Hardwear.io Netherlands 2018 Archive Links
Security Consultant at IOActive
Tiny Embedded Systems Firmware Reverse Engineering and Exploitation
This short workshop accomodates most important topics from the same-titled training. It is focused on reversing firmwares and exploiting vulnerabilities in microcontrollers (MCUs). Everbody heard abour ARM and MIPS, however even now, there are a lot of places in embedded systems where you could find oldfashioned" chips, e.f. from AVR or MSP. Temperature control in Solid State Drives, velocity control in hard disks, motor control in bikes, fieldbus communications in Industrial Control Systems, even compressor control in your new (or old) fridge -- they are totally everywhere. And you should not underestimate the importance of them from security point of view -- sometimes, firmware vulnerabilities in them are even dangerous than in main CPU itself, because exactly them doing real job and interacting physical world. Most of these devices have very small RAM size (sometimes just hundreds of bytes) and/or using Harvard architecture, which makes exploit writing very difficult. During this workshop, attendees will acquire some basic (and a couple of advanced) skills on how to reverse-engineer, fuzz and exploit firmwares for these tiny MCUs.
Workshop is highly practical and includes several demos and hands-on excercises. If you want to do them, make sure that you have VMWare of VirtualBox and 15Gb free disk space.
Alexander is a Security Consultant for IO Active. He holds a Ph.D. in computer security and his research interests lie in distributed systems, mobile, hardware and industrial protocols security. He has presented at conferences including Black Hat USA / EU / UK / Asia, ZeroNights, t2.fi, CONFIdence, and S4.
