ICHSA 2021: IoT PUF or: How I Learned to Stop Worrying and Love Security Research by Kang Wang

### Overview In this presentation, Kang Wang of Alibaba Group shares insights on IoT device identity threats, physically unclonable functions (PUF), and broader methodologies for security researchers. Framing device unclonability through historical precedents—such as ancient Chinese tiger tallies and secret society paper tokens—Wang illustrates how modern IoT security faces severe cloning challenges across fragmented and resource-constrained environments. Beyond hardware identification and SRAM PUF challenges, Wang presents practical security research case studies covering drone frequency hopping, click farms, microphone circuit behavior, and productivity methodologies for hackers.

### Key Topics - **Unclonability and Historical Context:** Using historical artifacts such as the ancient bronze tiger tally and paper tokens from late 19th-century secret societies to illustrate challenge-response pairs, token verification, and the economics of cloning. - **IoT Identification Challenges:** Limitations of standard identification methods including IP addresses (easily masked by VPNs/proxies), MAC addresses (easily modified via command-line tools like dd in OpenWrt flash partitions), LAN scanning, browser fingerprinting, and MEMS sensor defects. - **Physically Unclonable Functions (PUF):** Utilizing startup state unpredictability in SRAM cells, where roughly 80–84% of cells are constantly biased to 0 or 1 while ~20% exhibit usable randomness. - **Economics and Supply Chain Realities in Research:** Reverse engineering commercial off-the-shelf hardware (such as DJI Phantom 2 controllers) to discover that design decisions are driven by cost and off-the-shelf chip availability rather than bespoke engineering. - **Privacy and Practical Hacking:** Examining privacy trade-offs, click farm economics, hardware mute circuits (such as capacitor discharge in the Amazon Echo), policy hacking, and hacker productivity tools.

### Technical Details - **SRAM PUF Characteristics and Deployment:** An SRAM cell operates like a 1-bit latch with a balanced architecture. On power-up, while ~84% of cells stabilize consistently across multiple boots, the remainder provide entropy. However, practical engineering deployments face common-mode noise from temperature and magnetic interference, aging degradation, and strict engineering constraints—specifically that firmware engineers resist modifying bootloader code due to the risk of bricking production batches of 10,000 to 100,000 devices. Fast search algorithms are also required to manage weak PUFs with limited challenge-response pairs. - **RF Reverse Engineering:** In an investigation of a DJI Phantom 2 drone remote controller utilizing an RFMD ML2730 radio chip, Wang captured channel sequences across the 10 kHz to 100 MHz spread using a real-time signal analyzer (after encountering bandwidth limitations with a 20 MHz HackRF). The frequency hopping pattern simplified to a basic formula: `(channel - 14) mod 36`, matching legacy designs used by Japanese radio brand Futaba. - **Sensor and Hardware Audits:** Accelerometer angles (cosine theta) can reveal automated click farms where racks of phones share the exact same physical tilt. Hardware privacy audits on the Amazon Echo mute button showed that due to the slow discharge of the microphone's RLC equivalent circuit, ADC data could still capture microphone signals for up to 60 seconds after activation.

### Takeaways Wang emphasizes that security researchers should "follow the money," recognizing that real-world engineering teams face commercial and cost constraints. Furthermore, the talk advocates for adopting diverse hacker mindsets: low-cost hardware hacking (e.g., RTL-SDR), policy hacking (such as Project Zero's strict 90-day disclosure rule to eliminate internal negotiation), and personal productivity hacks (leveraging Makefiles, Unix mailboxes, RSS-to-email pipelines, and open-source workflows) with the ultimate objective of using security skills to protect others.