<img width="500" height="350" src="iot_awesome_logo.svg" alt="Awesome">
Awesome Embedded and
IoT Security 
A curated list of awesome resources about embedded and IoT security.
The list contains software and hardware tools, books, research papers
and more.
Botnets like Mirai have
proven that there is a need for more security in embedded and IoT
devices. This list shall help beginners and experts to find helpful
resources on the topic.
If you are a beginner, you should have a look at the
Books and Case Studies
sections.
If you want to start right away with your own analysis, you should give
the Analysis Frameworks a try. They are easy to use
and you do not need to be an expert to get first meaningful results.
Items marked with :euro: are comercial products.
Contents
Software tools for analyzing embedded/IoT devices and firmware.
Analysis Frameworks
- EXPLIoT -
Pentest framework like Metasploit but specialized for IoT.
- FACT - The Firmware
Analysis and Comparison Tool - Full-featured static analysis
framework including extraction of firmware, analysis utilizing different
plug-ins and comparison of different firmware versions.
- FwAnalyzer -
Analyze security of firmware based on customized rules. Intended as
additional step in DevSecOps, similar to CI.
- HAL – The Hardware
Analyzer - A comprehensive reverse engineering and manipulation
framework for gate-level netlists.
- HomePWN - Swiss
Army Knife for Pentesting of IoT Devices.
- IoTSecFuzz
- Framework for automatisation of IoT layers security analysis:
hardware, software and communication.
- Killerbee -
Framework for Testing & Auditing ZigBee and IEEE 802.15.4
Networks.
- PRET - Printer
Exploitation Toolkit.
- Routersploit -
Framework dedicated to exploit embedded devices.
- Binwalk -
Searches a binary for “interesting” stuff, as well as extracts arbitrary
files.
- cwe_checker -
Finds vulnerable patterns in binary executables - ELF support for x86,
ARM, and MIPS, experimental bare-metal support.
- emba - Analyze
Linux-based firmware of embedded devices.
- Firmadyne -
Tries to emulate and pentest a firmware.
- Firmwalker -
Searches extracted firmware images for interesting files and
information.
- Firmware
Slap - Discovering vulnerabilities in firmware through concolic
analysis and function clustering.
- Ghidra - Software Reverse
Engineering suite; handles arbitrary binaries, if you provide CPU
architecture and endianness of the binary.
- Radare2 - Software
Reverse Engineering framework, also handles popular formats and
arbitrary binaries, has an extensive command line toolset.
- Trommel - Searches
extracted firmware images for interesting files and information.
- FACT
Extractor - Detects container format automatically and executes the
corresponding extraction tool.
- Firmware
Mod Kit - Extraction tools for several container formats.
- The SRecord package -
Collection of tools for manipulating EPROM files (can convert lots of
binary formats).
- JTAGenum - Add
JTAG capabilities to an Arduino.
- OpenOCD - Free and Open On-Chip
Debugging, In-System Programming and Boundary-Scan Testing.
- Cotopaxi - Set of
tools for security testing of Internet of Things devices using specific
network IoT protocols.
- dumpflash -
Low-level NAND Flash dump and parsing utility.
- flashrom - Tool
for detecting, reading, writing, verifying and erasing flash chips.
- Samsung
Firmware Magic - Decrypt Samsung SSD firmware updates.
- Bus
Blaster - Detects and interacts with hardware debug ports like UART
and JTAG.
- Bus
Pirate - Detects and interacts with hardware debug ports like UART
and JTAG.
- Shikra - Detects
and interacts with hardware debug ports like UART and JTAG. Among other
protocols.
- JTAGULATOR
- Detects JTAG Pinouts fast.
- Saleae - Easy to use Logic
Analyzer that support many protocols :euro:.
- Ikalogic
- Alternative to Saleae logic analyzers :euro:.
- HydraBus -
Open source multi-tool hardware similar to the BusPirate but with NFC
capabilities.
- ChipWhisperer -
Detects Glitch/Side-channel attacks.
- Glasgow -
Tool for exploring and debugging different digital interfaces.
- J-Link
- J-Link offers USB powered JTAG debug probes for multiple different CPU
cores :euro:.
- UberTooth
One - Open source 2.4 GHz wireless development platform suitable for
Bluetooth experimentation.
- Bluefruit LE
Sniffer - Easy to use Bluetooth Low Energy sniffer.
- ApiMote - ZigBee security research
hardware for learning about and evaluating the security of IEEE
802.15.4/ZigBee systems. Killerbee compatible.
- Atmel RZUSBstick - Discontinued product. Lucky if you have one! -
Tool for development, debugging and demonstration of a wide range of low
power wireless applications including IEEE 802.15.4, 6LoWPAN, and ZigBee
networks. Killerbee compatible.
- Freakduino
- Low Cost Battery Operated Wireless Arduino Board that can be turned
into a IEEE 802.15.4 protocol sniffer.
- RTL-SDR -
Cheapest SDR for beginners. It is a computer based radio scanner for
receiving live radio signals frequencies from 500 kHz up to 1.75
GHz.
- HackRF One -
Software Defined Radio peripheral capable of transmission or reception
of radio signals from 1 MHz to 6 GHz (half-duplex).
- YardStick
One - Half-duplex sub-1 GHz wireless transceiver.
- LimeSDR
- Software Defined Radio peripheral capable of transmission or reception
of radio signals from 100 KHz to 3.8 GHz (full-duplex).
- BladeRF 2.0 -
Software Defined Radio peripheral capable of transmission or reception
of radio signals from 47 MHz to 6 GHz (full-duplex).
- USRP B
Series - Software Defined Radio peripheral capable of transmission
or reception of radio signals from 70 MHz to 6 GHz (full-duplex).
- Proxmark 3 RDV4 - Powerful
general purpose RFID tool. From Low Frequency (125kHz) to High Frequency
(13.56MHz) tags.
- ChamaleonMini -
Programmable, portable tool for NFC security analysis.
- HydraNFC -
Powerful 13.56MHz RFID / NFC platform. Read / write / crack / sniff /
emulate.
Books
- 2020, Fotios Chantzis, Evangel Deirme, Ioannis Stais, Paulino
Calderon, Beau Woods: Practical
IoT Hacking
- 2020, Jasper van Woudenberg, Colin O’Flynn: The Hardware Hacking
Handbook: Breaking Embedded Security with Hardware Attacks
- 2019, Yago Hansen: The
Hacker’s Hardware Toolkit: The best collection of hardware gadgets for
Red Team hackers, Pentesters and security researchers
- 2019, Aditya Gupta: The IoT Hacker’s
Handbook: A Practical Guide to Hacking the Internet of Things
- 2018, Mark Swarup Tehranipoor: Hardware
Security: A Hands-on Learning Approach
- 2018, Mark Carney: Pentesting Hardware
- A Practical Handbook (DRAFT)
- 2018, Qing Yang, Lin Huang Inside
Radio: An Attack and Defense Guide
- 2017, Aditya Gupta, Aaron Guzman: IoT
Penetration Testing Cookbook
- 2017, Andrew Huang: The Hardware Hacker:
Adventures in Making and Breaking Hardware
- 2016, Craig Smith: The Car
Hacker’s Handbook: A Guide for the Penetration Tester
- 2015, Keng Tiong Ng: The Art of
PCB Reverse Engineering
- 2015, Nitesh Dhanjan: Abusing the
Internet of Things: Blackouts, Freakouts, and Stakeouts
- 2015, Joshua Wright , Johnny Cache: Hacking
Wireless Exposed
- 2014, Debdeep Mukhopadhyay: Hardware
Security: Design, Threats, and Safeguards
- 2014, Jack Ganssle: The
Firmware Handbook (Embedded Technology)
- 2013, Andrew Huang: Hacking
the XBOX
Research Papers
- 2020, Oser et al: SAFER: Development and
Evaluation of an IoT Device Risk Assessment Framework in a Multinational
Organization
- 2019, Agarwal et al: Detecting IoT Devices
and How They Put Large Heterogeneous Networks at Security Risk
- 2019, Almakhdhub et al: BenchIoT: A
Security Benchmark for the Internet of Things
- 2019, Alrawi et al: SoK:
Security Evaluation of Home-Based IoT Deployments
- 2019, Abbasi et al: Challenges
in Designing Exploit Mitigations for Deeply Embedded Systems
- 2019, Song et al: PeriScope:
An Effective Probing and Fuzzing Framework for the Hardware-OS
Boundary
- 2018, Muench et al: What
You Corrupt Is Not What You Crash: Challenges in Fuzzing Embedded
Devices
- 2017, O’Meara et al: Embedded
Device Vulnerability Analysis Case Study Using Trommel
- 2017, Jacob et al: How to Break Secure Boot on
FPGA SoCs through Malicious Hardware
- 2017, Costin et al: Towards Automated
Classification of Firmware Images and Identification of Embedded
Devices
- 2016, Kammerstetter et al: Embedded
Security Testing with Peripheral Device Caching and Runtime Program
State Approximation
- 2016, Chen et al: Towards
Automated Dynamic Analysis for Linux-based Embedded Firmware
- 2016, Costin et al: Automated Dynamic
Firmware Analysis at Scale: A Case Study on Embedded Web
Interfaces
- 2015, Shoshitaishvili et al:Firmalice
- Automatic Detection of Authentication Bypass Vulnerabilities in Binary
Firmware
- 2015, Papp et al: Embedded
Systems Security: Threats, Vulnerabilities, and Attack Taxonomy
- 2014, Zaddach et al: Avatar:
A Framework to Support Dynamic Security Analysis of Embedded Systems’
Firmwares
- 2014, Alimi et al: Analysis of embedded
applications by evolutionary fuzzing
- 2014, Costin et al: A
Large-Scale Analysis of the Security of Embedded Firmwares
- 2013, Davidson et al: FIE
on Firmware: Finding Vulnerabilities in Embedded Systems using Symbolic
Execution
Case Studies
Free Training
Websites
Blogs
Tutorials and Technical
Background
YouTube Channels
- Flashback Team
- A duo of hackers explaining their step by step approach to finding and
exploiting vulnerabilities in embedded devices.
- StackSmashing
- Reverse engineering and hardware hacking of embedded devices.
Conferences
Conferences focused on embedded and/or IoT security.
- Hardwear.io
- EU, The Hague, September.
- USA, Santa Clara, June.
Contribute
Contributions welcome! Read the contribution guidelines first.
License
To the extent possible under law, Fraunhofer FKIE has waived all
copyright and related or neighboring rights to this work.
embeddedandiotsecurity.md
Github