Hi there, welcome back to this course. In this lesson, i'll talk about exploitation of I2C communication
protocols of Iot devices.
I2C stands for Inter-Integrated Circuit, invented in 1982 by Philips Semiconductors, known
today as NXP Semiconductors. Is a Synchronous Serial Bus Protocol, (Multi Master, Multi Slave),
used for short distance intra-board data communications between lower-speed peripheral of integrated
circuits and processor/microcontrollers.
Let's see some possible applications of the I2C communication protocol. It is used, for example,
for data storage
via EEPROM, (electrical erasable, programmable read only memory), for accessing low speed DACs
That is a Digital to Analog Converter or for Analog to Digital Converters, for controlling small OLED or LCD
displays, for turning on and off the power supply of system components.
These are just some possible applications of I2C technology.
Regarding the method of data transmission, I2C can only send or receive data at the given point
of time, thus allowing an half-duplex communication.
The image shows a printed circuit related to an analog to digital converter with I2C interface.
I2C needs just two wires to enable the data exchange: a Serial Data line (SDA) and a Serial
Clock line (SCL). Typical voltages used are five volts or three point three volts.
They image shows a schematic of an I2C Master in connection with three slaves, where it is assumed
that the master is a microcontroller and the slaves are an ADC, a DAC and an additional microcontroller.
Let's see the operating speed categories of I2C. For a bidirectional bus communication are possible
four operating speeds
categories. A standard mode with a bitrate up to 100 kilobits per second, a fast mode, fast
mode plus, high speed mode with a bit rate up to three point four megabits per second.
Ultra fast-mode with a bit rate
up to five megabits per second.
For those wishing to further explore the technical and operational specifications of the I2C protocol,
it is possible to directly consult some technical manuals from NXP Semiconductors website, as you
can see in the slide.
Attack scenarios to I2C, let's see, which could be, first of all, sniffing the communication
between an I2C device and the controller/processor, or patching the data in the I2C EEPROM
memory, causing a malfunction of the device, and modifying the frequency of the I2C Clock's
signal, an attack known as a clock glitching attack.
And this can lead, for example, to an abnormal execution of applications running on the device.
Now let's see the steps to follow, to verify the safety of the I2C interface with respect,
for example, the possibility of extracting data directly from an EEPROM memory via the I2C interface.
The first step is to identify I2C pinouts, in particular, the SCL and SDA pinouts of the EEPROM.
And for this could be useful to fetch the datasheet of the I2C EEPROM chip.
The next step is to connect the I2C pinouts to PC via a USB TTL converter interface, for example,
the Attify badge, BusPirate, etc. There are two ways to connect the I2C pinouts, to the USB
TTL converter:
1) You can unsolder the I2C EEPROM from the printed circuit board and insert it into an adapter
suitable for the EEPROM packaging,
or 2) you can directly connect the I2C EEPROM pinouts to the USB TTL converter using SOIC clips
without unsoldering
the EEPROM.
And here we can see a schematic connection of the EEPROM of an Iot device connected to an analysis PC
through an Attify badge interface.
then
you can proceed with the exploitation steps by establishing a connection between the PC and the
Iot device through the chosen connection interface, launching an appropriate connection program
from the PC to read and write data, such as the python script
i2ceeprom.py, downloadable as a project from GitHub.
So if the data is not securely managed on the device, an attacker can read it or manipulate it.
OK, thank you for your kind attention.