Awesome Embedded & IoT Security

What it is

A curated list from Fraunhofer FKIE (CC0-style dedication, contributions accepted) covering embedded and IoT security. The page gives its own reading order: beginners start with the Books and Case Studies sections, and anyone who wants to analyze a device immediately starts with the Analysis Frameworks. It marks commercial products with a 💶 symbol. The Mirai botnet is the stated motivation.

Picking tools from it

The one-line descriptions on the page help narrow the choice:

• Firmware analysis, static: FACT extracts firmware, runs plug-ins and compares firmware versions. emba targets Linux-based firmware. cwe_checker finds vulnerable patterns in ELF binaries for x86, ARM and MIPS, with experimental bare-metal support. Firmwalker and Trommel search extracted images for interesting files.
• Firmware analysis, dynamic and CI: Firmadyne emulates and pentests a firmware. FwAnalyzer checks firmware against customized rules and is meant as a DevSecOps step, similar to CI. Firmware Slap uses concolic analysis and function clustering.
• Reverse engineering: Ghidra handles arbitrary binaries only if the CPU architecture and endianness are supplied. Radare2 offers an extensive command-line toolset.
• Extraction: Binwalk, FACT Extractor (detects the container format automatically), Firmware Mod Kit, SRecord (EPROM format conversion), flashrom and dumpflash (NAND dumps).
• Debug ports: JTAGULATOR finds JTAG pinouts. Bus Blaster, Bus Pirate and Shikra detect and talk to UART and JTAG. JTAGenum adds JTAG to an Arduino, and OpenOCD handles on-chip debugging. Saleae and Ikalogic are the commercial logic analyzers, as is J-Link.
• Protocol-specific: Killerbee for ZigBee and 802.15.4, PRET for printers, Cotopaxi for IoT network protocols, Routersploit and EXPLIoT as exploit frameworks.

Radio hardware ranges

The page gives frequency coverage, which decides what a device can reach:

• RTL-SDR: receive only, 500 kHz to 1.75 GHz.
• HackRF One: 1 MHz to 6 GHz, half-duplex.
• LimeSDR: 100 kHz to 3.8 GHz, full-duplex.
• BladeRF 2.0: 47 MHz to 6 GHz, full-duplex.
• USRP B Series: 70 MHz to 6 GHz, full-duplex.
• YardStick One: sub-1 GHz, half-duplex.
• Proxmark 3 RDV4: 125 kHz to 13.56 MHz RFID.

Caveats

• The Atmel RZUSBstick (Killerbee compatible) is noted as discontinued. ApiMote is the listed Killerbee-compatible alternative.
• ChipWhisperer is described only as detecting glitch and side-channel attacks. The page gives no usage detail.
• The list holds links and one-line descriptions only. It has no commands, versions or benchmarks, and it does not rank tools against each other.
• The books run from 2013 to 2020 and the papers from 2013 to 2020, so newer work is not covered. The conference section lists only Hardwear.io (The Hague in September, Santa Clara in June).
• Two items carry a 📺 mark as conference talks: the FACT talk and "Deadly Sins Of Development".

Case studies and practice targets

Write-ups include the D-Link DWR-932B and DIR-850L, the DSP-W215, the Huawei HG533, Xerox printers, Linksys "encryption", the PS4, and dumping SPI flash with a Bus Pirate. For practice, the list names IoTGoat (deliberately insecure OpenWrt firmware), Microcorruption, the CSAW 2019 Embedded Security Challenge, and Riscure's Rhme 2015, 2016 and 2017/2018 hardware CTFs.