Raiders of the Lost Firmware - A Hands On Workshop in IoT Firmware Archaeology

The talk starts from a common obstacle in IoT research: firmware that is encrypted, so it cannot be inspected. Breaking the cryptography or dumping flash from hardware are both costly and risky, so the presenters describe an alternative they call firmware archaeology. It collects traces a vendor leaves in public places, such as archived web pages, developer documentation and container images, and uses them to work out how the device's protection changed over time.

Applied to a commercial IP camera vendor, the team found an older firmware image that carried both the previous and the newer encryption schemes. They pulled the relevant decryption functions out of the binaries and ran only those routines under QEMU in a minimal setup. This recovered the firmware and the installed applications without reimplementing the vendor's cryptography. The decrypted apps then exposed manifests and interfaces that could be mapped as an attack surface.

The main takeaways are to map public exposure before reversing, to reuse vendor routines where the context allows, and to keep a person in control when using AI tools, which can take wrong paths or shortcut validation. The speakers reported vulnerabilities that were still under coordinated disclosure, so they did not give details. They said a toolset and a hands-on session would follow.