Trainings

Course Description

Students that complete the course will receive the target platform, an FPGA developer board, as well as a certificate of completion of the course.

The Toothless Consulting Hardware Hacking Training is one the world's leading courses on hardware security. The course is ideally suited for both hardware engineers who wish to better understand potential security issues that may exist in hardware implementations and software security engineers who may lack experience in analyzing hardware and embedded systems. The training teaches participants a unique hybrid hardware/software workflow that is extremely effective for identifying security issues in hardware, embedded devices, automotive and IoT (Internet of Things). Students will be familiarized with the concepts of hardware analysis and have a first-hand chance to build and instrument the analysis of hardware targets using FPGAs.

Students will implement complex algorithms in a modern high-level scripting language (python) while implementing all low-level timing critical components in hardware (Verilog HDL). This training will also cover how these techniques can be utilized for applications ranging from black box reverse-engineering of undocumented protocols to validating an overall hardware design. This training also offers a unique opportunity for students to work with real-world test and measurement equipment. Additionally, the training covers the minimal amount of electrical engineering required for instrumenting targets in practice.

As such there are no specific prerequisites for this course beyond a basic programming background. Students will be provided sufficient background and templates for the python scripting language to successfully complete the assignments. All the aspects of hardware design (FPGA development, RTL design, Verilog HDL as well as simulation and functional verification) will be covered in the course. Each day will feature one CTF (capture the flag) style assignment that will take approximately the entire day for students to solve. Each assignment will cover one common flaw that can be found in real-world hardware implementations.

Students should bring a notebook capable of running VMware Fusion, VMware Workstation or the free VMware Player.

Topics

• Common hardware vulnerabilities
• embedded device security
• IoT security
• test and measurement equipment (oscilloscopes, logic analyzers)
• JTAG, FPGA implementations
• HDL development
• core generation
• debugging
• soft cores
• glitching
• fuzzing
• Man-in-The-Middle (MITM) of protocols
• protocol injection
• hardware acceleration
• cloud FPGA platforms

4 or 5 Day Course Outline

This outline covers the standard 4 or 5-day training, the difference being the pace of the course. However customization is possible for onsite trainings. Schedule an onsite training at a location of your choice today.

Introduction

1. Theory/Basics

   • Recommended literature
   • Machine-To-Machine Communication
   • Logic 101

2. Combinatorics

   • Sequential & combinatorial logic
   • Finite State machines (FSM)
   • Logical functions & arithmetic computation
   • Logic optimization

3. Verilog 101

   • UART FSM
   • HDL equivalent for FSM
   • Testing and verification of RX/TX

4. Hardware Logic Implementation

   • Electronics 101
   • ASICs, TTL-Logic
   • FPGAs, CPLDs
   • Hard vs. Soft Macros
   • I/O, Tristates

5. FPGA/ASIC Development Workflow

   • Behavioral simulation
   • Synthesis
   • Place and Route
   • Timing simulation

6. Gotchas

   • Design constraints
   • Optimization
   • Best practices
   • Safety and electronics

Assignments

After the introduction to FPGAs, the design workflow and the tooling, students will get the opportunity to solve practical CTF style assignmnets. Each assignment takes approximately 4-6 hours to complete.

Assignment 1: FPGA Bring-Up

At the end of Day 1 students will have an opportunity to program create a design that utilizes the state machines written throughout the day. Subsequently students will load their bitstreams onto an FGPA and verify that they work. This assignment ensures that students have fully the process of simulation, synthesis and have fully understood the workflow with the FPGA tools.

Assignment 2: Basic Glitching

The goal of this assignment is to teach students that the security of the target platform can be compromised by manipulating the operating state of the target. The target is realized as a system requiring that a valid pin be entered on a pin pad for access. Students will have to identify ways in which the operating state of the device can be determined and change it accordingly.

Identify and analyze the communications protocol. Design a hardware implementation capable of brute forcing the system PIN. Identify valid triggers for the operating state of the system. Modify the hardware implementation to be able to cope with a penalty for 3 consecutive invalid PIN entries. Cope with a penalty flag hardware flag being set in Non Volatile Memory (NVM)

Assignment 3: Timing Analysis

The goal of this assignment is to familiarize students with the advantages of utilizing programmable logic platforms for their predictable timing behavior. Students must implement a hardware implementation capable of sending the target platform a password and measuring the response time.

Identify and analyze the communications protocol. Design a hardware implementation capable of sending a password and measuring the response time. Perform adaptive timing analysis against the target platform. Perform adaptive timing analysis against an optimized implementation.

Assignment 4: (Proprietary) Protocol Emulation

In this assignment, students implement and emulate the proprietary iPhone Lightning protocol. Students will learn how to develop implement and realize a proprietary protocol PHY in hardware. Students will only realize the low-level logic as a PHY in the FPGA and realize the rest of the control logic in python.

Understand the iPhone Lightning protocol. Realize a hardware protocol decoder with the FPGA. Implement a protocol analyzer capable of recording packet state. Emulate the Lightning protocol using python and the FPGA (and get an iPhone to charge from the FPGA).

Assignment 5: Bootloader Security Bypass

As seen on the blog (Part 1, Part 2, Part 3).

This assignment is designed to familiarize students with the workflow necessary for analyzing hardware targets in practice. Students will need to extract the bootloader from the device, analyze its contents, identify vulnerable instructions and glitch these instructions bypassing the protection mechanisms of the platform.

Extract the bootloader from a standard ARM microcontroller. Analyze the bootloader and identify vulnerabilities. Implement a programmable logic design capable of glitching a protected target. Glitch a protected target and extract the firmware.

Class requirements

Participants should have some familiarity with scripting languages, i.e. Python. This course is suitable for people that are new to hardware security and electronics. All the theory and concepts related to electronics, HDL and debugging will be explained during course.

What to bring

A notebook capable of running a VMware image.

Minimum software to install

VMware Player, VMware Workstation, VMware Fusion or Virtualbox.

Please ensure that your virtualization solution supports USB in the Virtual Machine.