Book Image

Practical Hardware Pentesting, Second edition - Second Edition

By : Jean-Georges Valle
Book Image

Practical Hardware Pentesting, Second edition - Second Edition

By: Jean-Georges Valle

Overview of this book

Practical Hardware Pentesting, Second Edition, is an example-driven guide that will help you plan attacks, hack your embedded devices, and secure the hardware infrastructure. Throughout the book, you’ll explore the functional and security aspects of a device and learn how a system senses and communicates with the outside world. You’ll set up a lab from scratch and gradually work towards an advanced hardware lab. The first part of this book will get you attacking the software of an embedded device. This will get you thinking from an attacker point of view; you’ll understand how devices are attacked, compromised, and how you can harden a device against the most common hardware attack vectors. As you progress, you’ll get to grips with the global architecture of an embedded system and sniff on-board traffic, learn how to identify and formalize threats to the embedded system, and understand its relationship with its ecosystem. This 2nd Edition covers real-world examples featuring various devices like smart TVs, baby monitors, or pacemakers, you’ll discover how to analyze hardware and locate its possible vulnerabilities before going on to explore firmware dumping, analysis, and exploitation. By the end of this book, you’ll and understand how to implement best practices to secure your hardware.
Table of Contents (5 chapters)

Sample labs

In this section, we will be looking at different states of a home laboratory (from beginner to pro) that you could take inspiration from. When a piece of equipment is not described at a given level, it means that the piece is kept from the level before. Some pieces of equipment are not necessary before a given level of maturity (for example, the pro level doesn't have a new hot air station because it is kept from the amateur level).

Beginner

At this stage, the goal is to kickstart the activity as cheaply as possible, acquire knowledge, and check that you like it without burning too much money. Have a look at the following table:

MCU

platform

A Chinese Arduino copy-start with Arduino and move later to a raw C context with avr-gcc and avrdude
Breadboard Cheap Chinese from a bidding site
Oscilloscope Any cheap secondhand 50 MHz bandwidth from a bidding site
Logic analyzer A cheap bidding site Cypress FX2 repurposed board with homemade clamping diode input protection
Bus pirate The one and only
Soldering station Cheap bidding site temperature-controlled iron-the TS100 is very popular but you need an external supply
Function generator A cheap Direct Digital Synthesis (DDS) device from eBay
Power supply Repurposed phone chargers or Advanced Technology eXtended ( ATX ) power supply breakout (this is a small board that you can plug a computer power supply to)
DMM El cheapo 10$ multimeter (do not work on mains voltage with this)

Price: <500€.

Amateur

At this point, you like the activity but you are starting to be limited by your equipment. You have circumvented some limitation by doing hacks, you have rolled out your own code to drive peripherals for common protocols on your current MCU and bit-banged some, but your platform is starting to become slow, your scope is not fast enough or lacking digital trigger, and more. Here are some pieces of equipment you can buy to solve these problems:

MCU

platform

A fast STM32F4 (such as the Discovery), in pure C with arm-gee and link
Breadboard A wide 3M with multiple rows
Oscilloscope A low-level oscilloscope with at least 100 MHz of bandwidth, potentially a hackable one for better bandwidth or decoding of digital protocols
Logic analyzer An open bench logic analyzer
Soldering station and hot air gun A Chinese brand (Bekka, Yihua, OneHungLow, and so on...) combo iron and hot air gun will cover your bases for quite a long time; just pay attention to the temperature control on the iron and to the availability of replacement tips.
Power supply A dual variable output with a fixed SV power supply. It is really easy to find one on a bidding site for a quite reasonable budget.
DMM A reasonably priced DMM from a reputable brand (in the 100€ range) will do the job nicely.
Good helping hands

The Chinese "octopus" style help hands are easy to find on bidding sites. They will allow you to hold probes easily, even if you have

a four-channel oscilloscope. They have an articulation system that looks like the feet of a gorillapod.

JTAG

programmer

Any development boards based on an FTDI FT2232H will do the job nicely (it is compatible with OpenOCD). It won't give you crazy fast speed, but this is not something you really need at this point.

Price: <2,000€

Pro

At this point you are doing it regularly, so you will pretty much know what you will need. Have a look at the following table:

Oscilloscope A good oscilloscope with a 350-500 MHz bandwidth from a major vendor {Rohde & Schwarz, Keysight, Tektronix, LeCroy, and so on) will be a serious investment. At this point, you will know what you need but will still need to research a lot since these instruments cost quite a bit of money.
Power supply Choose a nice, programmable power supply from a mid-tier vendor with at least two variable outputs, such as the Rigol DP832.
Function generator An entry-level function generator such as one from the Rigol DG900 series will cover your needs.
Logic analyzer Saleae Logic Pro 16 is a very good logic analyzer with very practical software.
DMM A mid-range DMM from Fluke {the DMM117, for example) will be good enough for what you will have to do. If you need something with more performance, have a look at bench multimeters.

JTAG

programmer

A SEGGER J-Link will give you very nice speeds.

FPGA

platform

Arty A7,57, or Z7, depending on your needs of having an onboard ARM CPU

Price: ~8,000€