Week 06 Quiz

Test your understanding of the weekly concepts.

Format: 10 multiple-choice questions. Passing score: 70%. Time: Untimed.

Take Quiz
CSY304 Week 06 Advanced

Automated debug interface identification tool.

IoT & Embedded Systems Security

Track your progress through this week's content

Opening Framing

The Physical Attack Vector: In the previous weeks, we looked at firmware as a file. But firmware lives on silicon. Secure Boot, disk encryption, and OS hardening often rely on the assumption that the hardware is trusted and immutable.

Why This Matters: Hardware hacking shatters this assumption. By attaching wires to test points, attackers can interrupt the boot process, dump secrets from RAM, or glitch the CPU into skipping password checks. If you can physically access a device, you are rarely more than $50 of equipment away from root access including techniques developed by NSA's ANT division (implants) to hobbyist bypassing of game console security.

Real-World Relevance: The PlayStation 3 Jailbreak was achieved by a simple voltage glitch on a memory line. ATM "skimmers" and "jackpotting" attacks often involve plugging into internal USB or serial ports hidden behind a plastic bezel.

Week Learning Outcomes:
  • Identify chips, test points, and interfaces on a PCB.
  • Interface with UART to access root consoles and bootloader shells.
  • Dump flash memory using SPI programmers (Flashrom).
  • Understand JTAG/SWD debugging protocols for deep system access.
  • Analyze logic analyzer captures to reverse engineer unknown protocols.
  • Execute basic fault injection attacks to bypass security checks.
MITRE ATT&CK for IoT Mapping:
T1046: Network Service Scanning

Mapping exposed interfaces like UART or JTAG.

T1052.001: Exfiltration over Physical Medium

Dumping firmware via SPI flash extraction.

T1200: Hardware Additions

Implanting hardware sniffers or malicious chips.

1) Tools of the Trade: Setting Up Your Lab

Hardware hacking requires a physical toolkit. You don't need thousands of dollars; a $50 kit can compromise 90% of consumer IoT devices.

Essential Hardware

Tool Price (Est) Function
USB-to-Serial (TTL) $5 Communicating with UART consoles (CP2102, CH340).
Multimeter $20 Tracing connections, checking voltage (VCC vs GND).
Logic Analyzer $15 Viewing digital signals (Saleae clone + Sigrok).
Programmer (CH341A) $10 Reading/Writing SPI Flash chips (BIOS/Firmware).
SOIC-8 Clip $5 Attaching to chips without soldering.

The Software Stack

You will need a Linux environment (Kali or Ubuntu) with specific drivers.

Install Command (Kali Linux)
sudo apt update
sudo apt install flashrom openocd minicom pulseview sigrok-cli binwalk

# Permissions Setup (Udev rules)
# Often required to access USB devices without sudo
wget https://git.io/openocd-udev -O /etc/udev/rules.d/99-openocd.rules
sudo udevadm control --reload

2) PCB Reconnaissance

The first step in any hardware engagement is high-resolution photography and component identification. You must understand what you are looking at before you apply power.

Anatomy of a PCB

COMPONENT IDENTIFICATION GUIDE:

┌───────────────────────────────────────┐
│ [ POWER SECTION ]                     │
│ - Fat traces (high current)           │
│ - Large capacitors (cylinders)        │
│ - Inductors (coils/squares)           │
│ - Voltage Regulators (3-pin + tab)    │
│ -> GOAL: Find 3.3V, 5V, and GND       │
└───────────────────────────────────────┘

┌───────────────────────────────────────┐
│ [ LOGIC SECTION ]                     │
│ - SoC/CPU (Largest BGA chip)          │
│ - RAM (DDR) near CPU (Length matched) │
│ - Flash (8-pin SPI or 48-pin TSOP)    │
│ -> GOAL: Identify Architecture        │
└───────────────────────────────────────┘

┌───────────────────────────────────────┐
│ [ DEBUG INTERFACES ]                  │
│ - 4-pin headers (UART)                │
│ - 10/14/20-pin headers (JTAG)         │
│ - Unpopulated solder pads             │
│ -> GOAL: Identify Root Shell access   │
└───────────────────────────────────────┘

Datasheet Hunting

Every chip has a unique marking. Google is your primary tool.

FCC ID Lookup: Most wireless devices have an FCC ID printed on the label. Search it on fccid.io. You will often find high-resolution "Internal Photos" uploaded by the testing lab, letting you analyze the board before you even buy the device!

3) UART Access (The Root Console)

UART (Universal Asynchronous Receiver/Transmitter) is the "standard out" for embedded systems. Developers use it to see boot logs. Hackers use it to interrupt the boot process.

Identifying the Pinout

You typically find a row of 3 or 4 pins (VCC, GND, TX, RX).

Pin Method to Identify Multimeter Reading
GND Continuity test to USB shield or SD card slot shell. 0 Ohms resistance to ground.
VCC Measure Voltage. DO NOT CONNECT your adapter here usually. Steady 3.3V or 5V.
TX Transmits data from device. Fluctuates (bounces) during boot. Resting voltage 3.3V (High).
RX Receives data from you. Steady High (3.3V) usually, waiting for input.

Connecting & Interacting

Use a USB-to-TTL Adapter (FTDI/CH340). CROSS THE STREAMS: Your TX goes to their RX. Your RX goes to their TX.

Terminal - Screen Session
$ screen /dev/ttyUSB0 115200 [ 0.000000] Linux version 4.1.15 (root@buildserver) ... [ 0.600000] console [ttyS0] enabled ... U-Boot 2020.04-g8b5 (Startup) Hit any key to stop autoboot: 0 <-- MASH ENTER HERE! => printenv bootargs=console=ttyS0,115200 root=/dev/mtdblock2 rootfstype=squashfs ipaddr=192.168.1.1 serverip=192.168.1.100 => setenv bootargs console=ttyS0,115200 init=/bin/sh => saveenv => boot

Exploit: By changing `bootargs` to `init=/bin/sh`, we tell the kernel to launch a root shell instead of the normal init system. This bypasses login passwords entirely.

4) SPI Flash Extraction

If UART is locked or silent, we go directly for the brain storage: the SPI Flash chip.

The Hardware

The Process (In-Circuit Programming - ICP)

You attach the clip to the chip while it is soldered to the board.

Voltage Contention: When you power the flash chip with your programmer (3.3V), that 3.3V rail also goes to the main CPU. The CPU might wake up and try to talk to the flash at the same time as you.
Fix: Short the CPU's Reset pin to Ground, or just lift the VCC pin of the flash chip.
Dumping with Flashrom
# 1. Detect the chip
sudo flashrom -p ch341a_spi

# Output: Found Winbond flash chip "W25Q64" (8192 kB, SPI).

# 2. Dump firmware (DO IT TWICE!)
sudo flashrom -p ch341a_spi -r dump1.bin
sudo flashrom -p ch341a_spi -r dump2.bin

# 3. Verify integrity
md5sum dump1.bin dump2.bin
# If hashes match, you have a good dump. If not, check connections.

5) JTAG & SWD (God Mode)

JTAG (Joint Test Action Group) is an industry standard for testing PCBs. For hackers, it is a hardware debugger interface that lets you control the CPU core directly.

Capabilities

Tools of the Trade

JTAGulator / JTAGEnum

Brute-force tools to find which of the 20 pins on a header are actually TMS, TCK, TDI, TDO.

OpenOCD

Open On-Chip Debugger. The software bridge between your adapter and GDB.

OPENOCD SESSION EXAMPLE:

$ openocd -f interface/jlink.cfg -f target/stm32f4x.cfg
...
Info: stm32f4x.cpu: hardware has 6 breakpoints, 4 watchpoints

$ telnet localhost 4444
> reset halt
target halted due to debug-request, current mode: Thread 
xPSR: 0x01000000 pc: 0x08000134 msp: 0x20000400

> dump_image ram_dump.bin 0x20000000 0x10000
(Dumps 64KB of RAM to disk)

6) Case Study: Hacking the "HomeRouter X"

Let's walk through a complete hardware engagement from unboxing to root shell.

Phase 1: Entry

You pry open the router. You see a 4-pin header near the CPU.

  1. Multimeter Check: Pin 1 is GND. Pin 4 is 3.3V. Pin 2 is steady 3.3V (RX). Pin 3 fluctuates (TX).
  2. Calculated Guess: This is UART. The Baud rate is unknown.
  3. Tooling: Use a Logic Analyzer ($10) on Pin 3. Pulse width suggests 115200 baud.
  4. Connection: USB-TTL adapter connected. Screen session opened.

Phase 2: The Obstacle

You mash "Enter" and get a prompt: Password:. Common passwords (admin/admin, root/root) fail. The UART is password protected.

Phase 3: The Bypass

You notice the boot logs mention "U-Boot 1.1.4". You reboot the router and immediately mash keys again during the "Hit any key to stop autoboot" countdown.
Success! Alternatively, you can glitch the data line of the External Flash chip to corrupt the bootloader's "password text," causing it to fallback to a default or crash into a shell. You drop into the U-Boot shell =>.

Phase 4: Persistence

From U-Boot, you modify the kernel command line: setenv bootargs "console=ttyS0,115200 root=/dev/mtdblock2 init=/bin/sh". You boot. The kernel loads, mounts the filesystem, and instead of asking for a password, it gives you a root shell #. You dump /etc/shadow and crack the hash for later remote access.

7) Advanced: Fault Injection (Glitching)

If the software is secure (signed bootloader), and the debug ports are disabled (JTAG fused), how do you get in? You break the physics of the chip.

Voltage Glitching

At the exact moment the CPU checks a password or signature: if (signature_valid) ... You verify quickly drop the core voltage (VCC) to 0.5V and bring it back up.

The CPU might fail to execute the "Compare" instruction or skip the "Branch if Equal" instruction, falling through to the "Access Granted" code path. This breaks Secure Boot chains and Password checks on unpatchable ROM code.

Python Glitch Controller (Pseudo-Code)
import chipwhisperer as cw

# Connect to hardware
scope = cw.scope()
target = cw.target(scope)

# Loop to find the glitch
for width in range(1, 40):
    for offset in range(1, 100):
        scope.glitch.width = width
        scope.glitch.offset = offset
        
        # Trigger glitch
        scope.arm()
        target.reset()
        
        # Check result
        output = target.read()
        if "Welcome Root" in output:
            print(f"GLITCH SUCCESS at width {width}, offset {offset}")
            break

8) Defensive Hardware Architecture

How do we design hardware to resist these attacks?

Disable Debug Ports

Blow efficiency eFuses to permanently disable JTAG/SWD on production chips. Or simply don't route the traces to headers.

Conformal Coating

Cover critical chips in hard epoxy (potting) to prevent probing. Makes chip clips impossible to attach.

Secure Element (SE)

Store keys in a dedicated crypto chip (TPM/HSM) that resists extraction even if the main CPU is compromised.

Mesh Sensors

Active wire mesh embedded in the PCB layers. If a drill punctures it, the device wipes its keys (Tamper Response).

Guided Lab: Protocol Analysis

Objective: Analyze a captured logic analyzer trace of a secure boot process.

Scenario: You attached a logic analyzer to a suspicious chip. Decode the traffic.

Part 1: Setup Logic 2 (Saleae)

  1. Download "Saleae Logic 2" software (works without hardware in demo mode).
  2. Load the provided capture file `boot_capture.sal`.

Part 2: SPI Decoding

  1. Identify the Channels: CLK (Clock), MOSI (Master Out), MISO (Master In), CS (Select).
  2. Add an SPI Analyzer.
  3. Task: Find the ASCII string "U-Boot" in the MISO channel. This demonstrates the CPU reading the bootloader from Flash.
XP REWARD: +150 XP (Signal Analyst)

Part 3: UART Decoding

  1. Find the channel that is "High" most of the time but dips low occasionally.
  2. Add a Async Serial analyzer.
  3. Challenge: You don't know the Baud Rate. Use the "Auto-Baud" feature or measure the width of the shortest pulse (1 bit duration).
    Hint: If pulse is 8.68 microseconds, Baud = 1 / 0.00000868 ≈ 115200.
XP REWARD: +200 XP (Baud Hunter)

Building on Prior Knowledge

Hardware hacking relies heavily on the protocols you learned in CSY202.

From CSY202 (Protocols)

The UART and SPI signals are physical manifestations of the packets you studied. The start/stop bits in UART are the "Physical Layer" in OSI.

From CSY104 (Networking)

Many IoT devices have internal Ethernet switches. You can physically tap the MII/RMII traces on the logic board to sniff network traffic before it even hits the wire.

Outcome Check

Resources & Equipment

JTAGulator

Automated debug interface identification tool.

 Bus Pirate

Examples and documentation for the "Swiss Army Knife" of hardware hacking.

 Flashrom

The utility for reading/writing flash chips.

 FCC ID Search

Database of internal photos for wireless devices.

 Saleae Logic 2

The Logic Analyzer software standard (free for learning).

Glossary of Terms

UART
Universal Asynchronous Receiver/Transmitter. Serial communication protocol used for console access.
Baud Rate
The speed of data transmission in symbols per second (e.g., 115200 is fast, 9600 is slow).
JTAG
Joint Test Action Group. A debugging standard used to test PCBs and debug chips.
SPI
Serial Peripheral Interface. High-speed synchronous protocol used for Flash memory storage.
Glitching
Injecting faults (voltage/clock) to cause the CPU to skip instructions or behave unpredictably.