• Stars
    star
    1,395
  • Rank 33,684 (Top 0.7 %)
  • Language
  • License
    Creative Commons ...
  • Created over 5 years ago
  • Updated about 1 year ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

A curated list of awesome embedded and IoT security resources.
Awesome

Awesome Embedded and IoT Security Awesome

A curated list of awesome resources about embedded and IoT security. The list contains software and hardware tools, books, research papers and more.

Botnets like Mirai have proven that there is a need for more security in embedded and IoT devices. This list shall help beginners and experts to find helpful resources on the topic.
If you are a beginner, you should have a look at the Books and Case Studies sections.
If you want to start right away with your own analysis, you should give the Analysis Frameworks a try. They are easy to use and you do not need to be an expert to get first meaningful results.

Items marked with πŸ’Ά are comercial products.

Contents

Software Tools

Software tools for analyzing embedded/IoT devices and firmware.

Analysis Frameworks

Analysis Tools

  • Binwalk - Searches a binary for "interesting" stuff, as well as extracts arbitrary files.
  • emba - Analyze Linux-based firmware of embedded devices.
  • Firmadyne - Tries to emulate and pentest a firmware.
  • Firmwalker - Searches extracted firmware images for interesting files and information.
  • Firmware Slap - Discovering vulnerabilities in firmware through concolic analysis and function clustering.
  • Ghidra - Software Reverse Engineering suite; handles arbitrary binaries, if you provide CPU architecture and endianness of the binary.
  • Radare2 - Software Reverse Engineering framework, also handles popular formats and arbitrary binaries, has an extensive command line toolset.
  • Trommel - Searches extracted firmware images for interesting files and information.

Extraction Tools

  • FACT Extractor - Detects container format automatically and executes the corresponding extraction tool.
  • Firmware Mod Kit - Extraction tools for several container formats.
  • The SRecord package - Collection of tools for manipulating EPROM files (can convert lots of binary formats).

Support Tools

  • JTAGenum - Add JTAG capabilities to an Arduino.
  • OpenOCD - Free and Open On-Chip Debugging, In-System Programming and Boundary-Scan Testing.

Misc Tools

  • Cotopaxi - Set of tools for security testing of Internet of Things devices using specific network IoT protocols.
  • dumpflash - Low-level NAND Flash dump and parsing utility.
  • flashrom - Tool for detecting, reading, writing, verifying and erasing flash chips.
  • Samsung Firmware Magic - Decrypt Samsung SSD firmware updates.

Hardware Tools

  • Bus Blaster - Detects and interacts with hardware debug ports like UART and JTAG.
  • Bus Pirate - Detects and interacts with hardware debug ports like UART and JTAG.
  • Shikra - Detects and interacts with hardware debug ports like UART and JTAG. Among other protocols.
  • JTAGULATOR - Detects JTAG Pinouts fast.
  • Saleae - Easy to use Logic Analyzer that support many protocols πŸ’Ά.
  • Ikalogic - Alternative to Saleae logic analyzers πŸ’Ά.
  • HydraBus - Open source multi-tool hardware similar to the BusPirate but with NFC capabilities.
  • ChipWhisperer - Detects Glitch/Side-channel attacks.
  • Glasgow - Tool for exploring and debugging different digital interfaces.
  • J-Link - J-Link offers USB powered JTAG debug probes for multiple different CPU cores πŸ’Ά.

Bluetooth BLE Tools

  • UberTooth One - Open source 2.4 GHz wireless development platform suitable for Bluetooth experimentation.
  • Bluefruit LE Sniffer - Easy to use Bluetooth Low Energy sniffer.

ZigBee Tools

  • ApiMote - ZigBee security research hardware for learning about and evaluating the security of IEEE 802.15.4/ZigBee systems. Killerbee compatible.
  • Atmel RZUSBstick - Discontinued product. Lucky if you have one! - Tool for development, debugging and demonstration of a wide range of low power wireless applications including IEEE 802.15.4, 6LoWPAN, and ZigBee networks. Killerbee compatible.
  • Freakduino - Low Cost Battery Operated Wireless Arduino Board that can be turned into a IEEE 802.15.4 protocol sniffer.

SDR Tools

  • RTL-SDR - Cheapest SDR for beginners. It is a computer based radio scanner for receiving live radio signals frequencies from 500 kHz up to 1.75 GHz.
  • HackRF One - Software Defined Radio peripheral capable of transmission or reception of radio signals from 1 MHz to 6 GHz (half-duplex).
  • YardStick One - Half-duplex sub-1 GHz wireless transceiver.
  • LimeSDR - Software Defined Radio peripheral capable of transmission or reception of radio signals from 100 KHz to 3.8 GHz (full-duplex).
  • BladeRF 2.0 - Software Defined Radio peripheral capable of transmission or reception of radio signals from 47 MHz to 6 GHz (full-duplex).
  • USRP B Series - Software Defined Radio peripheral capable of transmission or reception of radio signals from 70 MHz to 6 GHz (full-duplex).

RFID NFC Tools

  • Proxmark 3 RDV4 - Powerful general purpose RFID tool. From Low Frequency (125kHz) to High Frequency (13.56MHz) tags.
  • ChamaleonMini - Programmable, portable tool for NFC security analysis.
  • HydraNFC - Powerful 13.56MHz RFID / NFC platform. Read / write / crack / sniff / emulate.

Books

Research Papers

Case Studies

Free Training

Websites

Blogs

Tutorials and Technical Background

YouTube Channels

  • Flashback Team - A duo of hackers explaining their step by step approach to finding and exploiting vulnerabilities in embedded devices.
  • StackSmashing - Reverse engineering and hardware hacking of embedded devices.

Conferences

Conferences focused on embedded and/or IoT security.

  • Hardwear.io
    • EU, The Hague, September.
    • USA, Santa Clara, June.

Contribute

Contributions welcome! Read the contribution guidelines first.

License

CC0

To the extent possible under law, Fraunhofer FKIE has waived all copyright and related or neighboring rights to this work.

More Repositories

1

FACT_core

Firmware Analysis and Comparison Tool
Python
1,230
star
2

cwe_checker

cwe_checker finds vulnerable patterns in binary executables
Rust
1,088
star
3

friTap

The goal of this project is to help researchers to analyze traffic encapsulated in SSL or TLS.
JavaScript
257
star
4

dewolf

A research decompiler implemented as a Binary Ninja plugin.
Python
171
star
5

libdesock

A de-socketing library for fuzzing.
C
131
star
6

nvd-json-data-feeds

Community reconstruction of the legacy JSON NVD Data Feeds. This project uses and redistributes data from the NVD API but is neither endorsed nor certified by the NVD.
Shell
109
star
7

RoAMer

Robust Automated Malware Unpacker
Python
84
star
8

fact_extractor

Standalone Utility for FACT-like extraction
Python
80
star
9

LuckyCAT

A distributed fuzzing management framework
Python
63
star
10

iva

IVA is a system to scan for known vulnerabilities in software products installed inside an organization. IVA uses CPE identifiers to search for CVEs related to a software product.
Python
60
star
11

DeStroid

Fighting String Encryption in Android Malware
Python
53
star
12

butterfly

LibAFL components for stateful fuzzing
Rust
42
star
13

yapscan

Yapscan is a YAra based Process SCANner, aimed at giving more control about what to scan and giving detailed reports on matches.
Go
40
star
14

bountyhunter

A Caldera plugin for the emulation of complete, realistic cyberattack chains.
Python
40
star
15

socbed

A Self-Contained Open-Source Cyberattack Experimentation Testbed
Python
35
star
16

pcapFS

A FUSE module to mount captured network data
C++
32
star
17

Logprep

log data pre processing, generation and shipping in python
Python
30
star
18

embedded-evaluation-corpus

firmware evaluation reference corpus
22
star
19

wattson

A co-simulation framework for reasearching cybersecurity in power grids.
Python
19
star
20

ipal_transcriber

Industrial protocol transcriber - a common representation of industrial communication as input for protocol-independent industrial intrusion detection systems.
Python
19
star
21

ipal_ids_framework

Industrial Intrusion Detection - A framework for protocol-independent industrial intrusion detection on top of IPAL.
Python
19
star
22

FACT_docker

Dockerfile for building the FACT container
Python
18
star
23

ipal_datasets

Industrial datasets - datasets for evaluating industrial intrusion detection systems on IPAL.
Python
14
star
24

FACT_analysis-plugin_CVE-lookup

FACT analysis plug-in that maps software version to cves
Python
13
star
25

headerParser

Header information parser for PE, ELF, DEX, MachO, ZIP (JAR, DocX).
C
13
star
26

blackbox-opcua-fuzzing

Python
9
star
27

Codescanner

Python
9
star
28

png-carving

PNG file carving related material
C++
8
star
29

mcritweb

JavaScript
7
star
30

bidcos-security-doc

A documentation of the Bidcos (homematic) radio protocol with focus on practical security aspects
Python
7
star
31

FACT_firmadyne_analysis_plugin

Integrates Firmadyne into FACT
Python
7
star
32

61850-fuzzing

This repository provides fuzzing scripts to analyze an IEC 61850 implementation
Python
6
star
33

woodblock

A framework to generate file carving test data.
Python
6
star
34

eeva

EΒ²VA short for Exploitation Experience with Vulnerable App is a vulnerable app to learn userspace exploitation on Android
Java
6
star
35

common_analysis_oms

Offline Malware Scanner (OMS) scans files with multiple locally installed malware scanners.
Python
6
star
36

dewolf-logic

A graph-based logic engine for bitwise operations.
Python
5
star
37

fact_pdf_report

FACT PDF Report Generator
Python
4
star
38

maritime-dissector

A lua plugin for Wireshark which contains dissectors for common maritime protocols.
Lua
4
star
39

common_analysis_ip_and_uri

Detects IPv4 and IPv6 adresses as well as URIs
Python
4
star
40

Algorithmic-Heap-Layout-Manipulation-in-the-Linux-Kernel

Our artifacts to our Paper: "Algorithmic Heap Layout Manipulation in the Linux Kernel"
C
4
star
41

bpf-rootkit-workshop

Workshop: Forensic Analysis of eBPF based Linux Rootkits
C
4
star
42

bpmac

C
3
star
43

talk

NtDeviceIoControlFile talker
C
3
star
44

windowsScripts

A collection of some useful windows (batch) scripts.
Batchfile
3
star
45

common_helper_extraction

Extraction support functions
Python
3
star
46

cve-attribution-s2

Companion Repository to our the whitepaper "Towards Reliable and Scalable Linux Kernel CVE Attribution in Automated Static Firmware Analyses": https://arxiv.org/abs/2209.05217
Python
3
star
47

fact_helper_file

File type helper functions and magic library
Python
3
star
48

entropython

Efficient calculation of shannon byte entropy based on rust library.
Rust
3
star
49

docker_qemu_user

Phusion-based docker image containing the binaries for Qemu User Emulation
Shell
2
star
50

epf-parameter-screening

Shell
2
star
51

pidarci

PIdARCI Prototype Implementation
Python
2
star
52

FACT_analysis_plugin_template

Download this template if you want to write your own FACT analysis plug-in
Python
2
star
53

FACT_Search_and_Download

This tool is intended to create a ground truth matching specific parameters for scientific research on firmware.
Python
2
star
54

common_helper_files

Python
2
star
55

common_helper_yara

Yara command line wrapper
Python
2
star
56

bamboo-chuck-norris-plugin

2
star
57

ELFbin

C
2
star
58

hexter

A minimal terminal hex viewer supporting reading, writing and searching in files and processes.
C
2
star
59

docker_ghidra_headless_base

base docker image for ghidra headless scripting
Dockerfile
2
star
60

ssdeeper

Supplemental material for our paper: ssdeeper - Evaluating and Improving ssdeep.
Shell
1
star
61

common_helper_filter

generate nice structured output
Python
1
star
62

cwe_checker_travis_docker_image

Docker image with current BAP (opam testing) and other dependencies for fast testing of cwe_checker on travis
Dockerfile
1
star
63

mana

Python
1
star
64

FACT_remote_plugin_runner

Base class for FACT remote analysis systems
1
star
65

epf-case-study

C
1
star
66

fact_radare_viewer

Start radare webUI via REST in container and deliver url to view
Python
1
star
67

socbed-eval-acsac-2021

SOCBED evaluation code and dataset as presented at ACSAC 2021
Python
1
star
68

ei2f

C++
1
star
69

common_helper_unpacking_classifier

Try to guess if unpacking a container was successfull.
Python
1
star
70

docker-radare-web-gui

Dockerfile for Radare2 web gui
Shell
1
star
71

dewolf-idioms

A new approach for compiler idioms handling that automatically generates patterns to annotate them.
Python
1
star
72

conpot-plus

Python
1
star
73

frida-emulator-bypass

1
star
74

common_helper_passwords

Helper functions for handling password lists and files.
Python
1
star
75

Web-Content-Integrity

Web Content Integrity: Tamper-proof websites beyond HTTPS
HTML
1
star
76

spmac

Python
1
star
77

common_helper_process

fail-safe process helpers
Python
1
star
78

powerowl

PowerOwl models power grids as a whole and allows to simulate their power-domain behavior.
Python
1
star
79

winDbgFixPte

Fixes WinDbg !pte command not working bug
C
1
star
80

DEXSLib

Currently, the project is being heavily refactored and is therefore in an unusable state. Android RE library for static forward and backward slicing
Java
1
star
81

fact_goblin_bindings

Goblin bindings for parsing ELF header information in FACT
Rust
1
star
82

linux-firmware-corpus

HTML
1
star