CommSec D1 - How to Find and Exploit Bugs in IoT Devices
summary
Demonstrates hardware hacks that recover full firmware and config from routers and voice hubs: JTAG on a Linksys WRT54G yields a kernel and memory dump, opens Telnet port 4444 with no password, and exposes plaintext usernames, PPPoE and DDNS passwords plus private keys; ISP soldering and chip‑off with infrared rework on Alexa/Google devices reads eMMC chips via BGA adapters; uses OpenOCD and Bus Blaster to dump images and the techniques reliably work on tested devices.
AI-written summary · about
chapters (19)
- 0:00SPEAKER BIO
- 1:02Speaker@
- 1:58Publications
- 2:47Attack Vector on loT
- 3:55Protocol / Software based
- 5:20Cherry Blossom - Page 124, Para 13
- 6:16Hardware based method?
- 6:58Test Access Port (TAP)
- 9:04Linksys Router JTAG pins
- 9:37UART pins
- 11:49OpenOCD
- 13:49Kill the watchdog and halt system
- 14:52Print the kernel address value
- 15:07Magic Header of Kernel Section
- 18:21Whole FLASH sturture
- 19:21ISP - In System Circuit Programming
- 20:12Amazon Alexa
- 21:58Google Home Mini
- 22:32Chip-off Village by VXRL
related talks
28mThe IoT Hacker's Toolkit
41mDon’t Trash It, Hack It: Reverse Engineering Secrets & Re-purposing ISP Routers
40mIntroduction to IoT Reverse Engineering
45mOutside the box: pwning IoT devices through their applications
32mCommon Attacks on IoT Devices
44mExposing Critical Threats In Millions Of Connected Devices
52mIoT Hacking 101: Reverse Engineering The Xiaomi Ecosystem
25mAdventures & Findings in ISP Hacking