale: A Case Study on Embedded Web Interfaces](http://s3.eurecom.fr/docs/asiaccs16_costin.pdf) -- 2015, Shoshitaishvili et al:[Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities in Binary Firmware](https://seclab.cs.ucsb.edu/media/uploads/papers/firmalice.pdf) +- 2015, Shoshitaishvili et al:[Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities in Binary Firmware](https://www.ndss-symposium.org/wp-content/uploads/2017/09/11_1_2.pdf) - 2015, Papp et al: [Embedded Systems Security: Threats, Vulnerabilities, and Attack Taxonomy](http://www.cse.psu.edu/~pdm12/cse597g-f15/readings/cse597g-embedded_systems.pdf) - 2014, Zaddach et al: [Avatar: A Framework to Support Dynamic Security Analysis of Embedded Systems' Firmwares](http://www.eurecom.fr/en/publication/4158/download/rs-publi-4158.pdf) - 2014, Alimi et al: [Analysis of embedded applications by evolutionary fuzzing](http://ieeexplore.ieee.org/document/6903734/) @@ -124,7 +123,7 @@ s](http://www.s3.eurecom.fr/docs/usenixsec14_costin.pdf) - [Cracking Linksys “Encryption”](http://www.devttys0.com/2014/02/cracking-linksys-crypto/) - [Deadly Sins Of Development](https://youtu.be/nXyglaY9N9w) - Conference talk presenting several real world examples on real bad implementations :tv:. - [Hacking the DSP-W215, Again](http://www.devttys0.com/2014/05/hacking-the-dspw215-again/) -- [Hacking the PS4](https://cturt.github.io/ps4.html) - Introduction to PS4's security +- [Hacking the PS4](https://cturt.github.io/ps4.html) - Introduction to PS4's security. - [Multiple vulnerabilities found in the D-link DWR-932B](https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html) - [Pwning the Dlink 850L routers and abusing the MyDlink Cloud protocol](https://pierrekim.github.io/blog/2017-09-08-dlink-850l-mydlink-cloud-0days-vulnerabilities.html) - [PWN Xerox Printers (...again)](https://www.fkie.fraunhofer.de/content/dam/fkie/de/documents/xerox_phaser_6700_white_paper.pdf) @@ -144,12 +143,12 @@ s](http://www.s3.eurecom.fr/docs/usenixsec14_costin.pdf) ## Websites - [Hacking Printers Wiki](http://hacking-printers.net/wiki/index.php/Main_Page) - All things printer. -- [OWASP Embedded Application Security Project](https://www.owasp.org/index.php/OWASP_Embedded_Application_Security) - Development best practices and list of hardware and software tools. -- [OWASP Internet of Things Project](https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project) - IoT common vulnerabilities and attack surfaces. +- [OWASP Embedded Application Security Project](https://owasp.org/www-project-embedded-application-security/) - Development best practices and list of hardware and software tools. +- [OWASP Internet of Things Project](https://owasp.org/www-project-internet-of-things/) - IoT common vulnerabilities and attack surfaces. - [Router Passwords](https://192-168-1-1ip.mobi/default-router-passwords-list/) - Default login credential database sorted by manufacturer. -- [Siliconpr0n](https://siliconpr0n.org/) - A Wiki/Archive of all things IC reversing +- [Siliconpr0n](https://siliconpr0n.org/) - A Wiki/Archive of all things IC reversing. -## Blogs +### Blogs - [/dev/ttyS0's Embedded Device Hacking](http://www.devttys0.com/blog/) - [Exploiteers](https://www.exploitee.rs/) @@ -169,7 +168,7 @@ Contributions welcome! Read the [contribution guidelines](contributing.md) first ## License -[![CC0](https://mirrors.creativecommons.org/presskit/buttons/88x31/svg/cc-zero.svg)](https://creativecommons.org/publicdomain/zero/1.0) +[![CC0](https://mirrors.creativecommons.org/presskit/buttons/88x31/svg/cc-zero.svg)](https://creativecommons.org/publicdomain/zero/1.0/) To the extent possible under law, Fraunhofer FKIE has waived all copyright and related or neighboring rights to this work. From 93b83a8a9069653fb8e5c27d6f45b5682517e5ee Mon Sep 17 00:00:00 2001 From: 0xricksanchez Date: Sat, 11 Apr 2020 14:06:12 +0200 Subject: [PATCH 12/13] added new content --- readme.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/readme.md b/readme.md index dcf36b4..7a1d887 100644 --- a/readme.md +++ b/readme.md @@ -122,13 +122,17 @@ s](http://www.s3.eurecom.fr/docs/usenixsec14_costin.pdf) - [Binary Hardening in IoT products](https://cyber-itl.org/2019/08/26/iot-data-writeup.html) - [Cracking Linksys “Encryption”](http://www.devttys0.com/2014/02/cracking-linksys-crypto/) - [Deadly Sins Of Development](https://youtu.be/nXyglaY9N9w) - Conference talk presenting several real world examples on real bad implementations :tv:. +- [Dumping firmware a device with a buspirate and a SPI flash chip](https://www.iotpentest.com/2019/06/dumping-firmware-from-device-using.html) - [Hacking the DSP-W215, Again](http://www.devttys0.com/2014/05/hacking-the-dspw215-again/) - [Hacking the PS4](https://cturt.github.io/ps4.html) - Introduction to PS4's security. +- [JTAG Explained](https://blog.senr.io/blog/jtag-explained#) - A walkthrough covering UART and JTAG bypassing a protected login shell. - [Multiple vulnerabilities found in the D-link DWR-932B](https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html) - [Pwning the Dlink 850L routers and abusing the MyDlink Cloud protocol](https://pierrekim.github.io/blog/2017-09-08-dlink-850l-mydlink-cloud-0days-vulnerabilities.html) - [PWN Xerox Printers (...again)](https://www.fkie.fraunhofer.de/content/dam/fkie/de/documents/xerox_phaser_6700_white_paper.pdf) +- [Reverse Engineering Serial Ports](http://www.devttys0.com/2012/11/reverse-engineering-serial-ports/) - [Reversing Firmware With Radare](https://www.bored-nerds.com/reversing/radare/automotive/2019/07/07/reversing-firmware-with-radare.html) - [Reversing the Huawei HG533](http://jcjc-dev.com/2016/04/08/reversing-huawei-router-1-find-uart/) +- [Samsung Firmware Magic](https://github.com/chrivers/samsung-firmware-magic) ## Free Training @@ -150,11 +154,14 @@ s](http://www.s3.eurecom.fr/docs/usenixsec14_costin.pdf) ### Blogs +- [Azeria Lab](https://azeria-labs.com/writing-arm-assembly-part-1/) - [/dev/ttyS0's Embedded Device Hacking](http://www.devttys0.com/blog/) - [Exploiteers](https://www.exploitee.rs/) - [Hackaday](https://hackaday.com) - [jcjc's Hack The World](https://jcjc-dev.com/) +- [Mikroe - UART explained](https://www.mikroe.com/blog/uart-serial-communication) - [Quarkslab](https://blog.quarkslab.com/) +- [wrong baud](https://wrongbaud.github.io/) ## Conferences Conferences focused on embedded and/or IoT security. From 38454d8e494e13ea1b30a840d5ed9870047b66e4 Mon Sep 17 00:00:00 2001 From: 0xricksanchez Date: Tue, 14 Apr 2020 08:44:26 +0200 Subject: [PATCH 13/13] PR --- readme.md | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/readme.md b/readme.md index 7a1d887..0aedbfa 100644 --- a/readme.md +++ b/readme.md @@ -21,13 +21,15 @@ They are easy to use and you do not need to be an expert to get first meaningful - [Analysis Tools](#analysis-tools) - [Extraction Tools](#extraction-tools) - [Support Tools](#support-tools) + - [Misc Tools](#misc-tools) - [Hardware Tools](#hardware-tools) - [Books](#books) - [Research Papers](#research-papers) - [Case Studies](#case-studies) - [Free Training](#free-training) - [Websites](#websites) - - [Blogs](#blogs) + - [Blogs](#blogs) + - [Tutorials and Technical Background](#tutorials-and-technical-background) - [Conferences](#conferences) @@ -68,6 +70,10 @@ Software tools for analyzing embedded/IoT devices and firmware. - [JTAGenum](https://github.com/cyphunk/JTAGenum) - Add JTAG capabilities to an Arduino. - [OpenOCD](http://openocd.org/) - Free and Open On-Chip Debugging, In-System Programming and Boundary-Scan Testing. +### Misc Tools + +- [Samsung Firmware Magic](https://github.com/chrivers/samsung-firmware-magic) - Decrypt Samsung SSD firmware updates. + ## Hardware Tools - [Bus Blaster](http://dangerousprototypes.com/docs/Bus_Blaster) - Detects and interacts with hardware debug ports like [UART](https://en.wikipedia.org/wiki/Universal_asynchronous_receiver-transmitter) and [JTAG](https://en.wikipedia.org/wiki/JTAG). @@ -122,17 +128,14 @@ s](http://www.s3.eurecom.fr/docs/usenixsec14_costin.pdf) - [Binary Hardening in IoT products](https://cyber-itl.org/2019/08/26/iot-data-writeup.html) - [Cracking Linksys “Encryption”](http://www.devttys0.com/2014/02/cracking-linksys-crypto/) - [Deadly Sins Of Development](https://youtu.be/nXyglaY9N9w) - Conference talk presenting several real world examples on real bad implementations :tv:. -- [Dumping firmware a device with a buspirate and a SPI flash chip](https://www.iotpentest.com/2019/06/dumping-firmware-from-device-using.html) +- [Dumping firmware from a device's SPI flash with a buspirate](https://www.iotpentest.com/2019/06/dumping-firmware-from-device-using.html) - [Hacking the DSP-W215, Again](http://www.devttys0.com/2014/05/hacking-the-dspw215-again/) - [Hacking the PS4](https://cturt.github.io/ps4.html) - Introduction to PS4's security. -- [JTAG Explained](https://blog.senr.io/blog/jtag-explained#) - A walkthrough covering UART and JTAG bypassing a protected login shell. - [Multiple vulnerabilities found in the D-link DWR-932B](https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html) - [Pwning the Dlink 850L routers and abusing the MyDlink Cloud protocol](https://pierrekim.github.io/blog/2017-09-08-dlink-850l-mydlink-cloud-0days-vulnerabilities.html) - [PWN Xerox Printers (...again)](https://www.fkie.fraunhofer.de/content/dam/fkie/de/documents/xerox_phaser_6700_white_paper.pdf) -- [Reverse Engineering Serial Ports](http://www.devttys0.com/2012/11/reverse-engineering-serial-ports/) - [Reversing Firmware With Radare](https://www.bored-nerds.com/reversing/radare/automotive/2019/07/07/reversing-firmware-with-radare.html) - [Reversing the Huawei HG533](http://jcjc-dev.com/2016/04/08/reversing-huawei-router-1-find-uart/) -- [Samsung Firmware Magic](https://github.com/chrivers/samsung-firmware-magic) ## Free Training @@ -154,15 +157,20 @@ s](http://www.s3.eurecom.fr/docs/usenixsec14_costin.pdf) ### Blogs -- [Azeria Lab](https://azeria-labs.com/writing-arm-assembly-part-1/) - [/dev/ttyS0's Embedded Device Hacking](http://www.devttys0.com/blog/) - [Exploiteers](https://www.exploitee.rs/) - [Hackaday](https://hackaday.com) - [jcjc's Hack The World](https://jcjc-dev.com/) -- [Mikroe - UART explained](https://www.mikroe.com/blog/uart-serial-communication) - [Quarkslab](https://blog.quarkslab.com/) - [wrong baud](https://wrongbaud.github.io/) +### Tutorials and Technical Background +- [Azeria Lab](https://azeria-labs.com/) - Miscellaneous ARM related Tutorials. +- [JTAG Explained](https://blog.senr.io/blog/jtag-explained#) - A walkthrough covering UART and JTAG bypassing a protected login shell. +- [Reverse Engineering Serial Ports](http://www.devttys0.com/2012/11/reverse-engineering-serial-ports/) - Detailed tutorial about how to spot debug pads on a PCB. +- [UART explained](https://www.mikroe.com/blog/uart-serial-communication) - An in depth explanation of the UART protocol. + + ## Conferences Conferences focused on embedded and/or IoT security.