SBOMs the Hard Way: Hacking Bob the Minion
Demonstrates hardware disassembly, SPI flash extraction, and JTAG interfacing to build an accurate Software Bill of Materials for an IoT Wi-Fi router.
Summary
Challenges in Generating Hardware SBOMs
Generating an accurate Software Bill of Materials (SBOM) for consumer IoT equipment typically requires access to vendor firmware packages. When manufacturers withhold firmware releases, conventional software analysis tools cannot be applied.
Hardware Disassembly and Chip Identification
Analyzing the Davolink 'Bob the Minion' Wi-Fi router began with complete physical disassembly, component inspection, and pinout identification across circuit boards.
SPI Flash Extraction and JTAG Debugging
Physical extraction techniques, including desoldering SPI flash memory and tapping JTAG/SWD debug interfaces, enabled direct binary dumps of the device's running firmware.
Constructing the SBOM and Reporting Vulnerabilities
Decompiling and inspecting the extracted firmware binaries produced a comprehensive software inventory, revealing unpatched component vulnerabilities that were reported to the vendor.
Related talks
Creator Stage·43 min
Zoltan Balazs
Surveys pervasive architectural and implementation failures in consumer IoT gadgets, highlighting cleartext credentials, command injections, and insecure defaults.
Creator Stage·54 min
Andrew Bellini
Provides a beginner-friendly methodology and budget hardware toolkit guide for disassembling, extracting firmware, and hacking IoT devices.
Creator Stage·28 min
Justin Mott · Ava Petersen
Documents finding nine zero-day vulnerabilities in Vilo consumer home routers through UART interfacing, firmware reversing, and protocol analysis.