Facebook-f Twitter Youtube Linkedin
Cart

Red Team Exercises for IoT Security [HITB+ CYBERWEEK 2021]

$2,299.00

REGISTER

Duration

2 days

Delivery Method

virtual

Level

intermediate

Seats Available

20

Duration

2 days

Delivery Method

virtual

Level

intermediate

ATTEND ONLINE: Virtual via Zoom

DATE: 22-23 November 2021

TIME: 09:00 to 17:00 GST/GMT+4

Date Day Time Duration
22 November Monday 09:00 to 17:00 GST/GMT+4 8 Hours
23 November Tuesday 09:00 to 17:00 GST/GMT+4 8 Hours

 

Today’s Internet of Things (IoT) market is developing rapidly, and presents the security community with a difficult challenge.  How do you monitor or limit the dangers that IoT devices can bring to the workplace (and at home), while recognizing the explosion in the market of products to include:  kitchen gadgets, watches, web cameras, smart televisions, smart speakers (Alexa, Google Home), Wi-Fi routers, to all forms of consumer and hospital-grade medical devices/equipment, from the “connected car,” and onto Smart Cities and Smart Factories (Industry 4.0).  

Basically, if it has an on/off switch, either a consumer or the business wants to give it an IP address, and connect it with other devices or the Internet for monitoring, advertising or the promise of “ easier management.”  IoT devices have become an indispensable part of people’s lives, but its threat to your personal/business data, and privacy will continue to grow.

The reality is that IoT devices are here to stay, and their threat will only grow as the line between working from home or at the office continues to blend together.  In addition, the threat IoT devices bring to systems that cannot be traditionally monitored, lateral movement after an attack, and the dangers that ransomware also brings to a business means that gaining control of the threat of IoT is something that cannot be ignored.

This course will explain the concept and architecture of IoT devices, and then jump into legit “in the wild” / real hacking techniques and analysis used against real targets.  We will also review the real world exploit, as a framework for how these security issues start through development, so that students can get a glimpse of the world of IoT security.

There are a lot of hands- on Lab exercises in this course, which is very suitable for students who want to be taught by hand, and will foster learning from within the course and hands-on instruction, as well as working at home or in your home lab.

Agenda

  • IoT Ecosystem Overview and Attack Vectors

    • What is IoT? • Exploring OWASP IoT Top 10 • Introduce Attack Vector of IoT devices • Experience and Analyze MQTT protocol (Lab)

  • ARM Exploitation (Lab)

    • Tool Introduction • Basic ARM Exploitation • Exploit Mitigation Techniques • Bypass Mitigation

  • Analyzing and Exploiting IoT Firmware (Many Labs)

    • Firmware Analysis Process Overview • Common Firmware Analysis (Static and Dynamic) • Encrypted Firmware Analysis (Static and Dynamic) • Fix Hardware Dependency

  • Analyzing IoT Malware and Botnet (Lab)

    • Analyze and Compile IoT Malware • Build IoT Botnet

  • Analyzing Car Protocol attacking (Lab)

    • Attack Vectors Analysis on Car • Build Car Simulation • Cat Attack Exercise

  • Introduction of Hardware and Radio Frequency Penetration Testing

    • Hardware Penetration Testing Overview • Exploit Hardware Debug Ports • Radio Frequency Penetration Testing Overview • Demos

Why You Should Take This Course

As the world of IoT, Enterprise IT security (IT)  and Operational Technology (OT) / Critical infrastructure blend together, the trends and threats that IoT brings are here to stay.  This is not meant to instill fear or doubt, but about looking at the reality of how security events are happening, beyond the scope of phishing attacks and end-users accidentally clicking on “bad links.” IoT security knowledge and implementation technology is the trend of the Internet of Everything era.  In this course, you can explore various IoT Security-related technologies from the shallower to the deeper, and after this course, the students will be better prepared to not only understand the primary risks around IoT, but also have a starter framework and hands-on ability to put what they’ve learned into practice at both their home and job.

Who Should Attend

  • Blue Team members to understand the threats of IoT, and Red Team members to exploit their weaknesses
  • Network / Security Operations Center personnel looking to better understand the IoT threat
  • Penetration tester for IoT Security
  • Security researcher and consultant interested in IoT Security
  • Developers want to build IoT Security Knowledge which help to create more secure products
  • Anyone who interested in IoT Security
  • Risk management personnel that want to understand the risks IoT devices bring to both the working from home and within an office environment

Key Learning Objectives

  • Build IoT Hacking Foundations

  • Comparing the x86 and ARM-based IoT frameworks

  • Get ARM Exploitation and Bypass Mitigation Techniques

  • Familiar with How to Use Reverse Engineering (Ghidra) and Dynamic Analysis Tools

  • Learn How to Analyze Common IoT Firmwares

  • Learn How to Analyze Encrypted IoT Firmwares

  • Get the Skills to Fix Hardware Dependency

  • Learn the Knowledge about IoT Malware

  • Experience of IoT Botnet Hand on

  • Car Attack Vectors and Protocol attacking

  • Hardware and Radio Frequency Penetration Testing Concept

    • Prerequisite Knowledge

    Trainees should have a working knowledge of TCP/IP and a basic knowledge of the Windows and Linux command lines.

    Hardware / Software Requirements

    • The course is expected to provide 2 VMs (OVA files), 50 GB free space of hard disk and 8GB of memory are minimum)
    • Attendees will need VMware Player or Workstation, VMware Fusion as your virtual machine environment

    Your Instructor

    No data was found

    HACK IN THE BOX LIMITED

    Masdar City, United Arab Emirates