Embedded Linux device bughunting

Presented at Disobey 2023, Feb. 17, 2023, 2:45 p.m. (60 minutes).

A walkthrough of the audit procedure of an embedded Linux device, in this case an IP camera created by Uniview, showcasing a range of (RCE) bugs and describing how to get started reviewing / auditing / hacking devices like this.

Presenters:

• Knud Hojgaard - Senior security consultant at Fraktal
  Knud works at Fraktal.fi in the exciting field of information security. Interests and focus areas span wide, from lock manipulation and covert entry to vulnerability discovery and exploit development, usually focused on traversing trust boundaries one way or another. He enjoys popping shells and stealing corporate secrets, with permission naturally.

Links:

• https://disobey.fi/2023/profile/embedded_linux_device_bughunting

Similar Presentations:

• DEF CON 21 (2013) / GoPro or GTFO: A Tale of Reversing an Embedded System
• ShmooCon XIV (2018) / Embedded Device Vulnerability Analysis Case Study Using TROMMEL
• Black Hat Europe 2021 / Achieving Linux Kernel Code Execution Through a Malicious USB Device