With a surge in the production of internet of things (IoT) devices, embedded development tools are becoming commonplace and the software they run on is often trusted to run in escalated modes. However, some of the embedded development tools on the market contain serious vulnerabilities that put users at risk. In this talk we discuss the various attack vectors that these embedded development tools expose users to, and why users should not blindly trust their tools. This talk will detail a variety reverse engineering, fuzzing, exploit development and protocol analysis techniques that we used to analyze and exploit the security of a common embedded debugger.
In this talk we will describe the methodology used in order to assess the security of one of the most commonly used embedded debuggers in the world. Additionally, we will describe our findings which resulted in 5 CVEs and included remote code execution flaws and an unauthenticated backdoor. We will also discuss the impact of these vulnerabilities and steps one can take to improve the security of their embedded development supply chain.