Firmware Penetration Testing

D-Link Routers - “Joel’s Backdoor” in Production

In 2013 it was discovered that D-Link routers had a hardcoded backdoor in firmware - a special User-Agent in browser gave full admin access without password. Thousands of devices worldwide were open. The backdoor had been there for years.

Without firmware testing:

• Backdoors and hardcoded credentials reach production
• Attackers can take control of customer devices
• Supply chain attack - trusted device as attack vector
• Product recall costs
• Brand reputation loss and customer lawsuits
• No control over security of supplier devices

From Firmware Extraction to Exploit

We test firmware like an attacker would - hardware hacking, reverse engineering, binary analysis. We find backdoors, hardcoded credentials, update vulnerabilities.

What you get:

• Firmware extraction from device (JTAG, UART, SPI flash) or from update file
• Decompression and filesystem unpacking (squashfs, jffs2, etc.)
• Code reverse engineering (ARM, MIPS, x86)
• Cryptography analysis (keys, certificates, algorithms)
• Backdoor and Easter egg identification
• Hardcoded credentials test (passwords, API keys)
• Update mechanism analysis (MITM, downgrade, unsigned)
• Debug port test (JTAG, UART, serial console)
• Firmware emulation and dynamic testing
• Proof of Concept for critical vulnerabilities
• Detailed report with remediation steps
• Optional fix implementation support

Who Is It For?

This service is for you if:

• You manufacture IoT devices, routers, cameras, industrial controllers
• You want to test firmware before releasing new version
• You need to verify security of supplier devices
• You’re planning acquisition and want to check code quality
• A vulnerability was found in your product and you want full security audit

Firmware Test Scope

What We Analyze

Firmware Extraction:

• Download from official sources (update files)
• Flash memory extraction (SPI, NAND)
• Dump through debug ports (JTAG, UART)
• OTA update sniffing

Static Analysis:

• Decompression and unpacking (binwalk, jefferson)
• Architecture identification (ARM, MIPS, x86, RISC-V)
• Reverse engineering (Ghidra, IDA Pro, Binary Ninja)
• Code analysis - backdoors, vulnerabilities
• Hardcoded credentials (passwords, keys, tokens)
• Cryptography analysis (weak algorithms, hardcoded keys)
• Known vulnerability search (CVE)

Hardware Analysis:

• Chip and interface identification
• Debug port testing (JTAG, UART, SWD)
• Serial console access
• Flash memory dumping
• Side-channel attacks (timing, power)

Dynamic Analysis:

• Firmware emulation (QEMU, Firmware Analysis Toolkit)
• Runtime testing and fuzzing
• Network traffic analysis
• Debug and instrumentation

Update Mechanism:

• Man-in-the-middle on update
• Unsigned updates
• Downgrade attacks
• Certificate validation

IoT Protocols:

• MQTT, CoAP, HTTP API
• Authorization and encryption
• Command injection
• Authentication bypass

Common Vulnerabilities We Find

Hardcoded Credentials

Example: root:admin123 in /etc/shadow or API_KEY="sk_live_..." in binary Impact: Anyone with device or firmware has full access Fix: Unique credentials per device, secure provisioning

Insecure Update Mechanism

Vulnerability: Updates over HTTP without signature verification Exploit: MITM injects malicious firmware, device auto-installs Impact: Mass compromise of all devices Fix: HTTPS + cryptographic signature + secure boot chain

Debug Ports Enabled

Vulnerability: UART/JTAG accessible on production device Exploit: Physical access → root shell → firmware dump → key extraction Impact: Complete device compromise, firmware extraction Fix: Disable debug ports in production, fuse protection

Command Injection in Web Interface

Vulnerability: Unsanitized input passed to system() call Endpoint: http://device/api/ping?host=8.8.8.8;cat /etc/passwd Impact: Remote code execution with root privileges Fix: Input validation, avoid shell commands, use libraries

Weak Encryption

Vulnerability: AES with hardcoded key in firmware, or weak algorithms (DES, MD5) Impact: Anyone who extracts firmware can decrypt sensitive data Fix: Per-device keys, hardware security module, modern algorithms

Tools We Use

Firmware Extraction:

• binwalk - firmware analysis and extraction
• jefferson - JFFS2 filesystem extraction
• sasquatch - SquashFS extraction
• flashrom - SPI flash reading

Reverse Engineering:

• Ghidra - free RE framework
• IDA Pro - industry standard disassembler
• Binary Ninja - modern RE platform
• Radare2 - open source RE toolkit

Hardware:

• Bus Pirate - multi-protocol interface
• SEGGER J-Link - JTAG/SWD debugger
• Logic analyzer - protocol analysis
• Oscilloscope - signal analysis

Dynamic Analysis:

• QEMU - processor emulation
• Firmware Analysis Toolkit - automated analysis
• Frida - dynamic instrumentation
• Custom scripts and harnesses

Related Glossary Terms

Learn more about key concepts related to this service:

• API
• AWS
• CVE
• Information Security Architecture
• IoT
• OT (Operational Technology)
• SSE
• SSO (Single Sign-On)