HIP19: Introduction to IoT Reverse Engineering - V. Di Giampietro

Introduction to IoT Reverse Engineering by Valerio Di Giampietro

https://hackinparis.com/talks/#talk-2019-introduction-to-iot-reverse-engineering-with-an-example-on-a-home-router

Introduction to firmware reverse engineering process of IoT devices. The process, described with an example on a home router, is based on Information Gathering of hardware and software, Building of an Emulation Environment to run binaries, and Techniques to analyze, hack and modify the firmware.

The introduction to firmware reverse engineering process is described with a real example, done by the author, on a recent home router with the target to load a modified firmware overcoming the router protection that doesn’t allow loading of unsigned firmware.
The process described is based on:
Information Gathering

- identify main device components (CPU, Flash, SDRAM, main components)

- locate UART and JTAG interfaces

- hw tools: Bus Pirate, OpenOCD, Jtagulator

- get os image file or firmware file

- sw tools: strings, file, binwalk, dd, jefferson, uncramfs etc.

- identification of CPU, Flash, RAM, kernel version, C library, toolchain used etc.

- identification of Original Manufacturer and Original Firmware Manufacturer

Emulation Environment using QEMU

- select a QEMU machine and CPU reasonably similar to the IoT device (same CPU, similar kernel version, similar modules and libraries)

- select a tool to build the kernel and the root file system (brief description of Yocto Project, Buildroot and OpenWRT build system). Buildroot will be used in the example and described in more detail

- Buildroot and kernel configuration, generation of root file system with binaries and libraries with debugging information

- Overcoming obstacles created by the firmware manufacturer

- Running interesting binaries in the emulated environment

- Use tools like strace, ltrace, gdb to reverse engineer the most interesting binaries

Analyze how the device works

- the firmware upgrade process

- CLI and Web interface analisys

- main processes analisys

- finding vulnerabilities

- hacking into the system

- hack the firmware upgrade process

- replace the original firmware

Create a Firmware Modification Kit to simplify the firmware modification process

Видео HIP19: Introduction to IoT Reverse Engineering - V. Di Giampietro канала Hack in Paris