IoT Security Training by TechMaker [HITB+ CYBERWEEK 2021]



2 days

Delivery Method




Seats Available



2 days

Delivery Method





ATTEND IN-PERSON: Onsite in Abu Dhabi

ATTEND ONLINE: Virtual via Zoom and Discord

DATE: 22-23 November 2021

TIME: 09:00 to 17:00 GST/GMT+4

Date Day Time Duration
22 November Monday 09:00 to 17:00 GST/GMT+4 8 Hours
23 November Tuesday 09:00 to 17:00 GST/GMT+4 8 Hours


You will be using your HITB Badge as an IoT hacking doll and

you’ll be able to pump your skills by solving over a dozen specially crafted CTF-like challenges!

Online attendees on Nov 22-23 will be present via Zoom and Discord but will not have a practical part of training. HITB Badge and additional hardware will be shipped to online attendees after all registrations are confirmed. A separate single day online session with hardware practice will be scheduled in the second half of December as soon as all attendees confirm their mail package received.

Microcontrollers and embedded devices are all around us. Cheap hardware has many integrated basic communication methods, including access to the Internet. At the same time, there are almost no built-in security features in most microcontrollers to protect code from reverse engineering, cloning, finding hardcoded keys and accessing backend API endpoints that device uses.

During this two day training we are going to discuss threat model of IoT devices with backend interaction. Our examples are based on STM32 and ESP32 microcontrollers, SDR demonstrations are done with bladeRF 2.0.

TechMaker’s blog:


  • Day 1

    1. What is a microcontroller? 2. Comparing architectures and toolchains 3. Hardware interfaces: I2C, SPI, UART, USB, CANbus 4. How to read PCBA and find valuable stuff 5. Analysing digital data 6. JTAG, bootloaders, secure boot, root of trust, FUSEs 7. Wireless connectivity. Threat model, attack vectors 8. Device to backend connection architecture: MQTT, HTTPS, TLS

  • Day 2

    9. Intercepting wired data 10. Intercepting wireless data 11. Reverse engineering binary firmware obtained from debug interface or OTA update 12. Analysing backend infrastructure: anubis -> gobuster, Firefox + Burp + sqlmap 13. Expert topics. Side-channel attacks, ChipWhisperer 14. Expert topics. Using SDR and blank SIM cards to capture 4G traffic

Why You Should Take This Course


Who Should Attend

  • CISO, system architects and project leads to better understand IoT cybersecurity risks and threat models
  • Penetration testers and embedded engineers hoping to learn more about IoT hacking and how to secure your code and hardware
  • Bug bounty hunters who wants to start working on hardware/IoT projects

Key Learning Objectives

  • Analyze attack surface and create threat model of IoT devices

  • Audit an existing device on vulnerabilities in device architecture, firmware and hardware design

  • Analyze RF signals and decode data payload

  • Proactively participate in cybersecurity decision-making when designing a new IoT device

  • Conduct pentesting on IoT projects based on MCUs (ARM Cortex-M, ARM Cortex-A, xTensa, RISC-V)
  • Prerequisite Knowledge

    • Basic UNIX/Linux knowledge
    • Basic Understanding of computer architecture
    • Feel free to contact us and discuss what you need to read/learn before the training begins

    Hardware / Software Requirements

    • Laptop with macOS or Linux-based OS
    • ESP-IDF, esptool
    • GHIDRA, radare2, Cutter + Rizin
    • Firefox
    • sigrok + PulseView
    • Universal Radio Hacker
    • Burp
    • Gobuster
    • Sqlmap
    • Anubis
    • bettercap + compatible WIFI adapter (built-in or USB). Compatible == supports monitor mode

    Your Instructor

    No data was found