[FR] Smart backdooring 2.0, Paul Daher

### Overview In this presentation, Paul Daher from Digital Security details research conducted on hardware reverse engineering and smart backdooring of IoT devices, using a Bluetooth Low Energy (BLE) connected padlock as a primary case study. The talk outlines the complete methodology for auditing connected objects when starting with zero prior knowledge of the architecture or system internals. The objective is to demonstrate how an attacker with physical access (such as during supply chain interception or purchasing a second-hand device) can extract firmware via debugging interfaces, reverse-engineer proprietary firmware, and install a persistent hardware/firmware backdoor.

### Key Topics - **IoT Audit Methodology**: Inspecting packaging, user manuals, and physical hardware components; searching for reset buttons, exposed debug interfaces, and motor triggers; analyzing printed circuit board (PCB) traces and identifying chip references. - **Firmware Acquisition**: Connecting an affordable programmer/debugger (CC Debugger) to exposed programming test points to dump firmware without having source code. - **Reverse Engineering Bare-Metal Architectures**: Navigating non-standard embedded architectures (such as the 8051 variant inside the Texas Instruments CC2541), handling disassembler limitations, and manually reconstructing memory mappings and register definitions. - **Backdooring Strategies**: Identifying authentication and control logic within firmware to bypass PIN validation.

### Technical Details - **Hardware & Chipset**: The padlock features a Texas Instruments CC2541 microcontroller (2.4 GHz BLE system-on-chip) implementing an 8051-compatible architecture with 256 KB of memory, alongside an NFC chip and an internal unlocking motor. - **Firmware Extraction**: Using a CC Debugger (~20–30 euros) connected to five debugging pins identified on the PCB, the speaker extracted the firmware image in Intel HEX format and converted it to raw binary. - **Disassembly Challenges in IDA Pro**: The disassembler did not automatically recognize the specific CC2541 device, identifying only a dozen functions out of 256 KB of code and data. To resolve this, Daher spent two days manually crafting a configuration file of roughly 1,200 lines based on the datasheet, specifying interrupt tables and Special Function Registers (SFRs). - **Isolating Target Code**: Because the CC2541 handles both the BLE stack and application logic on the same core, roughly half of the firmware was BLE stack code. To locate the padlock's motor control logic, the speaker searched the datasheet for hardware mechanisms, finding references to Pulse Width Modulation (PWM) signals used to trigger the motor. Searching IDA Pro for PWM period values located the relevant motor activation code outside the BLE stack. - **Memory Banking**: The 8051 architecture uses memory banking (XDATA and code banking across up to eight 32 KB banks). Properly mapping these 32 KB code segments allowed IDA Pro to generate proper control flow graphs and relative jump instructions. - **Patching Authentication**: The speaker initially experimented with inverting conditional jumps (`0x70` / `JNZ` to `0x60` / `JZ`), which caused the correct password to fail while accepting incorrect entries. Ultimately, replacing the conditional jump `0x70 0x05` with NOP instructions (`0x00 0x00`) allowed the padlock to unlock with any PIN entered via the mobile application.

### Takeaways - **Defensive Recommendations**: Hardware manufacturers should physically solder or pot enclosures to make physical tampering immediately detectable. Furthermore, exposed programming and debugging headers/traces should be disabled or physically removed before production, and strong encryption must be enforced across all communications. - **Supply Chain & Second-Hand Risks**: Users should exercise extreme caution with second-hand connected devices or intercepted shipments, as modified firmware with a backdoor can perfectly mimic normal functionality while completely bypassing security controls.