When it comes to learning how to hack hardware and IoT devices, Yuewei Wu is well worth listening to.
Also known as ‘sunshinefactory’, Yuewei was on the winning team at SPIRITCYBER, a hardware-hacking competition organised by YesWeHack in partnership with the Cyber Security Agency of Singapore (CSA).
During the event, which featured targets ranging from military drones and industrial surveillance cameras to smart home and personal devices, she kindly took the time to answer questions from YesWeHack.
In this interview, the National University of Singapore (NUS) Information Security student, who was 21 at the time, explains her methodology for probing IoT targets, recalls how she got started in cybersecurity, compares Capture the Flag (CTF) challenges with Bug Bounty hunting, and shares advice for would-be cybersecurity professionals.
Sunshinefactory on becoming a hacker…
I actually wanted to pursue mass communication and media studies, but I decided that I was going to try something new. So I studied cybersecurity for three years, and during the three years I found love and passion for cybersecurity by playing CTFs with my friends, sharing all the different hacker knowledge with my friends, learning new vulnerabilities…
I think this really fits my personality, where I really like to find new challenges to tackle.
On Bug Bounty hunting versus competing in CTFs…
So in CTFs you are given a dedicated environment, a dedicated challenge, so you already know what kind of exploit you want to run on this certain challenge to be able to get the flag.
One challenging thing about Bug Bounty is that it’s a black-box challenge. I don’t really know what I’m going into, I’m just given a device list and they say: “Go hack it, go find vulnerabilities!”
They don’t really tell you exactly what you are looking for, so you really have to dig deep.
On choosing IoT targets…
I usually start with those that don’t really have encrypted firmware, because straight away I'm able to get to the source code and start looking for bugs and vulnerabilities already. After I’m done with all these low-hanging fruits – easy targets – then I’ll move on to try and decrypt the firmware of harder devices.
On her favourite IoT hunting tool…
I think the most essential thing for all of us is using Kali Linux. It has a wide range of tools we can use for a lot of different purposes. We need to be able to decrypt the firmware to be able to analyse the different vulnerabilities and bugs that each device contains.
My go-to is using this reverse engineering tool called IDA, which decompiles the programs and allows for us to better understand what this program is doing and be able to then find vulnerabilities from there.
On the hardware hacking skills she most wants to develop…
Reverse engineering is such an important skill to have, because you are still able to decompile the different codes through different tools, like IDA decompiler.
But after you decompile, then what’s next? If you can’t really understand what the code is saying, then you also can’t find bugs. So I think that’s one skill that I want to continue working on.
Her advice for aspiring security professionals…
There are many local communities that you can join and don’t be afraid to talk to people. I know a lot of my friends in cybersecurity are introverts, but I always tell them they should not be scared to talk to people if they really want to know more about cybersecurity in Singapore.
