Learning the secret incantations to make embedded systems carry out your will is not as hard as one might think. In the world of IoT, the hardened system is rare and most times a firmware image is more than enough to find and exploit weakness. Embedded devices are flooding corporate and home networks with limited insight into product security.

These sessions teach attendees how to evaluate IoT devices regularly deployed on enterprise networks. Learning the techniques utilized by attackers will help enterprise admins vet devices intended for deployment while also helping companies that develop these devices identify how attackers operate.

Participants will be provided with a virtual machine pre-loaded with IoT analysis tools and configured to emulate several embedded devices. Students will learn how to analyze and exploit these devices through a series of hands-on lab exercises designed to demonstrate some of the key concepts involved in IoT hacking. Upon completion of each lab, students will be given the opportunity to test their exploits against live devices.

These techniques have been successfully employed by the author to identify over 100 CVEs on embedded/IoT devices as well as to win the 0-day and CTF tracks in the DEF CON 22 SOHOpelessly Broken router hacking competition.

For the first time ever, we’re offering this advanced IoT Hacking – Brainwashing Embedded Systems course. If you’ve not completed the IoT Hacking course at SecTor 2016 or 2017, or not experienced in embedded exploit dev or proficient in shell, we recommend you take our 2018 IoT hacking introductory course.

Attendees will find their day divided into three sections covering everything needed to become an IoT Security Expert.

SECTION ONE: DRIVE-BY DEVICE EXPLOITS

Whether you notice it or not, many connected devices expose embedded HTTP servers to the local network. Obviously, an adversary on the local network can directly attack this server, but users often overlook the fact that many HTTP exposed vulnerabilities can be exploited remotely. In this section, attendees will build a web page which uses the victim’s browser to seek out and exploit a targeted device on the victim’s network. Finally, we will explore the impact of DNS rebinding on IoT security.

SECTION TWO: MAKING BETTER PAYLOADS

Real-world adversaries are not satisfied by simply getting a shell. Attacks of scale require automation and generally this is best achieved by loading new tools onto a target. In this section, attendees will learn how to build software suitable for running on various embedded Linux.

SECTION THREE: EMULATING DEVICES

Device emulation enables researchers to study the security of a device without actually having it. Unfortunately, the variety in hardware and firmware designs means that there is no ‘one size fits all’ approach to firmware emulation but with a little knowledge of the tools involved and sometimes a lot of patience, it is often possible to virtualize device components or even complete firmware images. This final lab of the day guides attendees through some examples of this process.