Hi there, welcome back.
In this lesson, I will talk about hardware exploitation of Iot devices, in particular exploitation
of UART interfaces.
But let's start by listing what the consequences of hardware exploitation can be, exploitation of the
hardware of an unsecured Iot device can allow you to: obtaining access as root/admin on the Iot device,
dumping the firmware from the Iot device, make live
debug execution to verify the possibility to bypass security protection and do a firmware modification
and rewright on the device.
First of all, let's see an introduction to UART communication.
UART stands for Universal Asynchronous Receiver Transmitter and is an hardware component for a
asynchronous serial communication. The UART
interface of a device requires the presence in addition to the ground connection and the power supply
of two cables for bidirectional communication.
That is a transmission cable (TX) and a reception cable (RX) as shown in picture.
UART ports could be hardware or software emulated on GPIOs (general-purpose input outputs) that are present
on many microcontrollers.
In UART communication, data is transmitted as frames, transmitter and receiver do not share a common
clock, so they should transmit at the same speed or baud rate that is symbols per seconds.
Common UART baud rates are listed on the slide from four thousand eight hundred to one
hundred fifteen thousand two hundred.
Now, let's see how the UART data transmission frame format is structured, UART frame or packet
format consists of: a start bit, then data bits that could be seven data bits plus one parity bit or
eight data bits without a parity bit, with least significant bit transmitted first.
Then we have a parity bit that is optional and at the end a stop bit.
To be able to correctly identify the structure of the UART data transmission frame of a specific physical
device, it is useful to use logic analyzers.
There are several on the market.
The figure shows an example of analysis of a signal made with the Saleae logic analyzer.
The waveform of the UART signal relating to a transmitted data sequence is clearly visible.
Now, let's talk about the steps to follow, to test the robustness in terms of security of a UART interface
present in a printed circuit board of an IoT device.
The first step to follow is to identify the UART pinouts
that is TX, RX, Ground, Vcc generally three point three Volts, or five Volts of the Iot device.
The indication of the pinouts can be done with a multimeter or with the use of tools such
as JTAGulator
of which a photo is shown in the slide.
The photo in this slide shows the identification of the four UART interface pinouts in a printed
circuit board related to a TPLink router.
The second step
in UART exploitation is to connect the UART pinouts of the Iot device to the PC used for the
analysis via a USB-TTL that is transistor transistor logic converter interface, for example, using
hardware tools such as Shikra, Attify badge, Bus Pirate, Adafruit, etc. In figure is shown
an image of the Bus Pirate converter interface.
And here is a schematic connection of an IoT device with UART interface connected to an analysis
PC through an Attify Badge interface.
The next step before establishing a data communication between the PC and the UART interface of the
Iot device is to identify the correct baud rate to set for data transmission.
To do this, it is possible to proceed either by using adhoc software scripts such as the Python
baudrate.py the script, that can be downloaded from a github project, or by using a diagnostic made
using hardware tools such as the JTAGulator tool.
Then you can proceed to establish a connection between the PC and the Iot device through the chosen
connection interface, launching appropriate connection programs from the PC such as the Linux minicom
or screen commands, as shown in the slide.
Once the connection with minicom or screen has been established, if the UART communication of the Iot
device is not protected with authentication
It is possible to gain access to the device's operating system through an authenticated root
shell.
These are the basics to finding and communicating with an embedded device via UART, and it's only
the tip of the iceberg.
There are many more things that can be done once you get a connection via UART to a device, such
as interrupting the boot process to access the bootloader, make use of the boot logs to identify how to
trigger scripts to run custom code, and change settings to give more access permissions.
But luckily, most modern enbedded devices aren't as simple as the examples shown here.
Many have protections in place to disable the UART console or have the debug pads removed from the PCB.
OK, this lesson ends here.
Thank you for your kind attention bye