Attify Badge IoT Hacking Device Usage - Revision history

LPutz at 15:15, 31 March 2023

2023-03-31T15:15:35Z

← Older revision		Revision as of 15:15, 31 March 2023
Line 3:		Line 3:
	The Attify Badge uses an FTDI chip that can speak a wide variety of communication protocols and standards such as UART, SPI, I2C, 1-Wire and JTAG. This way one can interact with any IoT / embedded device for which one or more hardware communication ports are available. It supports both 3.3V and 5V, making it suitable for a large number of target devices. You don't need any special connection wires or cables to use the Attify Badge, but the standard Dupont jumper wires (also included in all Attify Badges). Attify Badge has a micro-USB port that allows it to be easily connected to your PC using a micro-USB cable. This is also included when you order an Attify Badge.		The Attify Badge uses an FTDI chip that can speak a wide variety of communication protocols and standards such as UART, SPI, I2C, 1-Wire and JTAG. This way one can interact with any IoT / embedded device for which one or more hardware communication ports are available. It supports both 3.3V and 5V, making it suitable for a large number of target devices. You don't need any special connection wires or cables to use the Attify Badge, but the standard Dupont jumper wires (also included in all Attify Badges). Attify Badge has a micro-USB port that allows it to be easily connected to your PC using a micro-USB cable. This is also included when you order an Attify Badge.

	== ~~Firmware~~ ==		== Usage Attify Badge Tool https://github.com/attify/attify-badge-tool ==
	~~Firmware is software that is embedded in electronic devices and performs basic functions there. It occupies an intermediate position between hardware (i.e.~~ the ~~physical components~~ of ~~a device) and~~ the ~~application software (~~the ~~possibly exchangeable programs of a~~ device). It is mostly stored in a flash memory, an EPROM, EEPROM or ROM and cannot be exchanged by the user or can only be exchanged with special means or functions. The term is derived from the fact that firmware is functionally permanently connected to the hardware, which means that one cannot be used without the other.		=== UART ===
			Connect the Pins of the Attify Badge to the UART-device:

	~~Firmware is both~~ the ~~operating software of various devices or components~~ (e.g. ~~mobile phone, game~~ console~~, remote control, hard drive, printer) and~~ the ~~basic software of a computer~~ (e.g. the ~~BIOS anchored in a flash memory in personal computers)~~, ~~which is necessary~~ to ~~load and operate~~ the ~~operating system kernel of the actual operating system~~		{\| class="wikitable"
	== Usage ==		\|- style="font-weight:bold;"
			! Attify Badge
			! UART-device
			\|-
			\| D0 (TXD)
			\| RX
			\|-
			\| D1 (RXD)
			\| TX
			\|-
			\| GND
			\| GND
			\|}
			Run the following commands to install and start the Attify Badge Tool (Attify Serial Console)
			git clone https://github.com/attify/attify-badge-tool
			cd attify-badge-tool
			pip3 install -r requirements.txt
			python3 serial-console.py

			Set the serial port (e.g. COM6) and the baud rate and the click on connect.
			After that, you are connected to the UART.

			== Usage old Attify Badge Tool (deprecated) https://github.com/attify/attify-badge ==
	The Attify Badge Tool consists of 5 main modules that correspond to the 5 protocols supported by the Attify Badge:		The Attify Badge Tool consists of 5 main modules that correspond to the 5 protocols supported by the Attify Badge:
	<ul>		<ul>
Line 17:		Line 40:
	</ul>		</ul>
	If the target device you want to test or exploit has one of these interfaces, Attify Badge should be the tool of choice for this purpose.		If the target device you want to test or exploit has one of these interfaces, Attify Badge should be the tool of choice for this purpose.
	== Exploit by UART ==		=== Exploit by UART ===

	Register the external USB device connected to the system and add it to the combo box at the top left of the user interface.		Register the external USB device connected to the system and add it to the combo box at the top left of the user interface.
Line 25:		Line 48:
	Once you have selected the desired baud rate, press Enter to connect to the device. the data received from the UART device will be displayed in a black console window. You can use the input fields below it to interact with the device. In the combo box at the bottom right, you can select the line termination for each line you want to send to the device.		Once you have selected the desired baud rate, press Enter to connect to the device. the data received from the UART device will be displayed in a black console window. You can use the input fields below it to interact with the device. In the combo box at the bottom right, you can select the line termination for each line you want to send to the device.

	== Exploit by SPI ==		=== Exploit by SPI ===

	''Allows users to detect, read, write and erase SPI based memory of the target device connected to the Attify Badge.''		''Allows users to detect, read, write and erase SPI based memory of the target device connected to the Attify Badge.''
Line 33:		Line 56:
	For read/write commands, enter the path of the file where the data will be saved or read. An example of a path is ~/files/firmware.bin.		For read/write commands, enter the path of the file where the data will be saved or read. An example of a path is ~/files/firmware.bin.

	== Exploit by JTAG ==		=== Exploit by JTAG ===
	Select the appropriate configuration file for the target device. (Custom configuration files can be placed directly in the cfg/ directory.)		Select the appropriate configuration file for the target device. (Custom configuration files can be placed directly in the cfg/ directory.)

Line 44:		Line 67:
	''This will start a gdb session for the tool to analyze.''		''This will start a gdb session for the tool to analyze.''

	== Exploit by I²C ==		=== Exploit by I²C ===
	''The I2C module can be used to find I2C devices and to read, write and erase the contents of I2C EEPROMs connected to the badge.''		''The I2C module can be used to find I2C devices and to read, write and erase the contents of I2C EEPROMs connected to the badge.''

	To do so, simply select the action you want from the drop-down menu, enter the file path if necessary, and click the "Run" button.		To do so, simply select the action you want from the drop-down menu, enter the file path if necessary, and click the "Run" button.

	== Exploit by GPIO ==		=== Exploit by GPIO ===

	'''Output Mode:'''		'''Output Mode:'''

LPutz at 14:32, 31 March 2023

2023-03-31T14:32:21Z

← Older revision		Revision as of 14:32, 31 March 2023
Line 1:		Line 1:
	== Description ==		== Description ==
	The [[Attify Badge IoT Hacking Device]] is a hardware security assessment tool created by Attify that is used to communicate between a PC and an embedded device using various hardware communication protocols. The device was initially built to aid in pentests for IoT devices, but the immense potential was soon recognized. The Attify Badge uses an FTDI chip that can speak a wide variety of communication protocols and standards such as UART, SPI, I2C, 1-Wire and JTAG. This way one can interact with any IoT / embedded device for which one or more hardware communication ports are available. It supports both 3.3V and 5V, making it suitable for a large number of target devices. You don't need any special connection wires or cables to use the Attify Badge, but the standard Dupont jumper wires (also included in all Attify Badges). Attify Badge has a micro-USB port that allows it to be easily connected to your PC using a micro-USB cable. This is also included when you order an Attify Badge.		The [[Attify Badge IoT Hacking Device]] is a hardware security assessment tool created by Attify that is used to communicate between a PC and an embedded device using various hardware communication protocols. The device was initially built to aid in pentests for IoT devices, but the immense potential was soon recognized.
	The Attify Badge uses an FTDI chip that can speak a wide variety of communication protocols and standards such as UART, SPI, I2C, 1-Wire and JTAG. This way one can interact with any IoT / embedded device for which one or more hardware communication ports are available. It supports both 3.3V and 5V, making it suitable for a large number of target devices.		The Attify Badge uses an FTDI chip that can speak a wide variety of communication protocols and standards such as UART, SPI, I2C, 1-Wire and JTAG. This way one can interact with any IoT / embedded device for which one or more hardware communication ports are available. It supports both 3.3V and 5V, making it suitable for a large number of target devices. You don't need any special connection wires or cables to use the Attify Badge, but the standard Dupont jumper wires (also included in all Attify Badges). Attify Badge has a micro-USB port that allows it to be easily connected to your PC using a micro-USB cable. This is also included when you order an Attify Badge.
	You don't need any special connection wires or cables to use the Attify Badge, but the standard Dupont jumper wires (also included in all Attify Badges). Attify Badge has a micro-USB port that allows it to be easily connected to your PC using a micro-USB cable. This is also included when you order an Attify Badge.
	== Firmware ==		== Firmware ==
	Firmware is software that is embedded in electronic devices and performs basic functions there. It occupies an intermediate position between hardware (i.e. the physical components of a device) and the application software (the possibly exchangeable programs of a device). It is mostly stored in a flash memory, an EPROM, EEPROM or ROM and cannot be exchanged by the user or can only be exchanged with special means or functions. The term is derived from the fact that firmware is functionally permanently connected to the hardware, which means that one cannot be used without the other.		Firmware is software that is embedded in electronic devices and performs basic functions there. It occupies an intermediate position between hardware (i.e. the physical components of a device) and the application software (the possibly exchangeable programs of a device). It is mostly stored in a flash memory, an EPROM, EEPROM or ROM and cannot be exchanged by the user or can only be exchanged with special means or functions. The term is derived from the fact that firmware is functionally permanently connected to the hardware, which means that one cannot be used without the other.

LPutz: LPutz moved page Attify Badge IoT Hacking Device Description to Attify Badge IoT Hacking Device Usage: contains more usage than description

2023-03-31T14:31:34Z

LPutz moved page Attify Badge IoT Hacking Device Description to Attify Badge IoT Hacking Device Usage: contains more usage than description

← Older revision	Revision as of 14:31, 31 March 2023
(No difference)

MAERehim at 10:05, 5 January 2022

2022-01-05T10:05:46Z

← Older revision		Revision as of 10:05, 5 January 2022
Line 74:		Line 74:
	<li>and many more</li>		<li>and many more</li>
	</ul>		</ul>

			== References ==
			https://blog.attify.com/hack-iot-devices-embedded-exploitation/

			https://github.com/attify/attify-badge-tool

	[[Category:Pentesting]]		[[Category:Pentesting]]

MAERehim at 21:32, 21 December 2021

2021-12-21T21:32:40Z

@@ Line 17: / Line 17: @@
 </ul>
 If the target device you want to test or exploit has one of these interfaces, Attify Badge should be the tool of choice for this purpose.
 == What's possible ==
 With the help of UART communication you can get a serial root access to the target system, you can get debugging logs, U-Boot access and boot logs. It is also possible to save firmware, API keys or other confidential information stored on the flash chip via SPI or I2C. You can also write your own firmware to the device using Flash Write or perform JTAG debugging with OpenOCD and GDB.

JOppitz at 16:29, 21 December 2020

2020-12-21T16:29:49Z

← Older revision		Revision as of 16:29, 21 December 2020
Line 1:		Line 1:
	== Description ==		== Description ==
	The Attify Badge is a hardware security assessment tool created by Attify that is used to communicate between a PC and an embedded device using various hardware communication protocols. The device was initially built to aid in pentests for IoT devices, but the immense potential was soon recognized. The Attify Badge uses an FTDI chip that can speak a wide variety of communication protocols and standards such as UART, SPI, I2C, 1-Wire and JTAG. This way one can interact with any IoT / embedded device for which one or more hardware communication ports are available. It supports both 3.3V and 5V, making it suitable for a large number of target devices. You don't need any special connection wires or cables to use the Attify Badge, but the standard Dupont jumper wires (also included in all Attify Badges). Attify Badge has a micro-USB port that allows it to be easily connected to your PC using a micro-USB cable. This is also included when you order an Attify Badge.		The [[Attify Badge IoT Hacking Device]] is a hardware security assessment tool created by Attify that is used to communicate between a PC and an embedded device using various hardware communication protocols. The device was initially built to aid in pentests for IoT devices, but the immense potential was soon recognized. The Attify Badge uses an FTDI chip that can speak a wide variety of communication protocols and standards such as UART, SPI, I2C, 1-Wire and JTAG. This way one can interact with any IoT / embedded device for which one or more hardware communication ports are available. It supports both 3.3V and 5V, making it suitable for a large number of target devices. You don't need any special connection wires or cables to use the Attify Badge, but the standard Dupont jumper wires (also included in all Attify Badges). Attify Badge has a micro-USB port that allows it to be easily connected to your PC using a micro-USB cable. This is also included when you order an Attify Badge.
	The Attify Badge uses an FTDI chip that can speak a wide variety of communication protocols and standards such as UART, SPI, I2C, 1-Wire and JTAG. This way one can interact with any IoT / embedded device for which one or more hardware communication ports are available. It supports both 3.3V and 5V, making it suitable for a large number of target devices.		The Attify Badge uses an FTDI chip that can speak a wide variety of communication protocols and standards such as UART, SPI, I2C, 1-Wire and JTAG. This way one can interact with any IoT / embedded device for which one or more hardware communication ports are available. It supports both 3.3V and 5V, making it suitable for a large number of target devices.
	You don't need any special connection wires or cables to use the Attify Badge, but the standard Dupont jumper wires (also included in all Attify Badges). Attify Badge has a micro-USB port that allows it to be easily connected to your PC using a micro-USB cable. This is also included when you order an Attify Badge.		You don't need any special connection wires or cables to use the Attify Badge, but the standard Dupont jumper wires (also included in all Attify Badges). Attify Badge has a micro-USB port that allows it to be easily connected to your PC using a micro-USB cable. This is also included when you order an Attify Badge.

JOppitz at 16:28, 21 December 2020

2020-12-21T16:28:43Z

← Older revision		Revision as of 16:28, 21 December 2020
Line 30:		Line 30:
	<li>and many more</li>		<li>and many more</li>
	</ul>		</ul>

			[[Category:Pentesting]]

JOppitz: Created page with "== Description == The Attify Badge is a hardware security assessment tool created by Attify that is used to communicate between a PC and an embedded device using various hardw..."

2020-12-21T16:24:00Z

Created page with "== Description == The Attify Badge is a hardware security assessment tool created by Attify that is used to communicate between a PC and an embedded device using various hardw..."

New page

== Description ==
The Attify Badge is a hardware security assessment tool created by Attify that is used to communicate between a PC and an embedded device using various hardware communication protocols. The device was initially built to aid in pentests for IoT devices, but the immense potential was soon recognized. The Attify Badge uses an FTDI chip that can speak a wide variety of communication protocols and standards such as UART, SPI, I2C, 1-Wire and JTAG. This way one can interact with any IoT / embedded device for which one or more hardware communication ports are available. It supports both 3.3V and 5V, making it suitable for a large number of target devices. You don't need any special connection wires or cables to use the Attify Badge, but the standard Dupont jumper wires (also included in all Attify Badges). Attify Badge has a micro-USB port that allows it to be easily connected to your PC using a micro-USB cable. This is also included when you order an Attify Badge.
The Attify Badge uses an FTDI chip that can speak a wide variety of communication protocols and standards such as UART, SPI, I2C, 1-Wire and JTAG. This way one can interact with any IoT / embedded device for which one or more hardware communication ports are available. It supports both 3.3V and 5V, making it suitable for a large number of target devices.
You don't need any special connection wires or cables to use the Attify Badge, but the standard Dupont jumper wires (also included in all Attify Badges). Attify Badge has a micro-USB port that allows it to be easily connected to your PC using a micro-USB cable. This is also included when you order an Attify Badge.
== Firmware ==
Firmware is software that is embedded in electronic devices and performs basic functions there. It occupies an intermediate position between hardware (i.e. the physical components of a device) and the application software (the possibly exchangeable programs of a device). It is mostly stored in a flash memory, an EPROM, EEPROM or ROM and cannot be exchanged by the user or can only be exchanged with special means or functions. The term is derived from the fact that firmware is functionally permanently connected to the hardware, which means that one cannot be used without the other.

Firmware is both the operating software of various devices or components (e.g. mobile phone, game console, remote control, hard drive, printer) and the basic software of a computer (e.g. the BIOS anchored in a flash memory in personal computers), which is necessary to load and operate the operating system kernel of the actual operating system
== Usage ==
The Attify Badge Tool consists of 5 main modules that correspond to the 5 protocols supported by the Attify Badge:
<ul>
<li>UART</li>
<li>SPI</li>
<li>JTAG</li>
<li>I2C</li>
<li>GPIO</li>
</ul>
If the target device you want to test or exploit has one of these interfaces, Attify Badge should be the tool of choice for this purpose.
== What's possible ==
With the help of UART communication you can get a serial root access to the target system, you can get debugging logs, U-Boot access and boot logs. It is also possible to save firmware, API keys or other confidential information stored on the flash chip via SPI or I2C. You can also write your own firmware to the device using Flash Write or perform JTAG debugging with OpenOCD and GDB.
Attify provides several tutorials on its own website and also sells its own [https://blog.attify.com/hack-iot-devices-embedded-exploitation/ IoT Exploitation Learning Kit], which is not affordable for every hobby pentester is. They also provide a [https://github.com/attify/attify-badge GitHub Repository] with sample code.

== IoT Vulnerabilities ==
Nowadays, IoT devices are everywhere, including at home, e.g. To be able to control lamps or the heating with the mobile phone. However, many of these devices are very unsafe because for a long time no value was placed on the security of these things. Weak points are for example:
<ul>
<li>Weak, easy to guess, or hard-coded passwords. Often the standard passwords are simply used.</li>
<li>Insecure network services</li>
<li>Lack of a secure update mechanism</li>
<li>Insecure data transmission and storage</li>
<li>and many more</li>
</ul>