SlideShare a Scribd company logo

Hardware hacking 101

Download as PPTX, PDF
••
Tiago Henriques, profile picture
Tiago Henriques

Hardware hacking involves analyzing and modifying electronic devices at the hardware level. It is important because secure software relies on secure underlying hardware, but hardware is often overlooked from a security perspective. Hardware hacking requires some basic electronics knowledge as well as tools like a multimeter, logic analyzer, and oscilloscope. Common hardware hacking techniques involve identifying chip components, reading datasheets, probing pins to analyze protocols, and modifying hardware configurations. The document provides an overview of hardware hacking concepts and demonstrations of hardware attacks.

Related topics:
Reverse Engineering
1 of 60
Downloaded 271 times
1
2
3
4
5
6
Most read
7
Most read
8
9
10
11
Most read
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
HARDWARE HACKING 101 An introduction to hardware hacking and why it matters...
SPEAKER • BSc Software Engineering University of Brighton • MSc by Research in Computer Security and Forensics Univ of Bedfordshire • PhD Dropout • Enjoys breaking stuff • Founder @ptcoresec • Organizer of @Bsideslisbon with @morisson • Never had electronics lessons or any type of background • You should know me by now... It’s my 6th time speaking @confraria!
TOPICS
AGENDA • Hardware Hacking • What • Why • Bill of materials • Protocols • Hardware hackz • Demos
HARDWARE HACKING - WHAT Q:What is hardware hacking, and why should I care about it ? A:Your secure software is only as secure as the hardware it is running on... Imagine implementing all your crypto correctly but then a tiny itsy bitsy of a “problem” with your RNG.
HARDWARE HACKING - WHAT
HARDWARE HACKING - WHY • Electronic equipment is virtually everywhere we look. • How safe is this hardware? Should be important to know if it is safe, since we have a ton of things running on chips and using protocols that we take for granted as “secure”.... • Hardware hacking is still a taboo, people feel that its harder to get into it – It’s high school all over again “maths is hard, physics is hard...” • Old attacks work still work on hardware... • Lot’s of security by obscurity... “black box devices”
HARDWARE HACKING – WHY WHITEHAT VERSION • We see plenty of articles, most of them say “China hacked X, Y and Z” • Do we forget that there is also something that has the word “China” everywhere? The chips that run in pretty much all the hardware we use are mass built in China. “Made in china” • What if they decided to mass backdoor these chips? Or even better what if they decided to “selectively” backdoor and affect military “grade” chips only?
HARDWARE HACKING – WHY BLACKHAT VERSION • Stealing a service – Smartmeter hacking anyone? “Via verde” can also be funny one to look at – Oh, ISP Routers, are the lulz. • Cloning – Company X builds cool Whoopadywoo Gold edition gadget and company Z hires hardware reverse engineer to understand how it works. • Authentication – fake an authentication or bruteforcing it!
HARDWARE HACKING – CONCEPTS • You do need a bit of Physics
HARDWARE HACKING – CONCEPTS • Voltage - Simply put, voltage is used to provide power. In digital circuits it can be used to transmit data in binary form ON/OFF 1/0. Also in digital circuits it is usually found in form of 3.3V and 5V. Two types of voltage exist: AC and DC • AC (alternative current) – This is what you usually find on the wall. It’s produced in higher voltage at a power station and then reduced to be used at home by your equipment using a transformer for example. • DC (Direct current) – is what you find in batteries, essentially if a battery is 6V it will stay that way until it depletes.
HARDWARE HACKING – CONCEPTS • To measure voltage you can use a multimeter or an oscilloscope (we will look at these devices further down in this presentation). A few important points to remember about voltage: • You can only check voltage when your system is powered up. • Voltage must be read between two points (test point and ground point). • Voltage follows a direction – if you see negative values on the multimeter you’re probably putting the ground/black probe on the wrong point.
HARDWARE HACKING – CONCEPTS Resistance – a measurement that indicated the amount of current opposition created by a resistor. A resistor is usually represented by the symbol and it has two leads to which a resistor is connected to a circuit. Resistance is measured in Ohms and the symbol used is Ω (Omega)
HARDWARE HACKING BILL OF MATERIALS • Soldering iron • Desoldering Tool • Solder • Multimeter • Logic Analyzer • Microscope / Magnifier • Digital Circuit Design software • Wires – long, small, different sizes • Microcontroller reprogrammer • Prototyping microcontroller • Oscilloscope • Breadboards • Random electronic components • Hardware to break!
HARDWARE HACKING BILL OF MATERIALS Soldering iron Price: range 50€ - 5000€> Multiple types: Gas, Laser, Heat...
HARDWARE HACKING BILL OF MATERIALS Desoldering gun / pump Price range: 10€ - 500€> Multiple types: Pump, Gun
HARDWARE HACKING BILL OF MATERIALS Solder Price range: 2€ - 200€> Multiple types and sizes
HARDWARE HACKING BILL OF MATERIALS Multimeter Price range: 11€ - 9000€> Multiple types: Digital and Analog
HARDWARE HACKING BILL OF MATERIALS Multimeter A multimeter is a device that can be used to measure multiple things, the most basic multimeters are able to measure the following: • Voltage • Current • Resistance The accuracy of these devices usually depends a lot on the price as well.
HARDWARE HACKING BILL OF MATERIALS
HARDWARE HACKING BILL OF MATERIALS Putting the black probe (ground) on the negative side and the red probe on the positive, and then choosing DC Voltage 2V on the multimeter shows the following result
HARDWARE HACKING BILL OF MATERIALS The same thing can be done for resistors. If we grab a random resistor: And then we connect the probes. (In this case I used a bit of cable to connect them as they wouldn’t stick for the photo , also it doesn’t matter to what end you connect each probe. Unlike voltage, resistance isn’t directional.)
HARDWARE HACKING BILL OF MATERIALS Logic Analyzer Price range: irrelevant. What you want is this: The Salae Logic Analyzer - 140 € Used to understand which protocols are running and To debug different chips/protocols.
HARDWARE HACKING BILL OF MATERIALS Microscope or Magnifier Price range: 10€ - 5000€
HARDWARE HACKING BILL OF MATERIALS Digital circuit software Price range: 0 € - 5000 € http://fritzing.org/
HARDWARE HACKING BILL OF MATERIALS Wires Price range: 5€ - 400€ Made of multiple materials, different sizes, lenght etc...
HARDWARE HACKING BILL OF MATERIALS Microcontroller reprogrammer Price range: 20€ - 500€> Different protocols, capacity, speed, functionality... In my case I have a Bus Pirate “The Bus Pirate is an open source hacker multi-tool that talks to electronic stuff. It's got a bunch of features an intrepid hacker might need to prototype their next project.” http://dangerousprototypes.com/docs/Bus_Pirate
HARDWARE HACKING BILL OF MATERIALS • Bus Pirate • Talks multiple protocols • Built in Terminal • Can be controlled using python or c • Connects via USB • Protocols: 1-wire, UART, i2c, SPI, raw-2 wire, raw-3 wire, MIDI, PC Keyboard, JTAG
HARDWARE HACKING BILL OF MATERIALS • Bus Pirate
HARDWARE HACKING BILL OF MATERIALS Microcontroller reprogrammer Price range: 20€ - 500€> Different protocols, capacity, speed, functionality... In my case I also happen to have a GoodFET 31
HARDWARE HACKING BILL OF MATERIALS Prototyping microcontroller Price range: 20€ - xxxx€> Different protocols, capacity, speed, functionality... In my case I have multiple arduinos
HARDWARE HACKING BILL OF MATERIALS Prototyping microcontroller Price range: 38€ Different protocols, capacity, speed, functionality... Another great choice are the new beagle Boards. For the price they look even better then the arduinos.
HARDWARE HACKING BILL OF MATERIALS Oscilloscope Price range: 40€ - 5000€> Different capacity, speed, functionality... In my case I currently have a DSO Nano v3, this is a cheap scope that can be bought for 40€, its really all you need when you start, currently am considering upgrade to the Rigol DS2072, which at 500€ is still a great price for a full blown scope.
HARDWARE HACKING BILL OF MATERIALS Breadboards Price range: 5€ - 50€ Different sizes.
HARDWARE HACKING BILL OF MATERIALS Random electronic components • Resistors • Batteries • Capacitors • Sensors • Diodes • Transistors
HARDWARE HACKING BILL OF MATERIALS Hardware to break! mobile Nook Tamagotchi IM-ME Routers
HARDWARE HACKING BILL OF MATERIALS Hardware to break! femtocell Printer Random Hardware
HARDWARE HACKING BILL OF MATERIALS Hardware to break! Medical devices
HARDWARE HACKING PROTOCOLS SPI - Serial Peripheral Interface – operates in full duplex, is a synchronous serial data link, the devices communicate between them in a master/slave model. For SPI you will see a minimum of 3 pins. I2C – Inter Integrated Circuit – Uses 2 bidirectional lines SDA (Serial Data Line ) and SDC (Serial Data Clock). It operates in half duplex and since it uses 2 lines you will see 2 pins on devices.
HARDWARE HACKING PROTOCOLS • JTAG - Joint Test Action Group – usually used to debug devices. There are two possible pin layouts for JTAG: • 4 pins • TDI (Test Data In) • TDO (Test Data Out) • TCK (Test Clock) • TMS (Test Mode Select) • 5 pins • TDI (Test Data In) • TDO (Test Data Out) • TCK (Test Clock) • TMS (Test Mode Select) • TRST (Test Reset) optional.
HARDWARE HACKING PROCESS • The process to start some hardware hacking should be the following: 1. Crack open the surrouding case to access PCB – Watch out for safety measures – (secure seals, protective plastics) 2. Identify pins and components get access to datasheet 3. Connect and acquire useful data 4. Reverse 5. ??? 6. Profit OUR FOCUS
HARDWARE HACKING PROCESS – PIN IDENTIFICATION • We know the different protocols, we know the number of pins, but how do we find what each pin is? 1. Use multimeter – Measure voltage on all different pins 1. If pin has 3.3 volts or less its most likely used for data 2. If pin has >5v power source! 3. 0 volts = unused pin or ground 2. Connect a scope, identify Square waves (these are digital signals) 3. Connect logic analyzer to those pins, separate clock from data pins 4. Analyze data and being reversing... Source:http://www.turbosq uid.com/FullPreview/Index.c fm/ID/428945
HARDWARE HACKING PROCESS – COMPONENT IDENTIFICATION • What if I don’t want to poke all the pins and connections? • You can try to identify the different components and access their data sheets, where u can get all the technical information you might need • Vendor and part numbers are usually printed on the components • Look for manufacturers logo • Alphanumeric codes to identify
HARDWARE HACKING PROCESS – COMPONENT IDENTIFICATION • http://www.chipdocs.com/logos/logotypes.html
HARDWARE HACKING PROCESS – DATASHEETS • Data sheets are documents that contain technical information about the component • Some are free, others are paid • http://octopart.com/ • http://www.findchips.com/ • http://datasheetlocator.com/ • http://www.eem.com/ • http://www.ihs.com/products/product-design-sourcing/component-supplier- data/caps-expert.aspx
HARDWARE HACKING PROCESS – DATASHEETS
HARDWARE HACKING HACKZ • Real man wear pink pagers!
HARDWARE HACKING HACKZ • Wiring IM-ME for custom firmware installation! 1 2 3 3 4 1 - !RST - Reset 2 – DD – Debug Data 3 – DC – Debug Clock 4 - +2,5V - Power 5 – Gnd - Ground More information: http://travisgoodspeed.blogspot.pt/2010/03/im-me-goodfet-wiring-tutorial.html
HARDWARE HACKING HACKZ • TV tuner + all mighty clock!
HARDWARE HACKING HACKZ • TV tuner + all mighty clock! Results: http://adamsblog.aperturelabs.com/2013/03/you-can-ring-my-bell-adventures-in-sub.html
HARDWARE HACKING HACKZ • Linksys WMB54G and others! Connector J9 Pin 1 – TX – Transmission Pin 2 – RX – Receiver Pin 8 – GND - Ground RAMDISK: ext2 filesystem found at block 0 RAMDISK: Loading 4096 blocks [1 disk] into ram disk... done. Freeing initrd memory: 4096k freed VFS: Mounted root (ext2 filesystem). Freeing unused kernel memory: 60k freed mount /proc file system ok! serial console detected. Disabling virtual terminals. init started: BusyBox v1.00-pre8 (2008.01.17-05:54+0000) multi-call binary BusyBox v1.00-pre8 (2008.01.17-05:54+0000) Built-in shell (ash) Enter 'help' for a list of built-in commands. # http://www.devttys0.com/2012/07/hacking-the-linksys-wmb54g/
HARDWARE HACKING HACKZ • Hardware Random Number Generator • Two types of RNG: True and Pseudo • Pseudo – Created by algorithm • Problem – if someone knows your algorithm in theory can predict your random numbers • True – generates sequences that are impossible to predict. Use random physical events as sources of randomness. Component Quantity Arduino 1 2N3904 Transistor 3 4.7k Resistor 2 10k Resistor 1 1.5M Resistor 1 0.1µf Capacitor 1 10µf Capacitor 1 Breadboard 1 12v DC Adapter 1
HARDWARE HACKING HACKZ
HARDWARE HACKING HACKZ 1. The two transistors create avalanche noise 2. Third transistor amplifies the noise 3. Noise is sent across voltage dividers to the arduino
HARDWARE HACKING HACKZ 1 0 1 0 0 1 1 0 Arduino applies Von Neumann filtering to remove possible bias Provides network service that feeds random numbers
HARDWARE HACKING DEMOS • Logic analyzer and SMC WAAG EU
HARDWARE HACKING DEMOS • 2x Arduinos bomb Man in the middle Timer Activator
HARDWARE HACKING COMPLICATIONS • Hard to access pins for probing! • Solution!
HARDWARE HACKING COMPLICATIONS • Epoxy! • Heat gun • Dremel tool and sharp wooden stick • Best solution: Fuming Nitric Acid • Warm the nitric acid to 60 degree celsium • Putt small drops on the epoxy it will come right off
HARDWARE HACKING CONCLUSION • Hardware hacking can be lots of fun even for software peeps • The initial part is simple and doesn’t have a HIGH learning curve • The more complicated parts will come naturally because you had so much fun with the beginning • Tools for hardware hacking have lowered in price where a beginners kit can easily be bough for 300-350 euros • Protocols down there still need to improve a lot on security

More Related Content

PDF
Hardware Hacking Chronicles: IoT Hacking for Offence and Defence
Fatih Ozavci
 
PDF
Secure Coding in C/C++
Dan-Claudiu Dragoș
 
PDF
durga python full.pdf
ssuser476810
 
PDF
Webinar–Sécurité Applicative et DevSecOps dans un monde Agile
Synopsys Software Integrity Group
 
PPT
Practical Malware Analysis: Ch 7: Analyzing Malicious Windows Programs
Sam Bowne
 
PDF
IoT Device Hacking and New Direction of IoT Security Evaluation Using Common ...
Seungjoo Kim
 
PPT
IoT Security – Executing an Effective Security Testing Process
EC-Council
 
PDF
Ethical Hacking Tools
Multisoft Virtual Academy
 
Hardware Hacking Chronicles: IoT Hacking for Offence and Defence
Fatih Ozavci
 
Secure Coding in C/C++
Dan-Claudiu Dragoș
 
durga python full.pdf
ssuser476810
 
Webinar–Sécurité Applicative et DevSecOps dans un monde Agile
Synopsys Software Integrity Group
 
Practical Malware Analysis: Ch 7: Analyzing Malicious Windows Programs
Sam Bowne
 
IoT Device Hacking and New Direction of IoT Security Evaluation Using Common ...
Seungjoo Kim
 
IoT Security – Executing an Effective Security Testing Process
EC-Council
 
Ethical Hacking Tools
Multisoft Virtual Academy
 

What's hot (20)

PPTX
Google Codelabsをやってみた
furusin
 
PDF
Nick Stephens-how does someone unlock your phone with nose
GeekPwn Keen
 
PDF
The-Hacker-Playbook-Practical-Guide-To-Penetration-Testing-2014.pdf
prasunkagrawal
 
PPTX
Control flow statements in java
yugandhar vadlamudi
 
PPTX
Practical Malware Analysis: Ch 2 Malware Analysis in Virtual Machines & 3: Ba...
Sam Bowne
 
PPTX
Python Integrated Development Environment
TikendraPandey
 
PDF
JAVA PPT Part-1 BY ADI.pdf
Prof. Dr. K. Adisesha
 
PPTX
Practical Malware Analysis: Ch 0: Malware Analysis Primer & 1: Basic Static T...
Sam Bowne
 
PPTX
Java tokens
shalinikarunakaran1
 
PDF
Amazon CodeWhisperer
舒安 楊
 
DOC
Manual em Portugues Pc Analyzer
Reginaldo Santos Ledes
 
PPTX
Kali Linux
Chanchal Dabriya
 
PDF
Java - OOPS and Java Basics
Victer Paul
 
PPTX
Basics of JAVA programming
Elizabeth Thomas
 
PPTX
Important features of java
AL- AMIN
 
PPTX
Exception handling in Java
Abhishek Pachisia
 
PPTX
Python for Data Science with Anaconda
Travis Oliphant
 
PDF
Java Programming | Java Tutorial For Beginners | Java Training | Edureka
Edureka!
 
PPTX
Exception Handling in Java
Ganesh kumar reddy
 
PDF
COSCUP 2023 - Make Your Own Ray Tracing GPU with FPGA
Owen Wu
 
Google Codelabsをやってみた
furusin
 
Nick Stephens-how does someone unlock your phone with nose
GeekPwn Keen
 
The-Hacker-Playbook-Practical-Guide-To-Penetration-Testing-2014.pdf
prasunkagrawal
 
Control flow statements in java
yugandhar vadlamudi
 
Practical Malware Analysis: Ch 2 Malware Analysis in Virtual Machines & 3: Ba...
Sam Bowne
 
Python Integrated Development Environment
TikendraPandey
 
JAVA PPT Part-1 BY ADI.pdf
Prof. Dr. K. Adisesha
 
Practical Malware Analysis: Ch 0: Malware Analysis Primer & 1: Basic Static T...
Sam Bowne
 
Java tokens
shalinikarunakaran1
 
Amazon CodeWhisperer
舒安 楊
 
Manual em Portugues Pc Analyzer
Reginaldo Santos Ledes
 
Kali Linux
Chanchal Dabriya
 
Java - OOPS and Java Basics
Victer Paul
 
Basics of JAVA programming
Elizabeth Thomas
 
Important features of java
AL- AMIN
 
Exception handling in Java
Abhishek Pachisia
 
Python for Data Science with Anaconda
Travis Oliphant
 
Java Programming | Java Tutorial For Beginners | Java Training | Edureka
Edureka!
 
Exception Handling in Java
Ganesh kumar reddy
 
COSCUP 2023 - Make Your Own Ray Tracing GPU with FPGA
Owen Wu
 

Viewers also liked (20)

PDF
A BEGINNER’S JOURNEY INTO THE WORLD OF HARDWARE HACKING
Silvio Cesare
 
PDF
Hardware Reverse Engineering: From Boot to Root
Yashin Mehaboobe
 
PPTX
Hacking ppt
giridhar_sadasivuni
 
PDF
fault injection in operating systems
Lukas Pirl
 
PDF
Hardware Hacking caso práctico Ingeniería Inversa Smartcards
Andres Lozano
 
PDF
amrapali builders @@ hardware hacking and robotics using the raspberry pi.pdf
amrapalibuildersreviews
 
PDF
Intro to Hardware Firmware Hacking
Andrew Freeborn
 
PPTX
Hardware Hacking in schools (ACEC2014)
Dan Bowen
 
PPT
Playful
Tinker London
 
PPTX
Hardware Hacking Primer
Yashin Mehaboobe
 
PDF
BSides DFW2016-Hack Mode Enabled
pricemcdonald
 
PDF
Hardware hacking
Tavish Naruka
 
PDF
Breaking Bad EACS Implementations
Opposing Force S.r.l.
 
PPTX
Hacker's and painters Hardware Hacking 101 - 10th Oct 2014
Takeda Pharmaceuticals
 
PDF
Coders need to learn hardware hacking NOW
Matt Biddulph
 
PDF
Arduino Forensics
Steve Watson
 
PPTX
Router forensics
Taruna Chauhan
 
PDF
JTAG Interface (Intro)
Nitesh Bhatia
 
PPTX
PyTriage: A malware analysis framework
Yashin Mehaboobe
 
PPTX
Introduction to Oscilloscopes
bill16388
 
A BEGINNER’S JOURNEY INTO THE WORLD OF HARDWARE HACKING
Silvio Cesare
 
Hardware Reverse Engineering: From Boot to Root
Yashin Mehaboobe
 
Hacking ppt
giridhar_sadasivuni
 
fault injection in operating systems
Lukas Pirl
 
Hardware Hacking caso práctico Ingeniería Inversa Smartcards
Andres Lozano
 
amrapali builders @@ hardware hacking and robotics using the raspberry pi.pdf
amrapalibuildersreviews
 
Intro to Hardware Firmware Hacking
Andrew Freeborn
 
Hardware Hacking in schools (ACEC2014)
Dan Bowen
 
Playful
Tinker London
 
Hardware Hacking Primer
Yashin Mehaboobe
 
BSides DFW2016-Hack Mode Enabled
pricemcdonald
 
Hardware hacking
Tavish Naruka
 
Breaking Bad EACS Implementations
Opposing Force S.r.l.
 
Hacker's and painters Hardware Hacking 101 - 10th Oct 2014
Takeda Pharmaceuticals
 
Coders need to learn hardware hacking NOW
Matt Biddulph
 
Arduino Forensics
Steve Watson
 
Router forensics
Taruna Chauhan
 
JTAG Interface (Intro)
Nitesh Bhatia
 
PyTriage: A malware analysis framework
Yashin Mehaboobe
 
Introduction to Oscilloscopes
bill16388
 

Similar to Hardware hacking 101 (20)

PPT
Autonomous robotics based on simple sensor inputs.
sathish sak
 
PDF
Hardware-Hacking-101 By Asutosh Kumar.pdf
null - The Open Security Community
 
PPT
ROBOTICS - Introduction to Robotics Microcontroller
Vibrant Technologies & Computers
 
PPTX
Introduction to Arduino Webinar
Fragiskos Fourlas
 
PPTX
arduino and its introduction deep dive ppt.pptx
SruSru1
 
PDF
Insecure Obsolete and Trivial - The Real IOT
Price McDonald
 
PPTX
B1_25Jan21.pptx
DhirajPatel58
 
PDF
SCADA deep inside: protocols and security mechanisms
Aleksandr Timorin
 
PDF
CONFidence 2014: Alexander Timorin: SCADA deep inside: protocols and security...
PROIDEA
 
PPTX
Basic arduino components and more things about arduino
GeorgeTsak
 
PPTX
Introduction to the Arduino
Wingston
 
PPT
Networking Chapter 15
mlrbrown
 
PDF
Kathryn McElroy: Building IoT Prototypes with Arduino
Jordan Bresler
 
PPTX
Embedded systems basics 8051 - project approach
hybrald industries
 
PDF
Bsides Puerto Rico-2017
Price McDonald
 
PDF
BSides Indy 2017 - Hardware Hacking - Abusing the Things
Price McDonald
 
PPTX
Making and breaking security in embedded devices
Yashin Mehaboobe
 
PDF
arduinoworkshop-160204051621.pdf
AbdErrezakChahoub
 
PPTX
Ardui no
Amol Sakhalkar
 
PPT
Digital electronics
callr
 
Autonomous robotics based on simple sensor inputs.
sathish sak
 
Hardware-Hacking-101 By Asutosh Kumar.pdf
null - The Open Security Community
 
ROBOTICS - Introduction to Robotics Microcontroller
Vibrant Technologies & Computers
 
Introduction to Arduino Webinar
Fragiskos Fourlas
 
arduino and its introduction deep dive ppt.pptx
SruSru1
 
Insecure Obsolete and Trivial - The Real IOT
Price McDonald
 
B1_25Jan21.pptx
DhirajPatel58
 
SCADA deep inside: protocols and security mechanisms
Aleksandr Timorin
 
CONFidence 2014: Alexander Timorin: SCADA deep inside: protocols and security...
PROIDEA
 
Basic arduino components and more things about arduino
GeorgeTsak
 
Introduction to the Arduino
Wingston
 
Networking Chapter 15
mlrbrown
 
Kathryn McElroy: Building IoT Prototypes with Arduino
Jordan Bresler
 
Embedded systems basics 8051 - project approach
hybrald industries
 
Bsides Puerto Rico-2017
Price McDonald
 
BSides Indy 2017 - Hardware Hacking - Abusing the Things
Price McDonald
 
Making and breaking security in embedded devices
Yashin Mehaboobe
 
arduinoworkshop-160204051621.pdf
AbdErrezakChahoub
 
Ardui no
Amol Sakhalkar
 
Digital electronics
callr
 

More from Tiago Henriques (20)

PDF
BSides Lisbon 2023 - AI in Cybersecurity.pdf
Tiago Henriques
 
PDF
Pixels Camp 2017 - Stories from the trenches of building a data architecture
Tiago Henriques
 
PDF
Pixels Camp 2017 - Stranger Things the internet version
Tiago Henriques
 
PDF
The state of cybersecurity in Switzerland - FinTechDay 2017
Tiago Henriques
 
PDF
Webzurich - The State of Web Security in Switzerland
Tiago Henriques
 
PDF
BSides Lisbon - Data science, machine learning and cybersecurity
Tiago Henriques
 
PDF
I FOR ONE WELCOME OUR NEW CYBER OVERLORDS! AN INTRODUCTION TO THE USE OF MACH...
Tiago Henriques
 
PDF
BinaryEdge - Security Data Metrics and Measurements at Scale - BSidesLisbon 2015
Tiago Henriques
 
PDF
Codebits 2014 - Secure Coding - Gamification and automation for the win
Tiago Henriques
 
PPTX
Presentation Brucon - Anubisnetworks and PTCoresec
Tiago Henriques
 
PPTX
Workshop
Tiago Henriques
 
PPTX
Enei
Tiago Henriques
 
PPTX
Confraria 28-feb-2013 mesa redonda
Tiago Henriques
 
PPTX
Preso fcul
Tiago Henriques
 
PPTX
How to dominate a country
Tiago Henriques
 
PPTX
Country domination - Causing chaos and wrecking havoc
Tiago Henriques
 
PDF
(Mis)trusting and (ab)using ssh
Tiago Henriques
 
PPTX
Secure coding - Balgan - Tiago Henriques
Tiago Henriques
 
PPTX
Vulnerability, exploit to metasploit
Tiago Henriques
 
PPTX
Practical exploitation and social engineering
Tiago Henriques
 
BSides Lisbon 2023 - AI in Cybersecurity.pdf
Tiago Henriques
 
Pixels Camp 2017 - Stories from the trenches of building a data architecture
Tiago Henriques
 
Pixels Camp 2017 - Stranger Things the internet version
Tiago Henriques
 
The state of cybersecurity in Switzerland - FinTechDay 2017
Tiago Henriques
 
Webzurich - The State of Web Security in Switzerland
Tiago Henriques
 
BSides Lisbon - Data science, machine learning and cybersecurity
Tiago Henriques
 
I FOR ONE WELCOME OUR NEW CYBER OVERLORDS! AN INTRODUCTION TO THE USE OF MACH...
Tiago Henriques
 
BinaryEdge - Security Data Metrics and Measurements at Scale - BSidesLisbon 2015
Tiago Henriques
 
Codebits 2014 - Secure Coding - Gamification and automation for the win
Tiago Henriques
 
Presentation Brucon - Anubisnetworks and PTCoresec
Tiago Henriques
 
Workshop
Tiago Henriques
 
Enei
Tiago Henriques
 
Confraria 28-feb-2013 mesa redonda
Tiago Henriques
 
Preso fcul
Tiago Henriques
 
How to dominate a country
Tiago Henriques
 
Country domination - Causing chaos and wrecking havoc
Tiago Henriques
 
(Mis)trusting and (ab)using ssh
Tiago Henriques
 
Secure coding - Balgan - Tiago Henriques
Tiago Henriques
 
Vulnerability, exploit to metasploit
Tiago Henriques
 
Practical exploitation and social engineering
Tiago Henriques
 

Hardware hacking 101

  • 1. HARDWARE HACKING 101 An introduction to hardware hacking and why it matters...
  • 2. SPEAKER • BSc Software Engineering University of Brighton • MSc by Research in Computer Security and Forensics Univ of Bedfordshire • PhD Dropout • Enjoys breaking stuff • Founder @ptcoresec • Organizer of @Bsideslisbon with @morisson • Never had electronics lessons or any type of background • You should know me by now... It’s my 6th time speaking @confraria!
  • 4. AGENDA • Hardware Hacking • What • Why • Bill of materials • Protocols • Hardware hackz • Demos
  • 5. HARDWARE HACKING - WHAT Q:What is hardware hacking, and why should I care about it ? A:Your secure software is only as secure as the hardware it is running on... Imagine implementing all your crypto correctly but then a tiny itsy bitsy of a “problem” with your RNG.
  • 7. HARDWARE HACKING - WHY • Electronic equipment is virtually everywhere we look. • How safe is this hardware? Should be important to know if it is safe, since we have a ton of things running on chips and using protocols that we take for granted as “secure”.... • Hardware hacking is still a taboo, people feel that its harder to get into it – It’s high school all over again “maths is hard, physics is hard...” • Old attacks work still work on hardware... • Lot’s of security by obscurity... “black box devices”
  • 8. HARDWARE HACKING – WHY WHITEHAT VERSION • We see plenty of articles, most of them say “China hacked X, Y and Z” • Do we forget that there is also something that has the word “China” everywhere? The chips that run in pretty much all the hardware we use are mass built in China. “Made in china” • What if they decided to mass backdoor these chips? Or even better what if they decided to “selectively” backdoor and affect military “grade” chips only?
  • 9. HARDWARE HACKING – WHY BLACKHAT VERSION • Stealing a service – Smartmeter hacking anyone? “Via verde” can also be funny one to look at – Oh, ISP Routers, are the lulz. • Cloning – Company X builds cool Whoopadywoo Gold edition gadget and company Z hires hardware reverse engineer to understand how it works. • Authentication – fake an authentication or bruteforcing it!
  • 10. HARDWARE HACKING – CONCEPTS • You do need a bit of Physics
  • 11. HARDWARE HACKING – CONCEPTS • Voltage - Simply put, voltage is used to provide power. In digital circuits it can be used to transmit data in binary form ON/OFF 1/0. Also in digital circuits it is usually found in form of 3.3V and 5V. Two types of voltage exist: AC and DC • AC (alternative current) – This is what you usually find on the wall. It’s produced in higher voltage at a power station and then reduced to be used at home by your equipment using a transformer for example. • DC (Direct current) – is what you find in batteries, essentially if a battery is 6V it will stay that way until it depletes.
  • 12. HARDWARE HACKING – CONCEPTS • To measure voltage you can use a multimeter or an oscilloscope (we will look at these devices further down in this presentation). A few important points to remember about voltage: • You can only check voltage when your system is powered up. • Voltage must be read between two points (test point and ground point). • Voltage follows a direction – if you see negative values on the multimeter you’re probably putting the ground/black probe on the wrong point.
  • 13. HARDWARE HACKING – CONCEPTS Resistance – a measurement that indicated the amount of current opposition created by a resistor. A resistor is usually represented by the symbol and it has two leads to which a resistor is connected to a circuit. Resistance is measured in Ohms and the symbol used is Ω (Omega)
  • 14. HARDWARE HACKING BILL OF MATERIALS • Soldering iron • Desoldering Tool • Solder • Multimeter • Logic Analyzer • Microscope / Magnifier • Digital Circuit Design software • Wires – long, small, different sizes • Microcontroller reprogrammer • Prototyping microcontroller • Oscilloscope • Breadboards • Random electronic components • Hardware to break!
  • 15. HARDWARE HACKING BILL OF MATERIALS Soldering iron Price: range 50€ - 5000€> Multiple types: Gas, Laser, Heat...
  • 16. HARDWARE HACKING BILL OF MATERIALS Desoldering gun / pump Price range: 10€ - 500€> Multiple types: Pump, Gun
  • 17. HARDWARE HACKING BILL OF MATERIALS Solder Price range: 2€ - 200€> Multiple types and sizes
  • 18. HARDWARE HACKING BILL OF MATERIALS Multimeter Price range: 11€ - 9000€> Multiple types: Digital and Analog
  • 19. HARDWARE HACKING BILL OF MATERIALS Multimeter A multimeter is a device that can be used to measure multiple things, the most basic multimeters are able to measure the following: • Voltage • Current • Resistance The accuracy of these devices usually depends a lot on the price as well.
  • 21. HARDWARE HACKING BILL OF MATERIALS Putting the black probe (ground) on the negative side and the red probe on the positive, and then choosing DC Voltage 2V on the multimeter shows the following result
  • 22. HARDWARE HACKING BILL OF MATERIALS The same thing can be done for resistors. If we grab a random resistor: And then we connect the probes. (In this case I used a bit of cable to connect them as they wouldn’t stick for the photo , also it doesn’t matter to what end you connect each probe. Unlike voltage, resistance isn’t directional.)
  • 23. HARDWARE HACKING BILL OF MATERIALS Logic Analyzer Price range: irrelevant. What you want is this: The Salae Logic Analyzer - 140 € Used to understand which protocols are running and To debug different chips/protocols.
  • 24. HARDWARE HACKING BILL OF MATERIALS Microscope or Magnifier Price range: 10€ - 5000€
  • 25. HARDWARE HACKING BILL OF MATERIALS Digital circuit software Price range: 0 € - 5000 € http://fritzing.org/
  • 26. HARDWARE HACKING BILL OF MATERIALS Wires Price range: 5€ - 400€ Made of multiple materials, different sizes, lenght etc...
  • 27. HARDWARE HACKING BILL OF MATERIALS Microcontroller reprogrammer Price range: 20€ - 500€> Different protocols, capacity, speed, functionality... In my case I have a Bus Pirate “The Bus Pirate is an open source hacker multi-tool that talks to electronic stuff. It's got a bunch of features an intrepid hacker might need to prototype their next project.” http://dangerousprototypes.com/docs/Bus_Pirate
  • 28. HARDWARE HACKING BILL OF MATERIALS • Bus Pirate • Talks multiple protocols • Built in Terminal • Can be controlled using python or c • Connects via USB • Protocols: 1-wire, UART, i2c, SPI, raw-2 wire, raw-3 wire, MIDI, PC Keyboard, JTAG
  • 29. HARDWARE HACKING BILL OF MATERIALS • Bus Pirate
  • 30. HARDWARE HACKING BILL OF MATERIALS Microcontroller reprogrammer Price range: 20€ - 500€> Different protocols, capacity, speed, functionality... In my case I also happen to have a GoodFET 31
  • 31. HARDWARE HACKING BILL OF MATERIALS Prototyping microcontroller Price range: 20€ - xxxx€> Different protocols, capacity, speed, functionality... In my case I have multiple arduinos
  • 32. HARDWARE HACKING BILL OF MATERIALS Prototyping microcontroller Price range: 38€ Different protocols, capacity, speed, functionality... Another great choice are the new beagle Boards. For the price they look even better then the arduinos.
  • 33. HARDWARE HACKING BILL OF MATERIALS Oscilloscope Price range: 40€ - 5000€> Different capacity, speed, functionality... In my case I currently have a DSO Nano v3, this is a cheap scope that can be bought for 40€, its really all you need when you start, currently am considering upgrade to the Rigol DS2072, which at 500€ is still a great price for a full blown scope.
  • 34. HARDWARE HACKING BILL OF MATERIALS Breadboards Price range: 5€ - 50€ Different sizes.
  • 35. HARDWARE HACKING BILL OF MATERIALS Random electronic components • Resistors • Batteries • Capacitors • Sensors • Diodes • Transistors
  • 36. HARDWARE HACKING BILL OF MATERIALS Hardware to break! mobile Nook Tamagotchi IM-ME Routers
  • 37. HARDWARE HACKING BILL OF MATERIALS Hardware to break! femtocell Printer Random Hardware
  • 38. HARDWARE HACKING BILL OF MATERIALS Hardware to break! Medical devices
  • 39. HARDWARE HACKING PROTOCOLS SPI - Serial Peripheral Interface – operates in full duplex, is a synchronous serial data link, the devices communicate between them in a master/slave model. For SPI you will see a minimum of 3 pins. I2C – Inter Integrated Circuit – Uses 2 bidirectional lines SDA (Serial Data Line ) and SDC (Serial Data Clock). It operates in half duplex and since it uses 2 lines you will see 2 pins on devices.
  • 40. HARDWARE HACKING PROTOCOLS • JTAG - Joint Test Action Group – usually used to debug devices. There are two possible pin layouts for JTAG: • 4 pins • TDI (Test Data In) • TDO (Test Data Out) • TCK (Test Clock) • TMS (Test Mode Select) • 5 pins • TDI (Test Data In) • TDO (Test Data Out) • TCK (Test Clock) • TMS (Test Mode Select) • TRST (Test Reset) optional.
  • 41. HARDWARE HACKING PROCESS • The process to start some hardware hacking should be the following: 1. Crack open the surrouding case to access PCB – Watch out for safety measures – (secure seals, protective plastics) 2. Identify pins and components get access to datasheet 3. Connect and acquire useful data 4. Reverse 5. ??? 6. Profit OUR FOCUS
  • 42. HARDWARE HACKING PROCESS – PIN IDENTIFICATION • We know the different protocols, we know the number of pins, but how do we find what each pin is? 1. Use multimeter – Measure voltage on all different pins 1. If pin has 3.3 volts or less its most likely used for data 2. If pin has >5v power source! 3. 0 volts = unused pin or ground 2. Connect a scope, identify Square waves (these are digital signals) 3. Connect logic analyzer to those pins, separate clock from data pins 4. Analyze data and being reversing... Source:http://www.turbosq uid.com/FullPreview/Index.c fm/ID/428945
  • 43. HARDWARE HACKING PROCESS – COMPONENT IDENTIFICATION • What if I don’t want to poke all the pins and connections? • You can try to identify the different components and access their data sheets, where u can get all the technical information you might need • Vendor and part numbers are usually printed on the components • Look for manufacturers logo • Alphanumeric codes to identify
  • 44. HARDWARE HACKING PROCESS – COMPONENT IDENTIFICATION • http://www.chipdocs.com/logos/logotypes.html
  • 45. HARDWARE HACKING PROCESS – DATASHEETS • Data sheets are documents that contain technical information about the component • Some are free, others are paid • http://octopart.com/ • http://www.findchips.com/ • http://datasheetlocator.com/ • http://www.eem.com/ • http://www.ihs.com/products/product-design-sourcing/component-supplier- data/caps-expert.aspx
  • 47. HARDWARE HACKING HACKZ • Real man wear pink pagers!
  • 48. HARDWARE HACKING HACKZ • Wiring IM-ME for custom firmware installation! 1 2 3 3 4 1 - !RST - Reset 2 – DD – Debug Data 3 – DC – Debug Clock 4 - +2,5V - Power 5 – Gnd - Ground More information: http://travisgoodspeed.blogspot.pt/2010/03/im-me-goodfet-wiring-tutorial.html
  • 49. HARDWARE HACKING HACKZ • TV tuner + all mighty clock!
  • 50. HARDWARE HACKING HACKZ • TV tuner + all mighty clock! Results: http://adamsblog.aperturelabs.com/2013/03/you-can-ring-my-bell-adventures-in-sub.html
  • 51. HARDWARE HACKING HACKZ • Linksys WMB54G and others! Connector J9 Pin 1 – TX – Transmission Pin 2 – RX – Receiver Pin 8 – GND - Ground RAMDISK: ext2 filesystem found at block 0 RAMDISK: Loading 4096 blocks [1 disk] into ram disk... done. Freeing initrd memory: 4096k freed VFS: Mounted root (ext2 filesystem). Freeing unused kernel memory: 60k freed mount /proc file system ok! serial console detected. Disabling virtual terminals. init started: BusyBox v1.00-pre8 (2008.01.17-05:54+0000) multi-call binary BusyBox v1.00-pre8 (2008.01.17-05:54+0000) Built-in shell (ash) Enter 'help' for a list of built-in commands. # http://www.devttys0.com/2012/07/hacking-the-linksys-wmb54g/
  • 52. HARDWARE HACKING HACKZ • Hardware Random Number Generator • Two types of RNG: True and Pseudo • Pseudo – Created by algorithm • Problem – if someone knows your algorithm in theory can predict your random numbers • True – generates sequences that are impossible to predict. Use random physical events as sources of randomness. Component Quantity Arduino 1 2N3904 Transistor 3 4.7k Resistor 2 10k Resistor 1 1.5M Resistor 1 0.1µf Capacitor 1 10µf Capacitor 1 Breadboard 1 12v DC Adapter 1
  • 54. HARDWARE HACKING HACKZ 1. The two transistors create avalanche noise 2. Third transistor amplifies the noise 3. Noise is sent across voltage dividers to the arduino
  • 55. HARDWARE HACKING HACKZ 1 0 1 0 0 1 1 0 Arduino applies Von Neumann filtering to remove possible bias Provides network service that feeds random numbers
  • 56. HARDWARE HACKING DEMOS • Logic analyzer and SMC WAAG EU
  • 57. HARDWARE HACKING DEMOS • 2x Arduinos bomb Man in the middle Timer Activator
  • 58. HARDWARE HACKING COMPLICATIONS • Hard to access pins for probing! • Solution!
  • 59. HARDWARE HACKING COMPLICATIONS • Epoxy! • Heat gun • Dremel tool and sharp wooden stick • Best solution: Fuming Nitric Acid • Warm the nitric acid to 60 degree celsium • Putt small drops on the epoxy it will come right off
  • 60. HARDWARE HACKING CONCLUSION • Hardware hacking can be lots of fun even for software peeps • The initial part is simple and doesn’t have a HIGH learning curve • The more complicated parts will come naturally because you had so much fun with the beginning • Tools for hardware hacking have lowered in price where a beginners kit can easily be bough for 300-350 euros • Protocols down there still need to improve a lot on security

Editor's Notes

  • #23: If we look at the display we can see that the resistor measures as 1.46Ω, we can then assume that this is a 1.5M Ω resistor.
  • #38: Charlie miller research on batteries of mac books – it used i2cWii nunchuck = i2cPower button on laptop = SMBus which is i2c
  • #52: Does anyone remember the times we used to buy Motorola modems for cable and then switch the configs to get higher speeds? DOCSIS 2.0
  • #56:  It considers bits two at a time, taking one of three actions: when two successive bits are equal, they are discarded; a sequence of 1,0 becomes a 1; and a sequence of 0,1 becomes a zero. It thus represents a falling edge with a 1, and a rising edge with a 0It cannot assure randomness in its output, however. What it can do (with significant numbers of discarded bits) is transform a biased random bit stream into an unbiased one.