IoT Testing Crash Course
Tim Jensen (EapolSniper) delivers a hands-on crash course on IoT penetration testing, covering network discovery, firmware extraction, and binwalk analysis.
Summary
Foundational Skills for IoT Vulnerability Assessment
Assessing embedded IoT devices requires combining network reconnaissance, hardware teardown, firmware extraction, and binary reverse engineering.
Extracting and Analyzing Firmware with Binwalk
Tim Jensen walks through dumping SPI flash memory chips, downloading vendor firmware updates, and unpacking filesystem images with Binwalk.
Auditing Embedded Binaries and Network Daemons
Jensen demonstrates identifying vulnerable CGI scripts, hardcoded backdoor accounts, and unencrypted management daemons running on embedded Linux systems.
Practical Lab Setup and Tooling Recommendations
The presentation provides aspiring hardware hackers with a budget-friendly hardware toolkit and structured methodology for analyzing consumer smart devices.
Related talks
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
IoT Village·1 hr 3 min
Deral Heiland
Details techniques for dumping raw NAND flash chips, reconstructing wear-leveled blocks, and recovering embedded filesystems.
IoT Village·34 min
Reversing on-screen display (OSD) monitor controllers to achieve arbitrary code execution and covert pixel manipulation directly on displays.