You're reading from Practical Hardware Pentesting A guide to attacking embedded systems and protecting them against the most common hardware attacks

Product type Paperback

Published in Apr 2021

Publisher Packt

ISBN-13 9781789619133

Length 382 pages

Edition 1st Edition

Tools

Embedded Systems

Concepts

Embedded Systems

Author (1):

Jean-Georges Valle

View More author details

Table of Contents (20) Chapters

Preface

1. Section 1: Getting to Know the Hardware

2. Chapter 1: Setting Up Your Pentesting Lab and Ensuring Lab Safety FREE CHAPTER

3. Chapter 2: Understanding Your Target

4. Chapter 3: Identifying the Components of Your Target

5. Chapter 4: Approaching and Planning the Test

6. Section 2: Attacking the Hardware

7. Chapter 5: Our Main Attack Platform

8. Chapter 6: Sniffing and Attacking the Most Common Protocols

9. Chapter 7: Extracting and Manipulating Onboard Storage

10. Chapter 8: Attacking Wi-Fi, Bluetooth, and BLE

11. Chapter 9: Software-Defined Radio Attacks

12. Section 3: Attacking the Software

13. Chapter 10: Accessing the Debug Interfaces

14. Chapter 11: Static Reverse Engineering and Analysis

15. Chapter 12: Dynamic Reverse Engineering

16. Chapter 13: Scoring and Reporting Your Vulnerabilities

17. Chapter 14: Wrapping It Up – Mitigations and Good Practices

18. Assessments

19. Other Books You May Enjoy

Practical case

Let's have a look at a DSL modem (an ABB 560NM that I bought from my local flea market) that is sporting a JTAG connector. If you can't find the same modem, you will have to find a random piece of hardware with a JTAG connector. This will be a very good exercise in locating them.

Opening the case and going through the chip, I could easily identify the main CPU as a Samsung S3C4530A (the markings have not been removed; it is a big chip with Samsung and ARM markings and SC4530A is pretty visible). A bit of internet research scores the datasheet for this chip. It is sold as an "Integrated system for embedded Ethernet applications" and that fits the bill pretty nicely for a DSL modem. The datasheet is inside the ch10 folder of the repository.

Next to it, there is an already populated 10-pin connector that is not connected to anything on the system. It smells like JTAG!

Here, I can approach it in two ways: