June 4, 2026/
How to locate and read the bootloader in a raw flash dump with binwalk, strings, and dd, and what it...
- All Posts
- Cryptography
- Firmware
- Hardware
- Industry
- Learning
- Pen Testing
- Protocols
- Secure Boot
- Secure Development
- Side-Channel
- Threat Modeling
- Tutorials
- Back
- STM32
June 4, 2026/
Beyond surviving a glitch, a device can notice it is being attacked. Here is how runtime fault detection works and...
June 4, 2026/
You cannot stop a glitch, but you can make one insufficient. Here are the firmware patterns that survive fault injection.
June 4, 2026/
A comparison that returns early leaks how much of a secret you got right. Here is how timing attacks work...
June 4, 2026/
A chip radiates information as it computes. Here is how electromagnetic side-channel analysis works and why it can be easier...
June 4, 2026/
Clock glitching corrupts an instruction by feeding the chip a malformed clock edge. Here is how it differs from voltage...
June 4, 2026/
AES is strong, but the way it is used on microcontrollers often is not. Here are the implementation mistakes that...
June 4, 2026/
Per-device keys only help if they are generated safely. Here is how provisioning works at manufacturing and the pitfalls to...
June 4, 2026/
A single key shared across every unit turns one compromise into a fleet-wide breach. Here is why per-device keys matter...
June 4, 2026/
A device is only as secure as the place it keeps its keys. Here is a tour of common key...
June 4, 2026/
Disabling debug ports hardens a device but can block legitimate repair. Here is how to lock down without painting yourself...
June 4, 2026/
Secure boot and measured boot sound similar but do different jobs. Here is how they differ, how each works, and...
June 4, 2026/
One-time-programmable fuses turn security features on permanently. Here is what they protect and why shipping with them unblown is a...
June 4, 2026/
The Bus Pirate is a cheap multi-protocol tool for poking at unknown buses. Here is how it speeds up the...
June 4, 2026/
Older and higher-performance designs use parallel memory buses. Here is what makes them harder to tap than serial flash and...
June 4, 2026/
Before you can attack a board you have to know what is on it. Here is how to identify the...
June 4, 2026/
A locked JTAG port is not always a closed one. Here is how physical access is used to re-open disabled...
June 4, 2026/
A datasheet is a map of where a chip's secrets live. Here is how to read one with an attacker's...
June 4, 2026/
When a bootloader console is reachable over UART, you often do not need a chip clip at all. Here is...
June 4, 2026/
Encrypting firmware feels like the finish line, but the key has to live somewhere. Here is why encryption alone rarely...
June 4, 2026/
When a vendor ships a quiet security fix, diffing two firmware versions reveals exactly what changed. Here is how to...
June 4, 2026/
Many devices speak a custom binary protocol over serial or the network. Here is a method for decoding one from...
June 4, 2026/
Before a connected product ships, a security checklist catches the issues that are expensive to fix later. Here is the...
June 4, 2026/
Embedded C is powerful and unforgiving. Here are the recurring vulnerability patterns to look for when reviewing embedded firmware code.
June 4, 2026/
Security bolted on at the end is expensive and incomplete. Here is how to build it into the firmware development...
June 4, 2026/
IEC 62443 is the standard for industrial security, but meeting it on real embedded hardware takes interpretation. Here is how...
June 4, 2026/
When embedded devices cannot defend themselves, the network has to. Here is how segmentation protects fragile OT and embedded systems.
June 4, 2026/
STM32 chips offer real secure boot features, but only if you configure them. Here is what protects you, what is...
June 4, 2026/
Not every hidden access path is malicious, but every one is a risk. Here is how to find debug hooks...
June 4, 2026/
UDS gives powerful access to a vehicle's ECUs by design. Here is how that diagnostic protocol becomes an attack surface...
June 4, 2026/
PLCs run physical processes and were never designed for a hostile network. Here is how firmware tampering threatens them and...
June 4, 2026/
An implantable device cannot be patched easily and lives inside a person. Here is how threat modeling has to adapt...
June 4, 2026/
Medical device security carries stakes most products do not: patient safety. Here is how testing differs and what regulators now...
June 4, 2026/
Keyless entry is convenient and a rich attack surface. Here is how relay, replay, and rolling-code attacks work against modern...
June 4, 2026/
Getting onto a device is one thing; staying there across reboots and updates is another. Here is how persistence works...
June 4, 2026/
A start-to-finish look at how an embedded penetration test goes, from first contact with the board to a root shell...
June 4, 2026/
A finding nobody fixes is wasted work. Here is how to write a hardware penetration test report that engineers act...
June 4, 2026/
A good hardware pen test starts with good scope. Here is how to define what gets tested, how deeply, and...
June 4, 2026/
A connected device's cloud API is part of its attack surface. Here is how to test it from the device's...
June 4, 2026/
An attack tree breaks a goal into the steps an attacker would take. Here is how to build one for...
June 4, 2026/
Many RF remotes send the same code every time, which makes replay trivial. Here is how replay attacks work and...
June 4, 2026/
Security that is not written down does not get built. Here is how to turn a threat model into requirements...
June 4, 2026/
The OWASP IoT testing guidance gives a shared structure for assessing connected devices. Here is how to apply it to...
June 4, 2026/
The cheapest time to fix a security flaw is before the board exists. Here is why threat modeling belongs in...
June 4, 2026/
Not every finding deserves equal attention. Here is how to rank embedded vulnerabilities so you fix the ones that matter...
June 4, 2026/
A connected product's attack surface spans hardware, firmware, radios, and the cloud. Here is how to map all of it...
June 4, 2026/
Ad-hoc probing finds some bugs. A repeatable plan finds them consistently. Here is the structure of a hardware security test...
June 4, 2026/
Most attacks happen where trust changes hands. Here is how to find and harden the trust boundaries in a connected...
June 4, 2026/
A foothold on an embedded Linux device is rarely root at first. Here are the privilege-escalation paths that are common...
June 2, 2026/
How to use nmap to map a connected product's attack surface without crashing fragile embedded TCP stacks. A field guide...
June 2, 2026/
How Zigbee security fails when devices join with the default link key, recovering the network key from a capture, and...
June 2, 2026/
How to test IoT Wi-Fi security, capturing a handshake and cracking a weak default passphrase offline, and why the LAN...
June 2, 2026/
How voltage glitching and fault injection make a chip skip a security check, bypassing secure boot, and the defenses that...
June 2, 2026/
Why the USB port is a pre-auth attack surface on embedded devices, from exposed gadgets to parser bugs, and how...
June 2, 2026/
How UPnP and SSDP expose connected products, opening firewall ports and leaking device details, and how to reduce the exposure.
June 2, 2026/
How to threat model an IoT product with STRIDE, finding design flaws before a line of code is written, and...
June 2, 2026/
How a TPM binds secrets to a known-good boot state on embedded Linux, with sealed storage, measured boot, and attestation.
June 2, 2026/
How to test TLS certificate validation on embedded clients by intercepting their traffic, and why encryption without validation fails.
June 2, 2026/
How sniffing I2C and SPI buses reveals EEPROM contents, command traffic, and keys, and why secrets must never cross a...
June 2, 2026/
How to secure over-the-air firmware updates with signed manifests, rollback protection, and TLS, the three controls you must have.
June 2, 2026/
How embedded secure boot builds a chain of trust, how to prove it rejects tampering, and why rollback protection is...
June 2, 2026/
How to reverse engineer firmware with Ghidra, pivoting from strings and cross-references to the decompiled logic and hidden backdoors.
June 2, 2026/
How weak random number generation silently breaks keys and nonces on embedded devices, how to audit entropy, and how to...
June 2, 2026/
How RFID access control fails when badges use broken MIFARE Classic, demonstrated with a Proxmark3, and the move to modern...
June 2, 2026/
How a secure element like the ATECC608 protects device keys by generating them on-chip so a firmware dump yields nothing...
June 2, 2026/
How power side-channel analysis with ChipWhisperer recovers an AES key from a chip's power draw, and the constant-time defenses against...
June 2, 2026/
How Modbus security fails on a modern network, reading and writing a PLC with no authentication, and the segmentation that...
June 2, 2026/
How one trusting MQTT broker exposes and controls an entire IoT fleet, and the per-device auth and topic ACLs that...
June 2, 2026/
How LoRaWAN security is undermined by static ABP keys and ignored frame counters, and how OTAA with unique keys fixes...
June 2, 2026/
How to harden U-Boot for production by locking the console, requiring verified boot, and protecting the environment before a product...
June 2, 2026/
How to harden a FreeRTOS application with the MPU port, stack overflow detection, and unprivileged tasks so one bug cannot...
June 2, 2026/
How to harden an embedded Linux userland with BusyBox and Dropbear, dropping privilege and shrinking what a foothold can reach.
June 2, 2026/
How to fuzz embedded network protocols with boofuzz to find parser crashes and memory bugs before a malformed packet does...
June 2, 2026/
How to extract and analyze firmware with binwalk, identify and carve the filesystem, and spot encryption with an entropy scan.
June 2, 2026/
How to find JTAG and SWD debug ports on a board, what they expose, and why enabling readout protection before...
June 2, 2026/
How to hunt hardcoded secrets in firmware, from grep to verified secret scanners, and how to keep keys out of...
June 2, 2026/
The embedded exploit mitigations that matter, from stack canaries to MPU isolation, and how to confirm they are active on...
June 2, 2026/
How to emulate firmware with QEMU to test a device's services at scale without the hardware, with snapshots and a...
June 2, 2026/
How to dump eMMC and NAND flash from embedded Linux devices, verify the image, and why data at rest must...
June 2, 2026/
How to dump SPI flash off the board with a clip and flashrom to extract firmware, and why secrets must...
June 2, 2026/
Why IoT default credentials remain one of the most damaging weaknesses, how Mirai exploited them, and how to design the...
June 2, 2026/
How to decode UART, SPI, and I2C with a logic analyzer and sigrok, turning wiggling wires into readable protocol traffic...
June 2, 2026/
How DNS rebinding turns a browser into a foothold on local IoT devices, why it works, and how to make...
June 2, 2026/
How command injection in IoT web interfaces turns a diagnostics field into a root shell, where it hides, and how...
June 2, 2026/
How to assess CoAP security on constrained IoT devices, enumerate resources, and why unauthenticated writable resources are a remote control.
June 2, 2026/
How CAN bus security fails, sniffing and injecting frames with can-utils, and the segmentation and message authentication that defend it.
June 2, 2026/
Why stack buffer overflows still hand attackers full control on microcontrollers, how the crash looks, and the mitigations that stop...
June 2, 2026/
How to test a BLE device, from scanning to writing the GATT characteristic that unlocks it, and why the radio...
June 2, 2026/
How attackers find a UART serial console on an embedded device and turn it into an unauthenticated root shell, plus...
June 2, 2026/
How ARM TrustZone splits a chip into secure and normal worlds, where Trusted Execution Environments break, and how to keep...
June 2, 2026/
Nmap for Embedded and IoT Pen Testing: A Field Guide If you cannot see what a device is exposing, you...
May 26, 2026/
Intro to STM32 Lesson 5: DAC/PWM Time Required: 30 Minutes This tutorial introduces the digital-to-analog converter (DAC) and Pulse Width...
January 7, 2025/
Intro to STM32 Lesson 4: ADC/DMA Time Required: 30 Minutes This tutorial introduces the analog-to-digital converter (ADC) as well as...
January 6, 2025/
Intro to STM32 Lesson 3: USART Time Required: 20 Minutes This tutorial goes through the steps for establishing a RS232...
January 6, 2025/
Intro to STM32 Lesson 2: GPIO Time Required: 30 Minutes This tutorial goes through the steps for blinking an LED...
January 6, 2025/
Intro to STM32 Lesson 1: Setup Time Required: 45 Minutes Prerequisites Before Starting Computer with Windows 7 or later, OSX,...
Older PostsNewer Posts