After spending time examining the hardware, dismantling the black box, and analyzing its secrets, we reach a decisive stage: the actual attack through the exploitation of discovered vulnerabilities. This is where theory gives way to practice and our work becomes meaningful by demonstrating concretely that identified flaws are not abstract concepts but open doors for a malicious attacker.
In this phase, the goal is clear: exploit one or more vulnerabilities to gain unauthorized access, extract sensitive data (encryption keys, secrets), modify device behavior, or even establish a persistent presence. This is proof by example, which convinces manufacturers of the severity of the flaws and gives real value to hardware penetration tests. Let’s explore some of the tools in our offensive arsenal and the most common attack paths that help us turn discoveries into successful exploits.
Exploiting Debug Interfaces: when an oversight costs dearly
One of the most classic — and dangerous — vulnerabilities involves debug interfaces such as JTAG, SWD, or UART. Used during development to control and test components, these interfaces are often mistakenly left active in production.
When not disabled or protected, they allow direct memory read/write, bypass secure boot mechanisms, and even execute arbitrary code. In short, they provide a highway into the device’s core, making exploitation or intrusion demonstration much easier.
Firmware: extracting, patching, reflashing — with risks and precautions
Another widely used method is firmware extraction, aimed at analyzing the device’s operation and identifying software vulnerabilities. Once exploitable flaws are discovered (e.g., easily breakable password checks), it is possible to extract, study, and potentially modify the firmware.
Modified firmware can be reflashed on the chip to validate the technical feasibility of an attack. However, this process is delicate and risky: improper handling may permanently brick the device, causing irreversible data loss.
Software vulnerabilities: overflows and injections
Beyond hardware, many attacks exploit common software vulnerabilities. Buffer overflows, for example, allow attackers to send malformed data via legitimate interfaces such as network ports, USB, or UART. These flaws exploit inadequate bounds checking, allowing attackers to overwrite critical memory areas to inject and execute malicious code.
These attacks are formidable because they combine software complexity with standard access vectors.
Side-channel attacks: listen without touching
Sometimes, physical access to the target is impossible or undesirable. Side-channel attacks (SCA) are then invaluable, analyzing natural “leakages” from hardware during operation.
-
Power analysis: monitoring power consumption during cryptographic operations to reveal keys.
-
Timing analysis: observing variations in instruction execution to deduce secrets.
-
Electromagnetic analysis (EM): capturing EM emissions from switching transistors to reconstruct sensitive operations.
These techniques threaten the confidentiality of even well-protected systems.
Fault Injection: forcing errors to trick the system
To bypass certain verification mechanisms, fault injection (FI) attacks create intentional physical disturbances affecting hardware behavior and code execution.
Methods include:
-
Voltage or clock glitching, temporarily disturbing power supply or clock frequency to bypass critical checks like password verification.
-
Electromagnetic fault injection (EMFI), sending targeted EM pulses to destabilize internal circuits.
-
Laser injection, highly precise but sometimes requiring physical preparation of the component for targeting.
While complex, these attacks can efficiently escalate privileges and bypass software or hardware protections.
Real-world considerations
In reality, many manufacturers protect their products: debug interfaces are locked or disabled, secure boot, encryption, and digital signature mechanisms prevent execution of modified firmware, and hardware countermeasures protect against SCA and FI attacks.
Nevertheless, on the IoT consumer market, “attack highways” still exist, though progress is being made thanks to regulations. Advanced attacks require sophisticated equipment, technical mastery, multiple device samples, and careful balance between lab precision and real-world reproducibility.
HardSploit NG: the ally in the exploitation phase
HardSploit NG aims to revolutionize the exploitation phase. Traditional methods require multiple disparate tools, complex wiring, and time-consuming manual setups. HardSploit NG centralizes and automates critical operations.
-
FPGA-based architecture adapts dynamically to audit needs.
-
Debug interface modules (JTAG/SWD/UART) accelerate exploitation without constantly recabling.
-
Firmware extraction & reflashing uses reliable communication protocols to minimize corruption risks and reproducibly validate attacks.
-
Side-channel attacks integrate measurement modules for precise capture of power or EM variations.
-
Fault injection benefits from FPGA timing precision to generate voltage or clock glitches accurately, reducing device damage risk.
HardSploit NG doesn’t replace the auditor’s expertise but amplifies capabilities, allowing focus on analysis and attack strategy while automatically documenting each exploitation step.
This dive into the exploitation phase shows how discoveries can translate into real system access, revealing concrete risks to hardware. The next post will conclude this series by covering a critical step: report writing, where technical findings meet pedagogy to turn exploitation demonstrations into actionable improvements. Stay tuned!
