awesome-embedded-and-iot-security
A curated list of awesome embedded and IoT security resources.
https://github.com/fkie-cad/awesome-embedded-and-iot-security
Last synced: 3 days ago
JSON representation
-
Websites
-
Blogs
-
RFID NFC Tools
- Hacking Printers Wiki - All things printer.
- OWASP Embedded Application Security Project - Development best practices and list of hardware and software tools.
- OWASP Internet of Things Project - IoT common vulnerabilities and attack surfaces.
- Router Passwords - Default login credential database sorted by manufacturer.
- Siliconpr0n - A Wiki/Archive of all things IC reversing.
-
Tutorials and Technical Background
- Azeria Lab - Miscellaneous ARM related Tutorials.
- JTAG Explained - A walkthrough covering UART and JTAG bypassing a protected login shell.
- UART explained - An in depth explanation of the UART protocol.
- Reverse Engineering Serial Ports - Detailed tutorial about how to spot debug pads on a PCB.
- Reverse Engineering Serial Ports - Detailed tutorial about how to spot debug pads on a PCB.
-
YouTube Channels
- Flashback Team - A duo of hackers explaining their step by step approach to finding and exploiting vulnerabilities in embedded devices.
- StackSmashing - Reverse engineering and hardware hacking of embedded devices.
-
-
Software Tools
-
Analysis Frameworks
- Improving your firmware security analysis process with FACT - Conference talk about FACT :tv:.
- EXPLIoT - Pentest framework like Metasploit but specialized for IoT.
- FACT - The Firmware Analysis and Comparison Tool - Full-featured static analysis framework including extraction of firmware, analysis utilizing different plug-ins and comparison of different firmware versions.
- FwAnalyzer - Analyze security of firmware based on customized rules. Intended as additional step in DevSecOps, similar to CI.
- HomePWN - Swiss Army Knife for Pentesting of IoT Devices.
- IoTSecFuzz - Framework for automatisation of IoT layers security analysis: hardware, software and communication.
- Killerbee - Framework for Testing & Auditing ZigBee and IEEE 802.15.4 Networks.
- PRET - Printer Exploitation Toolkit.
- Routersploit - Framework dedicated to exploit embedded devices.
- HAL – The Hardware Analyzer - A comprehensive reverse engineering and manipulation framework for gate-level netlists.
- HomePWN - Swiss Army Knife for Pentesting of IoT Devices.
-
Analysis Tools
- emba - Analyze Linux-based firmware of embedded devices.
- Firmwalker - Searches extracted firmware images for interesting files and information.
- Ghidra - Software Reverse Engineering suite; handles arbitrary binaries, if you provide CPU architecture and endianness of the binary.
- Radare2 - Software Reverse Engineering framework, also handles popular formats and arbitrary binaries, has an extensive command line toolset.
- Binwalk - Searches a binary for "interesting" stuff, as well as extracts arbitrary files.
- cwe\_checker - Finds vulnerable patterns in binary executables - ELF support for x86, ARM, and MIPS, experimental bare-metal support.
- emba - Analyze Linux-based firmware of embedded devices.
- Firmadyne - Tries to emulate and pentest a firmware.
- Firmwalker - Searches extracted firmware images for interesting files and information.
- Firmware Slap - Discovering vulnerabilities in firmware through concolic analysis and function clustering.
- Trommel - Searches extracted firmware images for interesting files and information.
- Radare2 - Software Reverse Engineering framework, also handles popular formats and arbitrary binaries, has an extensive command line toolset.
-
Extraction Tools
- Firmware Mod Kit - Extraction tools for several container formats.
- The SRecord package - Collection of tools for manipulating EPROM files (can convert lots of binary formats).
- FACT Extractor - Detects container format automatically and executes the corresponding extraction tool.
-
Support Tools
- OpenOCD - Free and Open On-Chip Debugging, In-System Programming and Boundary-Scan Testing.
-
-
Hardware Tools
-
Misc Tools
- Bus Blaster - Detects and interacts with hardware debug ports like [UART](https://en.wikipedia.org/wiki/Universal_asynchronous_receiver-transmitter) and [JTAG](https://en.wikipedia.org/wiki/JTAG).
- Bus Pirate - Detects and interacts with hardware debug ports like UART and JTAG.
- Shikra - Detects and interacts with hardware debug ports like UART and JTAG. Among other protocols.
- JTAGULATOR - Detects JTAG Pinouts fast.
- Saleae - Easy to use Logic Analyzer that support many protocols :euro:.
- Ikalogic - Alternative to Saleae logic analyzers :euro:.
- HydraBus - Open source multi-tool hardware similar to the BusPirate but with NFC capabilities.
- ChipWhisperer - Detects Glitch/Side-channel attacks.
- J-Link - J-Link offers USB powered JTAG debug probes for multiple different CPU cores :euro:.
-
Bluetooth BLE Tools
- UberTooth One - Open source 2.4 GHz wireless development platform suitable for Bluetooth experimentation.
- Bluefruit LE Sniffer - Easy to use Bluetooth Low Energy sniffer.
-
ZigBee Tools
- ApiMote - ZigBee security research hardware for learning about and evaluating the security of IEEE 802.15.4/ZigBee systems. Killerbee compatible.
- Freakduino - Low Cost Battery Operated Wireless Arduino Board that can be turned into a IEEE 802.15.4 protocol sniffer.
-
SDR Tools
- RTL-SDR - Cheapest SDR for beginners. It is a computer based radio scanner for receiving live radio signals frequencies from 500 kHz up to 1.75 GHz.
- HackRF One - Software Defined Radio peripheral capable of transmission or reception of radio signals from 1 MHz to 6 GHz (half-duplex).
- YardStick One - Half-duplex sub-1 GHz wireless transceiver.
- LimeSDR - Software Defined Radio peripheral capable of transmission or reception of radio signals from 100 KHz to 3.8 GHz (full-duplex).
- BladeRF 2.0 - Software Defined Radio peripheral capable of transmission or reception of radio signals from 47 MHz to 6 GHz (full-duplex).
- USRP B Series - Software Defined Radio peripheral capable of transmission or reception of radio signals from 70 MHz to 6 GHz (full-duplex).
-
RFID NFC Tools
- Proxmark 3 RDV4 - Powerful general purpose RFID tool. From Low Frequency (125kHz) to High Frequency (13.56MHz) tags.
- ChamaleonMini - Programmable, portable tool for NFC security analysis.
- HydraNFC - Powerful 13.56MHz RFID / NFC platform. Read / write / crack / sniff / emulate.
-
-
Books
-
RFID NFC Tools
- Practical IoT Hacking
- The Hardware Hacking Handbook: Breaking Embedded Security with Hardware Attacks
- The Hacker's Hardware Toolkit: The best collection of hardware gadgets for Red Team hackers, Pentesters and security researchers
- The IoT Hacker's Handbook: A Practical Guide to Hacking the Internet of Things
- Hardware Security: A Hands-on Learning Approach
- Inside Radio: An Attack and Defense Guide
- IoT Penetration Testing Cookbook
- The Hardware Hacker: Adventures in Making and Breaking Hardware
- The Car Hacker's Handbook: A Guide for the Penetration Tester
- The Art of PCB Reverse Engineering
- Abusing the Internet of Things: Blackouts, Freakouts, and Stakeouts
- Hacking Wireless Exposed
- Hardware Security: Design, Threats, and Safeguards
- The Firmware Handbook (Embedded Technology)
- Hacking the XBOX
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Hacking Wireless Exposed
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- IoT Penetration Testing Cookbook
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
- Inside Radio: An Attack and Defense Guide
-
-
Research Papers
-
RFID NFC Tools
- SAFER: Development and Evaluation of an IoT Device Risk Assessment Framework in a Multinational Organization
- Detecting IoT Devices and How They Put Large Heterogeneous Networks at Security Risk
- BenchIoT: A Security Benchmark for the Internet of Things
- SoK: Security Evaluation of Home-Based IoT Deployments
- Challenges in Designing Exploit Mitigations for Deeply Embedded Systems
- PeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary
- What You Corrupt Is Not What You Crash: Challenges in Fuzzing Embedded Devices
- Embedded Device Vulnerability Analysis Case Study Using Trommel
- How to Break Secure Boot on FPGA SoCs through Malicious Hardware
- Towards Automated Classification of Firmware Images and Identification of Embedded Devices
- Embedded Security Testing with Peripheral Device Caching and Runtime Program State Approximation
- Towards Automated Dynamic Analysis for Linux-based Embedded Firmware
- Automated Dynamic Firmware Analysis at Scale: A Case Study on Embedded Web Interfaces
- Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities in Binary Firmware
- Embedded Systems Security: Threats, Vulnerabilities, and Attack Taxonomy
- Avatar: A Framework to Support Dynamic Security Analysis of Embedded Systems' Firmwares
- A Large-Scale Analysis of the Security of Embedded Firmwares
- FIE on Firmware: Finding Vulnerabilities in Embedded Systems using Symbolic Execution
- Analysis of embedded applications by evolutionary fuzzing
-
-
Case Studies
-
RFID NFC Tools
- Binary Hardening in IoT products
- Deadly Sins Of Development - Conference talk presenting several real world examples on real bad implementations :tv:.
- Dumping firmware from a device's SPI flash with a buspirate
- Hacking the PS4 - Introduction to PS4's security.
- IoT Security@CERN
- Multiple vulnerabilities found in the D-link DWR-932B
- Pwning the Dlink 850L routers and abusing the MyDlink Cloud protocol
- PWN Xerox Printers (...again)
- Reversing Firmware With Radare
- Reversing the Huawei HG533
- Deadly Sins Of Development - Conference talk presenting several real world examples on real bad implementations :tv:.
- Binary Hardening in IoT products
- Cracking Linksys “Encryption”
- Hacking the DSP-W215, Again
- Cracking Linksys “Encryption”
- Hacking the DSP-W215, Again
-
-
Free Training
-
RFID NFC Tools
- Embedded Security CTF - Microcorruption: Embedded Security CTF.
- Hardware Hacking 101 - Workshop @ BSides Munich 2019.
-
-
Conferences
-
YouTube Channels
-
Categories
Sub Categories
Keywords
security
6
reverse-engineering
3
iot
3
firmware-analysis
3
firmware-tools
3
security-tools
2
static-analyzer
2
vulnerability-scanner
2
python
2
firmware
2
binary-analysis
2
embedded-linux
2
security-automation
2
hacking
2
infosec
2
creds
1
bruteforce
1
dictionary-attack
1
nfc
1
embedded
1
exploits
1
hack
1
ble
1
security-audit
1
liunx
1
filesystem-security
1
filesystem-images
1
filesystem
1
android
1
testing
1
Internet of Things
1
Exploitatio
1
netlist
1
integrated-circuits
1
hardware
1
hal
1
fpga
1
embedded-security
1
vulnerability-discovery
1
exploit
1
angr
1
vulnerability-scanners
1
sbom
1
pentesting
1
penetration-testing
1
linux
1
embedded-systems
1
artificial-intelligence
1
security-scanner
1
program-analysis
1