Hardware Hacking Training

Hands-On Hardware Security Training

Request a quote for an onsite training

Course Description

Students that complete the course will receive the target platform, an FPGA developer board, as well as a certificate of completion of the course.

Dmitry Nedospasov’s Hardware Hacking Training is one the world’s leading courses on hardware security. The course is ideally suited for both hardware engineers who wish to better understand potential security issues that may exist in hardware implementations and software security engineers who may lack experience in analyzing hardware and embedded systems. The training teaches participants a unique hybrid hardware/software workflow that is extremely effective for identifying security issues in hardware, embedded devices, automotive and IoT (Internet of Things). Students will be familiarized with the concepts of hardware analysis and have a first-hand chance to build and instrument the analysis of hardware targets using FPGAs.

Students will implement complex algorithms in a modern high-level scripting language (python) while implementing all low-level timing critical components in hardware (Verilog HDL). This training will also cover how these techniques can be utilized for applications ranging from black box reverse-engineering of undocumented protocols to validating an overall hardware design. This training also offers a unique opportunity for students to work with real-world test and measurement equipment. Additionally, the training covers the minimal amount of electrical engineering required for instrumenting targets in practice.

As such there are no specific prerequisites for this course beyond a basic programming background. Students will be provided sufficient background and templates for the python scripting language to successfully complete the assignments. All the aspects of hardware design (FPGA development, RTL design, Verilog HDL as well as simulation and functional verification) will be covered in the course. Each day will feature one CTF (capture the flag) style assignment that will take approximately the entire day for students to solve. Each assignment will cover one common flaw that can be found in real-world hardware implementations.

Students should bring a notebook capable of running VMware Fusion, VMware Workstation or the free VMware Player.

Topics Covered During the Course

Common hardware vulnerabilities, embedded device security, IoT security, test and measurement equipment (oscilloscopes, logic analyzers), JTAG, FPGA implementations, HDL development, core generation, debugging, soft cores, glitching, fuzzing, Man-in-The-Middle (MITM) of protocols, protocol injection, hardware acceleration, cloud FPGA platforms.

Course Outline

Day 1: Introduction

  1. Theory/Basics
    • Recommended literature
    • Machine-To-Machine Communication
    • Logic 101
  2. Combinatorics
    • Sequential & combinatorial logic
    • Finite State machines (FSM)
    • Logical functions & arithmetic computation
    • Logic optimization
  3. Verilog 101
    • UART FSM
    • HDL equivalent for FSM
    • Testing and verification of RX/TX
  4. Hardware Logic Implementation
    • Electronics 101
    • ASICs, TTL-Logic
    • FPGAs, CPLDs
    • Hard vs. Soft Macros
    • I/O, Tristates
  5. FPGA/ASIC Development Workflow
    • Behavioral simulation
    • Synthesis
    • Place and Route
    • Timing simulation
  6. Gotchas
    • Design constraints
    • Optimization
    • Best practices
    • Safety and electronics

Day 1 assignment: FPGA bring up

At the end of Day 1 students will have an opportunity to program create a design that utilizes the state machines written throughout the day. Subsequently students will load their bitstreams onto an FGPA and verify that they work. This assignment ensures that students have fully the process of simulation, synthesis and have fully understood the workflow with the FPGA tools.

Day 2 assignment: Invalid protocol states

The goal of this assignment is to familiarize students with the hardware analysis techniques required for performing the assignments. Students will have to analyze the target platform and subsequently identify and understand the communications protocol. The protocol will require students to design a hardware implementation capable of decoding the communication in real time and injecting malicious data.

Identify and analyze the communications protocol. Design a hardware implementation capable of reading/injecting data. Implement a Denial of Service (DoS) attack against the protocol. Perform a replay attack against the protocol. Cope with an obfuscated protocol implementation.

Day 3 assignment: Basic Glitching

The goal of this assignment is to teach students that the security of the target platform can be compromised by manipulating the operating state of the target. The target is realized as a system requiring that a valid pin be entered on a pin pad for access. Students will have to identify ways in which the operating state of the device can be determined and change it accordingly.

Identify and analyze the communications protocol. Design a hardware implementation capable of brute forcing the system PIN. Identify valid triggers for the operating state of the system. Modify the hardware implementation to be able to cope with a penalty for 3 consecutive invalid PIN entries. Cope with a penalty flag hardware flag being set in Non Volatile Memory (NVM)

Day 4 assignment: Timing analysis

The goal of this assignment is to familiarize students with the advantages of utilizing programmable logic platforms for their predictable timing behavior. Students must implement a hardware implementation capable of sending the target platform a password and measuring the response time.

Identify and analyze the communications protocol. Design a hardware implementation capable of sending a password and measuring the response time. Perform adaptive timing analysis against the target platform. Perform adaptive timing analysis against an optimized implementation.

Day 5 assignment: Bootloader Bypass

This assignment is designed to familiarize students with the workflow necessary for analyzing hardware targets in practice. Students will need to extract the bootloader from the device, analyze its contents, identify vulnerable instructions and glitch these instructions bypassing the protection mechanisms of the platform.

Extract the bootloader from a standard ARM microcontroller. Analyze the bootloader and identify vulnerabilities. Implement a programmable logic design capable of glitching a protected target. Glitch a protected target and extract the firmware.

Class requirements

Participants should have some familiarity with scripting languages, i.e. Python. This course is suitable for people that are new to hardware security and electronics. All the theory and concepts related to electronics, HDL and debugging will be explained during course.

What to bring

A notebook capable of running a VMware image.

Minimum software to install

VMware Player, VMware Workstation, VMware Fusion or Virtualbox.

Please ensure that your virtualization solution supports USB in the Virtual Machine.

About the trainer

See our About page.