Share on

Fuzzing and Attacking Deeply Embedded Firmware

REGISTER

Training overview:

 

This training teaches how to analyze and fuzz test deeply embedded devices using custom embedded operating systems. These systems play a crucial role in the ever-growing Internet of Things and typically offer a lucrative attack surface with over-the-air interfaces, hardcoded secrets, and missing security protections.

During the training, we will understand the inner workings of a typical embedded system, and re-discover memory corruption vulnerabilities in real-world embedded operating systems by combining reverse engineering, emulation and fuzzing. We will then develop proof-of-concepts using the discovered vulnerabilities to demonstrate how an attacker could compromise the target system.

The full training is accompanied with various practical hands-on exercises and tinkering with a physical embedded training platform created for this training. After the training, we expect participants to feel comfortable to independently analyze deeply embedded systems of their choice.

Training agenda:

 

This three-day class will supply students with the following skills:

1.The inner workings of deeply embedded firmware

2. Fundamentals of firmware reverse engineering

3. Harnessing parsers for fuzzing

4. Fuzzing via full-system firmware rehosting

5. Overcoming typical fuzzing roadblocks

6. Triaging found crashes

7. How attackers could (ab-)use found vulnerabilities

Training schedule:

 

Day 1 

Obtaining and Analyzing Firmware

  • Linux-based VS deeply embedded firmware
  • Setting up and attaching a user-mode debugger
  •  Attaching a debugger using GFlags
  • Legacy debugger commands and extensions
Day 2

Emulation and Fuzzing

  • Full-system VS selective emulation
  • Parser harnessing with unicornAFL
  • Emulating peripherals
  • Full-system rehosting and fuzzing with Fuzzware
  • Identifying and solving fuzzing roadblocks
Day 3

Vulnerability Analysis and Outlook

  • Crash triaging and deduplication
  • Introduction to Cortex-M from an attacker’s perspective
  • Shellcoding on Arm
  • Advanced topics and training recap

Student requirements:

 

  • Basic knowledge in Python
  • Some background in C is a plus
  • Previous experience with firmware analysis, reverse engineering, or fuzzing is not required
Tobias is a systems security researcher at CISPA. In his academic research he focuses on the automated security testing of embedded firmware. Marius is an assistant professor at the University of Birmingham. His research interests cover (in-)security of embedded systems, binary & microarchitectural exploitation, and defenses.
REGISTER
Tobias Scharnowski & Marius Muench
Systems security researcher at CISPA & Assistant professor at the University of Birmingham
Tobias is a systems security researcher at CISPA. In his academic research he focuses on the automated security testing of embedded firmware. Marius is an assistant professor at the University of Birmingham. His research interests cover (in-)security of embedded systems, binary & microarchitectural exploitation, and defenses.