Hardware pentesting 101: UART, JTAG and your firmware's worst day

Your product shipped with a circuit board inside, and that board keeps secrets: firmware images, API keys, manufacturing credentials, the private key that signs updates. Hardware pentesting is the discipline of asking one question. If we bought your device on the open market, what could we read?

The bench comes first

Every engagement starts the same way: device on the table, enclosure opened, and a magnified look at the board. We photograph, map and identify the chips: the main MCU or SoC, external flash, debug headers or test pads left by the engineers who developed it. Those test pads are the story of every hardware hack.

UART: the forgotten console

UART is a two-wire serial console that developers use during bring-up. It is supposed to be disabled in production. In a remarkable share of shipped devices it is not, wired to accessible pads, spitting out a boot log that includes a root shell. Finding an open UART with a logic analyzer is the hello world of hardware pentesting, and it still works embarrassingly often.

JTAG: the debug interface that trusts you

JTAG is the deeper interface: hardware-level debugging that can halt the CPU and inspect memory. Locked JTAG stops casual attackers; improperly locked JTAG, which is common, stops nobody. When lock bits are misconfigured, firmware can be dumped directly from a running device.

SPI and external flash: reading the source of truth

When debug interfaces are closed, external SPI flash often is not. Clip on, read the chip, and the full firmware image comes off the board: filesystem, credentials, certificates. From there it is a software exercise in reverse engineering, diffing against older versions to find what changed and what secrets persisted.

Radios: attacking the air

BLE, Zigbee, Wi-Fi and NFC each carry their own classic failures: pairing that can be replayed, tokens that never rotate, debug services left advertising. Radio attacks scale differently because they need no physical access, only proximity.

Five fixes that stop most bench attacks

• Disable UART and JTAG in production, and verify on shipped units, not dev boards
• Enable flash encryption and secure boot, and test the failure paths
• Never bake uniform secrets into firmware images
• Provision unique credentials at manufacture instead
• Commission a hardware pentest before mass production, when fixes cost a firmware patch instead of a recall

The cheapest moment to fix hardware security is before the first production run. The most expensive is after someone else demonstrates the bug.

We run hardware engagements exactly this way: bench, interfaces, firmware, radios. If you ship a connected product, read about our hardware practice or book a scope call with the findings you want and the deadline you have.