Foundations of Embedded Protocol Analysis & Exploitation: A hands-οn IoT & Hardware Security Workshop

Overview

Embedded systems sit at the core of modern infrastructure, from industrial control systems and connected devices to automotive platforms and smart environments. Yet the communication protocols that link their components are often undocumented, lightly tested, and rarely analyzed from an attacker’s perspective.

 

When vulnerabilities appear in embedded and IoT systems, they rarely come from exotic zero-days. More often, they stem from exposed interfaces, weak protocol assumptions, or credentials and sensitive data flowing where they shouldn’t. Understanding how these protocols behave in real environments, and how attackers interact with them, is a critical skill for today’s security professionals.

 

To address this gap, Cyber Helmets is launching a new hands-on workshop focused on embedded protocol analysis and exploitation.

 

📅 26–27 February 2026

🕒 2pm–8pm CET

💻 Live online 

🧪 Guided hands-on labs using simulated hardware interfaces and authentic protocol traces

👉 Hands-on action with Hack The Box infrastructure and hardware-focused challenges

 

 

 


 

Why you should attend: A practical, attacker-oriented approach

Foundations of Embedded Protocol Analysis & Exploitation is a two-day, guided workshop built around how attackers actually approach embedded systems.

 

Across two intensive online sessions, participants will:

  • Work hands-on with simulated hardware targets
  • Analyze real communication captures from genuine devices
  • Step through attacker-oriented workflows
  • Apply practical exploitation techniques used in hardware security research

 

The workshop is designed to move from protocol observation and decoding to practical exploitation, helping participants build a repeatable methodology for approaching unknown embedded communication systems.

 

 


 

What participants can expect

This workshop focuses on real-world attacker workflows rather than isolated theoretical concepts. Throughout the two days, participants will:

 

  • Analyze communication behavior across embedded components
  • Identify exposed or undocumented interfaces
  • Decode protocol structures from captured traces
  • Extract credentials and sensitive data from communication flows
  • Apply practical exploitation techniques in guided lab scenarios

 

The experience is delivered through live, expert-led instruction, supported by guided hands-on labs and simulated hardware environments.

 

The workshop is also enriched with Hack The Box infrastructure and hardware-focused challenges, allowing participants to continue practicing beyond the live sessions.

 


 

Who this workshop is for

Hardware security beginners, red teamers, reverse engineers, IoT pentesters, firmware analysts, and security engineers with basic familiarity with Linux or scripting. If you’ve read about UART, SPI, or embedded interfaces but never analyzed or exploited them end-to-end, this workshop is for you.

 


 

Key takeaways

→ A deep understanding of embedded communication protocols and how they are used in hardware devices.

→ Hands-on experience analyzing embedded protocols using real-world captures and signals.

→ The ability to extract sensitive information from IoT devices through hardware-level analysis

→ Confidence in identifying and assessing hardware interfaces on embedded devices.

→ The skills to analyze real-world attacker workflows when assessing the security of IoT and embedded systems.

 

 


 

Meet the instructors

Learn directly from field experts and see how they approach real-world hardware and IoT security challenges.

 

Profile photo

Konstantinos Mokos
LinkedIn

Security researcher and Principal Cyber Security Architect
Profile photo

Ilias Fotakis
LinkedIn

Senior Content Engineer
Profile photo

Anastasios Meletlidis

Cybersecurity researcher

 

 

 


 

Join the workshop

Join us for two days of hands-on embedded protocol analysis and exploitation.

📅 26–27 February 2026

🕒 2pm–8pm CET, Live online 

👉 View full details and join us here:

 

REGISTER NOW →

SHARE:

Syllabus:

Intro to GCP

  • GCP Hierarchy
  • Google Workspace
  • gcloud config
  • Basic Hacking Techniques

Exploitation of GCP Services

  • IAM
  • KMS
  • Secrets 
  • Storage
  • Compute Instances & VPC
  • Cloud Functions
  • CloudSQL
  • Pub/Sub
  • App Engine
  • Google APIs
  • Cloud Shell

Methodologies

  • White box

Security Services

  • GCP Logging & Monitoring

Syllabus:

Intro to AWS

  • AWS Organization
  • AWS Principals
  • Basic Hacking Techniques

Exploitation of AWS Services

  • IAM
  • STS
  • KMS
  • Secrets Manager
  • S3
  • EC2 & VPC
  • Lambda
  • RDS
  • SQS
  • SNS

Methologies

  • White box

Common Detection Mechanisms

  • CloudTrail

Syllabus:

Azure Basics

  • Azure Organization
  • Entra ID
  • Azure Tokens & APIs
  • Basic Enumeration Tools

 

Exploitation of Azure Services

  • Entra ID IAM
  • Azure IAM
  • Azure Applications
  • Azure Key Vault
  • Azure Virtual Machine & Networking
  • Storage Accounts
  • Azure File Share
  • Azure Table Storage
  • Azure SQL Database
  • Azure MySQL & PostgreSQL
  • Azure CosmosDB
  • Azure App Service
  • Basic Azure Research Technique
  • Azure Function Apps
  • Static Web Apps
  • Azure Container Registry
  • Azure Container
  • Instances, Apps & Jobs
  • Azure Queue
  • Azure Service Bus
  • Azure Automation Account
  • Azure Logic Apps
  • Azure Cloud Shell
  • Azure Virtual Desktop

 

Methologies

  • White box
  • Black box
  • Pivoting between Entra ID & AD

 

Common Detection Mechanisms

  • Azure & Entra ID Logging & Monitoring
  • Microsoft Sentinel
  • Microsoft Defender for Cloud & Microsoft Defender EASM

Fundamentals and Setup

  1. Overview of Android’s architecture and ecosystem dynamics.
  2. Exploration of security features native to Android using Java, Kotlin, C++, and Rust.
  3. Mobile Application Threat Model
    a) Differences between mobile and web application threat models.
    b) Applying threat modeling techniques specifically to mobile applications.
    c) Case studies highlighting potential threats and vulnerabilities.
    d) How do we secure and test cross platform apps (e.g. ReactNative, Xamarin, etc).
  4. Introduction to industry mobile security standards
    a) OWASP Mobile Application Security (MAS) project
    b) Effective usage of the Mobile Application Security Verification Standard (MASVS).
    c) Effective usage of the Mobile Security Testing Guide (MSTG).
    d) Overview of the OWASP top 10 for mobile.
  5. Setting up and preparing a mobile security testing lab
    a) Configuration of industry-standard tools and guidance on their appropriate use.
    b) Setup of virtual mobile devices using Corellium, including its advantages.
    c) Introductory exercises to familiarize with the tools.
  6. Secure Coding Overview
    a) Exercises to identify vulnerabilities in code examples
    b) Discussion of the appropriate mechanisms for remediation
    c) Practical session on remediation and re-testing the app
  7. Secure storage
    a) Overview of application storage mechanisms.
    b) Introduction to cryptographic storage solutions on Android.

Advanced Techniques and Practical Application

  • Mobile penetration testing methodology
    a) Methodologies used in real-world scenarios with practical tips and tricks.
  • Identifying issues with backend APIs
    a) Examination of client-side trust issues.
    b) Analysis of insecure communications including certificate validation and pinning.
  • Cryptography in Android apps
    a) Utilization of Android’s Crypto APIs.
    b) Implementation of native cryptography using libraries like libnacl and OpenSSL.
    c) Management of cryptographic keys.
  • Authentication and Authorization
    a) Testing client-side authentication mechanisms, including secure usage of biometrics.
    b) Strategies to detect and bypass authentication flaws.
    c) Security measures for API authentication.
  • Android IPC
    a) Detailed exploration of Intents, deep links, Binders/services, and broadcast receivers.
  • Webviews
    a) Identifying and resolving common security issues in Android Webview configurations.
  • Software Composition Analysis (SBOM)
    a) Techniques to determine the components of an Android app.
    b) Identifying known vulnerabilities within these components.
  • Mobile Device Management (MDM)
    a) Introduction to Mobile Device Management: definition, core features, and its role in enhancing organizational security.
    b) Discussion on the benefits and practical applications of MDM in controlling and securing mobile devices across an enterprise.
  • Mobile Application Management (MAM)
    a) Overview of Mobile Application Management: what it entails and its significance in enterprise environments.
    b) Exploration of how MAM contributes to managing and securing applications specifically, detailing its utility for enterprise security strategies.

Advanced Techniques and Practical Application

  • Mobile penetration testing methodology
    a) Methodologies used in real-world scenarios with practical tips and tricks.
  • Identifying issues with backend APIs
    a) Examination of client-side trust issues.
    b) Analysis of insecure communications including App Transport Security issues & certificate pinning.
  • Cryptography in IOS apps
    a) Utilization of iOS’s CryptoKit & CommonCrypto APIs.
    b) Implementation of native cryptography using libraries like libnacl and OpenSSL.
    c) Management of cryptographic keys and leveraging the secure enclave.
  • Authentication and Authorization
    a) Testing client-side authentication mechanisms, including secure usage of Local Authentication (biometrics).
    b) Strategies to detect and bypass authentication flaws.
    c) Security measures for API authentication.
    d) Using Device Check and App Attest
  • iOS IPC
    a) Detailed exploration of URL schemes, deep (universal) links, and extensions.
  • Webviews
    a) Identifying and resolving common security issues in iOS Webview configurations.
  • Software Composition Analysis (SBOM)
    a) Techniques to determine the components of an iOS app.
    b) Identifying known vulnerabilities within these components.
  • Implementing App Integrity
    a) What to look for
    b) How to implement
  • Mobile Device Management (MDM)
    a) Introduction to Mobile Device Management: definition, core features, and its role in enhancing organizational security.
    b) Discussion on the benefits and practical applications of MDM in controlling and securing mobile devices across an enterprise.
  • Mobile Application Management (MAM)
    a) Overview of Mobile Application Management: what it entails and its significance in enterprise environments.
    b) Exploration of how MAM contributes to managing and securing applications specifically, detailing its utility for enterprise security strategies.

Fundamentals & Setup

  1. Overview of iOS’s architecture and ecosystem dynamics.
  2. Exploration of security features native to to iOS using Objective-C, Swift, and C(++).
  3. Mobile Application Threat Model
    a) Differences between mobile and web application threat models.
    b) Applying threat modeling techniques specifically to mobile applications.
    c) Case studies highlighting potential threats and vulnerabilities.
    d) How do we secure and test cross platform apps (e.g. ReactNative, Xamarin, etc).
  4. Introduction to industry mobile security standards
    a) OWASP Mobile Application Security (MAS) project
    b) Effective usage of the Mobile Application Security Verification Standard (MASVS).
    c) Effective usage of the Mobile Security Testing Guide (MSTG).
    d) Overview of the OWASP top 10 for mobile.
  5. Setting up and preparing a mobile security testing lab
    a) Configuration of industry-standard tools and guidance on their appropriate use.
    b) Setup of virtual mobile devices using Corellium, including its advantages.
    c) Introductory exercises to familiarize with the tools.
  6. Secure Coding Overview
    a) Exercises to identify vulnerabilities in iOS code examples
    b) Discussion of the appropriate mechanisms for remediation
    c) Practical session on remediation and re-testing the app
  7. Secure storage
    a) Overview of application storage mechanisms.
    b) Introduction to cryptographic storage solutions on iOS.