🔧

Hardware / IoT

Hardware and IoT challenges involve extracting, analysing, and exploiting firmware from embedded devices — reading debug interfaces like UART and JTAG, reversing proprietary protocols, and manipulating signals with logic analysers.

What is it?

Hardware and IoT security deals with the security of physical devices — routers, smart home gadgets, industrial controllers, medical devices, and custom embedded systems. Attackers target these devices through debug ports left enabled, unencrypted firmware update mechanisms, insecure bootloaders, and hard-coded credentials.

It blends electronics knowledge (serial protocols, PCB reading, soldering) with software RE (firmware extraction, MIPS/ARM binary analysis) and network security (exposing management APIs).

How it works in a CTF

In a CTF, hardware challenges usually provide a firmware image (.bin file), a logic analyser capture (.sal, .csv), or a description of a physical setup. Your goal is to extract a flag by analysing the firmware filesystem, reversing a binary, decoding a captured serial conversation, or exploiting a hardcoded credential.

Common workflow: run binwalk -e firmware.bin → explore the extracted filesystem → search for credentials and keys → reverse interesting binaries with Ghidra → or decode protocol capture with Sigrok.

Example challenge types

Binwalk extract filesystem from .binHard-coded root password in /etc/shadowUART console gives root shellDecrypt firmware update (AES key in binary)Logic analyser capture decode (UART/I²C/SPI)JTAG debug port code executionWeb interface command injection (router)Private key in firmware filesystemInsecure bootloader bypassMQTT broker unauthenticated subscribeOTA update replay attackExposed JTAG test pads on PCB

Sample Challenge

FirmwareFrenzy

Hardware Medium 250 pts

You receive a 4 MB binary dump from a consumer IoT router: router_fw.bin. The vendor claims the firmware is encrypted, but the security team suspects the flag is stored in plain text inside the filesystem.

router_fw.bin

How to solve it

Run binwalk router_fw.bin — it detects a SquashFS filesystem at offset 0x50000 and a LZMA-compressed kernel.
Extract: binwalk -e router_fw.bin — a directory _router_fw.bin.extracted/ appears.
Run firmwalker _router_fw.bin.extracted/ — it highlights /etc/config/system as containing a password.
Open the file — it contains: option flag 'FLAG{b1nwalk_squashfs_4_th3_w1n}'.

FLAG{b1nwalk_squashfs_4_th3_w1n}