Loudmouth Security - Offensive IoT Exploitation DCTLV2025

Name of Training: Loudmouth Security - Offensive IoT Exploitation
Trainer(s): Trainers from Loudmouth Security
Dates: August 11-12, 2025
Time: 8:00 am to 5:00 pm PT
Venue: Las Vegas Convention Center
Cost: $2,800

Course Description: 

As IoT becomes more integrated and integral into personal and work lives, there is a growing need to understand the inner workings of IoT devices and ensure these devices are secure. This course teaches security professionals and hackers how to identify and exploit security vulnerabilities in IoT devices. Participants will learn to interact with hardware debug capabilities, communicate with memory devices, and virtualize and analyze firmware. The course also covers various hardware attacks including glitching and side channel attacks, as well as diving into communications protocols, including Bluetooth, Zigbee, Thread and Matter. Participants will gain hands-on experience with industry tools and techniques. This course is suitable for security professionals, penetration testers, and hackers with basic programming and computer system knowledge, and equips them with skills to discover new vulnerabilities in IoT devices.

Course Outline: 

• Introduction to IoT and Embedded Device Hacking
  • Overview of devices & device architectures
  • What is firmware?
  • Introduction to digital signals analysis
• Interacting with Hardware Debugging Interfaces
  • Overview of hardware debugging interfaces
    • UART
    • JTAG
  • Using UART and JTAG to debug or extract firmware from devices
• Analyzing Firmware for Security Vulnerabilities
  • Extracting firmware from binary files
  • Tools for analyzing firmware, including disassemblers and debugger
  • Overview of common vulnerabilities found in IoT
  • Where to look for vulnerabilities
  • Reverse engineering firmware
  • Identifying security vulnerabilities using code analysis and fuzzing
• Communicating with Memory Devices
  • Overview of memory devices commonly used in IoT systems, such as flash memory, EEPROM, and SD cards
  • Communicating with common memory devices
    • SPI Flash
    • eMMC
  • Challenges encountered when communicating with memory devices
• Glitching and Side Channel Attacks
  • Overview of glitching and side channel attacks
  • Identifying vulnerabilities through glitching and side channel attacks
  • Tools for performing glitching and side channel attacks
• Virtualizing Firmware
  • Overview of firmware virtualization
  • Reasons for virtualizing firmware
  • Techniques for virtualizing firmware, such as emulators and hypervisors
  • Advantages and disadvantages of firmware virtualization
• Communications Protocols in Embedded Systems
  • Overview of communications protocols commonly used in IoT systems, such as Bluetooth, and Zigbee, Thread and Matter
  • Overview of application protocols such as MQTT and UPnP
  • Analyzing and reverse engineering communications protocols
  • Tools and techniques for sniffing and spoofing communications protocols

Difficulty Level:

Beginner to Intermediate. This is a compressed course and will move quickly.

Suggested Prerequisites:

Students should have:

• A willingness and desire to learn
• Understanding of common networking protocols
• Basic familiarity of virtualization technologies
• Basic familiarity of Windows and Linux
• Basic understanding of penetration testing

What Students Should Bring: 

• Laptop with 16GB RAM and at least 50GB free disk space
• External ethernet adapter
• VMware Player/Workstation/Fusion installed
• Administrator/Root access to their host Operating

Trainer(s) Bio:

The Loudmouth Security team consists of renowned security consultants and researchers with extensive experience in the cybersecurity industry. Collectively, they bring decades of expertise, with team members holding prestigious Black Badges from the IoT CTF at DEF CON 26. Several team members have been regular contributors to IoT Village and are now founders of the new Embedded Systems Village, where they continue to push the boundaries of security research.

The team excels at explaining complicated technical findings to executive management teams and has spent years mentoring younger hackers entering the field. Their teaching abilities stem from a shared passion for cybersecurity and dedication to continuous learning. They constantly seek out new information and insights, which they incorporate into their courses to provide the most up-to-date and relevant training possible.

Loudmouth Security's experts bring diverse specializations to the table. The team includes accomplished PCB designers with extensive hardware knowledge, professionals with backgrounds in IT administration for industrial and manufacturing companies, and specialists in the virtualization of embedded devices. Key team members have performed research on some of the most unusual and advanced embedded systems, discovering and disclosing significant bugs in the process.

As highly skilled trainers, the Loudmouth team is always eager to share their collective knowledge and experience, helping organizations stay ahead of the latest cyber threats.

Registration Terms and Conditions: 

Trainings are refundable before July 8, 2025, minus a non-refundable processing fee of $250.

Trainings are non-refundable after July 8, 2025.

Training tickets may be transferred. Please email us at training@defcon.org for specifics.

If a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).

Failure to attend the training without prior written notification, will be considered a no-show. No refund will be given.

By purchasing this ticket you agree to abide by the DEF CON Training Code of Conduct and the registration terms and conditions listed above.

Several breaks will be included throughout the day. Please note that food is not included.

All courses come with a certificate of completion, contingent upon attendance at all course sessions.