IoT hacking field notes #1: Intro to glitching attacks

TL;DR: First in a new series of short, IoT-related posts, this tells the story of a simple glitching attack we used to get a bootloader shell and ultimately root a device. IoT field notes is a new series of short stories about interesting (hopefully 🙂 ) observations, vulnerabilities and techniques, inspired directly from the IoT … Continue reading IoT hacking field notes #1: Intro to glitching attacks →

Will they melt? Testing the resistance of flash memory chips

Firmware: the holy grail of most Internet of Things (IoT) security assessments! Sometimes, getting access to a device's firmware can be as easy as visiting the vendor's website. Other times, the only option is to dump it directly from the hardware, and this is where things get interesting. Some procedures used for dumping can expose … Continue reading Will they melt? Testing the resistance of flash memory chips →

Enabling Verified boot on Raspberry Pi 3

TL;DR: Verified boot is a fundamental security technology and it is important to be able to experiment with it on easily accessible hardware. However, creating a Verified boot demo on a Raspberry Pi 3 is harder than it sounds. We set out to find resources on the internet. Unfortunately, some of these were outdated, others … Continue reading Enabling Verified boot on Raspberry Pi 3 →

Hacking Connected Home Alarm Systems – The Expensive [part 2]

TL;DR: We were wondering whether price affects the security of IoT appliances. So we verified the security of two differently priced connected home alarm systems. Both IoT alarms are marketed as an easy solution to protect your home. Unfortunately we find this not to be the case as we identified multiple critical vulnerabilities in both systems. … Continue reading Hacking Connected Home Alarm Systems – The Expensive [part 2] →

Hacking Connected Home Alarm Systems – The Cheap [Part 1]

Hack Our Train

This year, in an effort to raise awareness about IoT security, we launched the Hack Our Train challenge. For over three weeks, a model train tirelessly chugged on its tracks inside our IoT village at Co.Station Brussels and then once more for two days at BruCON 2017. We provided it with an emergency brake system … Continue reading Hack Our Train →

A 30-minute sweep of Industrial Control Systems in Belgium

TLDR; We found several ICS systems in Belgium that were exposed to the internet without requiring any authentication. Screenshots below. Update 19/12: We've also had some coverage in the media about this research. 'De Standaard' did an article about it and so did 'Datanews' (in Dutch and in French). Industrial Control Systems (ICS) is the … Continue reading A 30-minute sweep of Industrial Control Systems in Belgium →