IoT Security Testing and Exploitation Framework

Welcome to OWASP Bay Area's YouTube!

Enjoy these amazing talks from August meetups by OWASP Bay Area. For more details about past and upcoming meetups, visit the Meetup page: https://www.meetup.com/Bay-Area-OWASP

To contribute to Hacker Thursday as a speaker or would like to host us, email us at owaspht[at]gmail[dot].com
------------------------------

After working on IoT security testing for a few years, we realized that there is a lot of time spent on learning and setting up different tools including hardware, radio and software. As the IoT technology is new there are no standard software to test most of the components and the tools available are either not mature yet or do only specific job. With this problem at hand we envisioned a software that would allow developers and researchers to automate most of the IoT security testing steps. We began our journey with writing a flexible and extendable framework that would help the community and us in writing quick IoT test cases and exploits.
The objectives of the framework are:
1. Easy of use
2. Extendable
3. Support for hardware, radio and IoT protocol analysis

We have released the alpha version of the framework recently -https://gitlab.com/expliot_framework/expliot
The beta release is envisioned to have support for UART(serial), ZigBee, BLE, MQTT, CoAP (next version will have support for JTAG, I2C and SPI) and few miscellaneous test cases, exploits. This workshop would give attendees a first hand view of the functionality, how to use it and how to write plugins to extend the framework.

Speaker Bio
Aseem Jakhar is the Director R&D at Payatu Software Labs LLP, a boutique security testing organization with specialization in IoT, embedded, mobile and cloud security. He is a speaker and trainer at international security conferences like Blackhat, Hack in Paris, Brucon, Hack in the box, Defcon, Zer0con, PHDays to name a few. He is also an open source developer and has written various open source security projects including - Indroid/Jugaad - Runtime Thread injection toolkit for Arm/x86, Dexfuzzer - A dumb fuzzer for dex files, DIVA Android - Damn Insecure and Vulnerable App for Android and Expliot framework.
Sources:
- Expliot (Ruby) - https://bitbucket.org/aseemjakhar/expliot_framework
- DIVA Android - https://github.com/payatu/diva-android
- Indroid - https://bitbucket.org/aseemjakhar/indroid
- Jugaad - https://bitbucket.org/aseemjakhar/jugaad
- Dexfuzzer - https://bitbucket.org/aseemjakhar/dexfuzzer/src

Regards,
Aseem Jakhar
Co-Founder/Director, Research, Payatu Software Labs http://payatu.com
Co-Founder: null - The open security community http://null.co.in
nullcon Security Conference http://nullcon.net
hardwear.io - Hardware Security Conference http://hardwear.io