v33ru/awesome-connected-things-sec모든 연결된 사물을 위한 엄선된 보안 리소스 목록
# Awesome Connected Things Security [](https://awesome.re)
IoT, 임베디드, 산업용 및 자동차 시스템을 위한 보안 연구 및 익스플로잇 기법.
<p align="center">
<a href="https://github.com/V33RU/awesome-connected-things-sec">
<img src="https://assets.kitploit.com/production/public/readmes/48362/e2bdf22a796f2bdbfac266212c1887ee624b3bdffb853ca5b2484dd1357cde77.png" width="900"/>
</a>
</p>
<p align="center">
<img src="https://img.shields.io/github/stars/V33RU/awesome-connected-things-sec?style=flat-square&logo=github&label=Stars&color=gold"/>
<img src="https://img.shields.io/github/forks/V33RU/awesome-connected-things-sec?style=flat-square&logo=git&label=Forks&color=blue"/>
<img src="https://img.shields.io/github/last-commit/V33RU/awesome-connected-things-sec?style=flat-square&label=Updated&color=red"/>
<img src="https://img.shields.io/badge/Resources-900+-blueviolet?style=flat-square"/>
</p>
<p align="center">
<img src="https://readme-typing-svg.demolab.com?font=Fira+Code&weight=600&size=22&pause=1000&color=58A6FF%C2%A2er=true&vCenter=true&random=false&width=600&lines=Firmware+%E2%80%A2+Wireless+%E2%80%A2+Hardware+%E2%80%A2+Protocols;UART+%E2%86%92+JTAG+%E2%86%92+SWD+%E2%86%92+Firmware+%E2%86%92+Root;Hack+The+Planet,+One+Device+At+A+Time" alt="Typing SVG" />
</p>
<br/>
<p align="center">
<a href="https://github.com/V33RU/awesome-connected-things-sec/blob/main/docs/ICS/Industrial-Control-Systems.md"><img src="https://img.shields.io/badge/%F0%9F%8F%AD_ICS-SCADA_&_OT-ff6b6b?style=for-the-badge"/></a>
<a href="https://github.com/V33RU/awesome-connected-things-sec/blob/main/docs/Automotive/automotive-security.md"><img src="https://img.shields.io/badge/%F0%9F%9A%97_AUTO-CAN_&_ECU-4ecdc4?style=for-the-badge"/></a>
<a href="https://github.com/V33RU/awesome-connected-things-sec/blob/main/docs/Robotics/robotics-security.md"><img src="https://img.shields.io/badge/%F0%9F%A4%96_ROBOTICS-ROS_&_DDS-8b5cf6?style=for-the-badge"/></a>
<a href="https://github.com/V33RU/awesome-connected-things-sec/blob/main/docs/awesome-collection.md"><img src="https://img.shields.io/badge/%F0%9F%93%9A_AWESOME-COLLECTION-a855f7?style=for-the-badge"/></a>
<a href="https://github.com/V33RU/awesome-connected-things-sec/blob/main/contributing.md"><img src="https://img.shields.io/badge/%F0%9F%A4%9D_CONTRIBUTE-JOIN_US-f59e0b?style=for-the-badge"/></a>
</p>
<br/>
<p align="center">
<a href="#hardware-attacks"><img src="https://img.shields.io/badge/%E2%9A%A1_Hardware-Hacking-dc2626?style=flat-square"/></a>
<a href="#bluetooth--ble"><img src="https://img.shields.io/badge/%F0%9F%93%B6_Bluetooth-BLE-2563eb?style=flat-square"/></a>
<a href="#firmware-security"><img src="https://img.shields.io/badge/%F0%9F%92%BE_Firmware-Analysis-16a34a?style=flat-square"/></a>
<a href="#wireless-protocols"><img src="https://img.shields.io/badge/%F0%9F%93%A1_Wireless-Protocols-9333ea?style=flat-square"/></a>
<a href="#tools"><img src="https://img.shields.io/badge/%F0%9F%9B%A0%EF%B8%8F_Tools-Arsenal-ea580c?style=flat-square"/></a>
<a href="#labs-and-ctfs"><img src="https://img.shields.io/badge/%F0%9F%8E%AE_Labs-CTFs-0891b2?style=flat-square"/></a>
</p>
<br/>
<p align="center">
<a href="https://t.me/iotsrg"><img src="https://img.shields.io/badge/Telegram-26A5E4?style=for-the-badge&logo=telegram&logoColor=white"/></a>
<a href="https://discord.gg/EH9dxT9"><img src="https://img.shields.io/badge/Discord-5865F2?style=for-the-badge&logo=discord&logoColor=white"/></a>
<a href="https://twitter.com/v33riot"><img src="https://img.shields.io/badge/Twitter-1DA1F2?style=for-the-badge&logo=twitter&logoColor=white"/></a>
<a href="https://www.linkedin.com/in/veeraiot"><img src="https://img.shields.io/badge/LinkedIn-0A66C2?style=for-the-badge&logo=linkedin&logoColor=white"/></a>
</p>
---
## 목차
- [하드웨어 공격](#hardware-attacks)
- [기초](#fundamentals)
- [인터페이스 공격](#interface-attacks)
- [메모리 추출](#memory-extraction)
- [부채널 및 결함 주입](#side-channel-and-fault-injection)
- [PCIe 및 DMA 공격](#pcie-and-dma-attacks)
- [무선 프로토콜](#wireless-protocols)
- [RF 기초](#rf-fundamentals)
- [Bluetooth / BLE](#bluetooth--ble)
- [Zigbee / Z-Wave](#zigbee--z-wave)
- [LoRa / LoRaWAN](#lora--lorawan)
- [Matter / Thread](#matter--thread)
- [셀룰러 (GSM/LTE/5G)](#cellular-gsmlte5g)
- [NFC/RFID](#nfcrfid)
- [DECT (디지털 강화 무선 통신)](#dect-digital-enhanced-cordless-telecommunications)
- [Wi-Fi](#wi-fi)
- [USB](#usb)
- [UWB (초광대역)](#uwb-ultra-wideband)
- [TETRA](#tetra)
- [펌웨어 보안](#firmware-security)
- [기초](#fundamentals-1)
- [추출](#extraction)
- [정적 분석 도구](#static-analysis-tools)
- [동적 분석 및 에뮬레이션](#dynamic-analysis-and-emulation)
- [OTA 업데이트 보안](#ota-update-security)
- [RTOS 보안](#rtos-security)
- [리버스 엔지니어링 도구](#reverse-engineering-tools)
- [온라인 어셈블러](#online-assemblers)
- [ARM 익스플로잇](#arm-exploitation)
- [바이너리 분석](#binary-analysis)
- [보안 부팅](#secure-boot)
- [UEFI 보안](#uefi-security)
- [심볼릭 링크 공격](#symlink-attacks)
- [라우터 펌웨어 분석](#router-firmware-analysis)
- [라우터 익스플로잇](#router-exploitation)
- [보안 부팅 우회](#secure-boot-bypasses)
- [네트워크 및 웹 프로토콜](#network-and-web-protocols)
- [MQTT](#mqtt)
- [CoAP](#coap)
- [mTLS](#mtls)
- [IoT 프로토콜 개요](#iot-protocols-overview)
- [클라우드 및 백엔드 보안](#cloud-and-backend-security)
- [AWS IoT 보안](#aws-iot-security)
- [Firebase / 클라우드 설정 오류](#firebase--cloud-misconfigurations)
- [모바일 애플리케이션 보안](#mobile-application-security)
- [Android](#android)
- [iOS](#ios)
- [산업 및 자동차](#industrial-and-automotive)
- [ICS/SCADA](#icsscada)
- [자동차 보안](#automotive-security)
- [EV 충전기](#ev-chargers)
- [결제 시스템](#payment-systems)
- [ATM 해킹](#atm-hacking)
- [Payment Village](#payment-village)
- [도구](#tools)
- [하드웨어 도구](#hardware-tools)
- [소프트웨어 도구](#software-tools)
- [퍼징 도구](#fuzzing-tools)
- [펜테스팅 운영 체제](#pentesting-operating-systems)
- [검색 엔진](#search-engines)
- [방어 보안](#defensive-security)
- [위협 모델링](#threat-modeling)
- [보안 개발](#secure-development)
- [사고 대응](#incident-response)
- [학습 자료](#learning-resources)
- [교육 플랫폼](#training-platforms)
- [치트시트](#cheatsheets)
- [취약점 가이드](#vulnerability-guides)
- [펜테스팅 가이드](#pentesting-guides)
- [YouTube 채널](#youtube-channels)
- [도서](#books)
- [IoT 시리즈](#iot-series)
- [실습 및 CTF](#labs-and-ctfs)
- [취약한 애플리케이션](#vulnerable-applications)
- [CTF 대회](#ctf-competitions)
- [지속적 학습 플랫폼](#continuous-learning-platforms)
- [실습 환경 구축](#lab-setup)
- [연구 및 커뮤니티](#research-and-community)
- [기술 연구](#technical-research)
- [블로그](#blogs)
- [커뮤니티 플랫폼](#community-platforms)
- [Village](#villages)
- [팔로우할 연구자](#researchers-to-follow)
- [기기별 연구](#device-specific-research)
- [TrustZone 및 TEE 연구](#trustzone-and-tee-research)
- [Pwn2Own 연구](#pwn2own-research)
- [MCP / AI 에이전트](#mcp--ai-agent)
- [Bluetooth 리버스 엔지니어링](#bluetooth-reverse-engineering)
## 하드웨어 공격
### 기초
- [IoT 하드웨어 가이드](https://www.postscapes.com/internet-of-things-hardware/)
- [하드웨어 해킹 입문 - 첫 펌웨어 덤프하기](https://web.archive.org/web/2021/https://blog.nvisium.com/intro-to-hardware-hacking-dumping-your-first-firmware)
- [하드웨어 해킹 소개](https://securityboulevard.com/2020/09/an-introduction-to-hardware-hacking/)
- [IoT 보안 분석을 위한 하드웨어 툴킷](https://web.archive.org/web/2020/https://defcon-nn.ru/0x0B/Hardware%20toolkits%20for%20IoT%20security%20analysis.pdf)
- [IoT 디바이스 하드웨어 해킹 - 공격적 IoT 익스플로잇](https://www.infosecinstitute.com/resources/hacking/hardware-hacking-iot-devices-offensive-iot-exploitation/)
### 인터페이스 공격
#### UART
- [UART 인터페이스 식별하기](https://www.mikroe.com/blog/uart-serial-communication)
- [시리얼 터미널 기초](https://learn.sparkfun.com/tutorials/terminal-basics/all)
- [시리얼 포트 리버스 엔지니어링](https://www.devttys0.com/2012/11/reverse-engineering-serial-ports/)
- [임베디드 RE 입문: UBoot을 통한 UART 탐색 및 펌웨어 추출](https://voidstarsec.com/blog/uart-uboot-and-usb)
- [UART를 사용하여 중국산 IP 카메라에 연결하기](https://www.davidsopas.com/using-uart-to-connect-to-a-chinese-ip-cam/)
- [IoT 하드웨어 해킹 여정: UART](https://techblog.mediaservice.net/2019/03/a-journey-into-iot-hardware-hacking-uart/)
- [UART를 통한 펌웨어 접근 및 덤프](https://www.cyberark.com/resources/threat-research-blog/fantastic-rootkits-and-where-to-find-them-part-1)
- [Linksys e1000에서의 UART 연결 및 동적 분석](https://www.youtube.com/watch?v=ix6rSV2Dj44)
#### JTAG
- [하드웨어 해킹 101: JTAG 소개](https://www.riverloopsecurity.com/blog/2021/05/hw-101-jtag/)
- [JTAG 인터페이스를 찾는 방법](https://www.youtube.com/watch?v=_FSM_10JXsM)
- [JTAG 분석하기](https://nse.digital/pages/guides/hardware/jtag.html)
- [OpenOCD를 사용한 Bus Pirate JTAG 연결](https://web.archive.org/web/2020/https://research.kudelskisecurity.com/2014/05/01/jtag-debugging-made-easy-with-bus-pirate-and-openocd/)
- [JTAG를 통한 외부 메모리에서 펌웨어 추출하기](https://www.youtube.com/watch?v=IadnBUJAvks)
- [iPhone Lightning 및 JTAG 해킹에 관한 히치해커 가이드](https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/stacksmashing%20-%20The%20hitchhackers%20guide%20to%20iPhone%20Lightning%20%26%20JTAG%20hacking.pdf)
- [JTAG를 통한 AVR 마이크로컨트롤러 디버깅](https://hev0x.github.io/posts/debugging-avr-with-atmelice-and-gdb/)
#### SWD (Serial Wire Debug)
- [SWD 프로토콜 개요 - HardBreak Wiki](https://www.hardbreak.wiki/hardware-hacking/interface-interaction/jtag-swd/swd)
- [취약점 공개: 하드웨어에서 SWD 공격 표면 탐구하기](https://web.archive.org/web/2024/https://redfoxsec.com/blog/unveiling-vulnerabilities-exploring-swd-attack-surface-in-hardware/)
- [ARM Serial Wire Debug 프로토콜 소개](https://developer.arm.com/documentation/ihi0031/a/The-Serial-Wire-Debug-Port--SW-DP-/Introduction-to-the-ARM-Serial-Wire-Debug--SWD--protocol)
- [Serial Wire Debug 및 CoreSight 아키텍처](https://community.nxp.com/pwmxy87654/attachments/pwmxy87654/imxrt/4786/2/Serial_Wire_Debug.pdf)
- [LibSWD - Serial Wire Debug 오픈 라이브러리](https://github.com/cederom/LibSWD)
- [하드웨어 해킹 및 익스플로잇 부트캠프 - SWD](https://happeningnext.com/event/hardware-hacking-and-exploitation-bootcamp-eid4sntq7lbas1)
#### SPI
- [하드웨어 해킹 101: eMMC 플래시 식별 및 덤프](https://www.riverloopsecurity.com/blog/2020/03/hw-101-emmc/)
- [Bus Pirate - SPI를 사용하여 라우터에서 펌웨어 덤프하기](https://www.iotpentest.com/2019/06/dumping-firmware-from-device-using.html)
- [SPI를 통한 플래시 메모리 추출](https://web.archive.org/web/2023/https://akimbocore.com/article/extracting-flash-memory-over-spi/)
- [임베디드 장치에서 펌웨어 추출하기 (SPI NOR 플래시)](https://www.youtube.com/watch?v=nruUuDalNR0)
- [프로그래머로 라우터의 플래시 칩을 플래싱하는 방법](https://www.youtube.com/watch?v=fbt4OJXJdOc)
- [TPM 2.0: SPI를 통해 Bitlocker 키 추출하기](https://lucasteske.dev/2024/01/tpm2-bitlocker-keys)
#### I2C
- [IoT 보안 파트 16: 하드웨어 공격 표면 I2C](https://payatu.com/masterclass/iot-security-part-16-101-hardware-attack-surface-i2c/)
- [I2C 익스플로잇 - HackTricks](https://book.hacktricks.xyz/todo/hardware-hacking/i2c)
- [비침습적 I2C 하드웨어 트로이 목마 공격 벡터 (PDF)](https://hal.science/hal-03703165/document)
- [하드웨어 해킹: Bus Pirate를 이용한 I2C 인젝션](https://www.rockfishsec.com/2014/09/hardware-hacking-i2c-injection-with-bus.html)
- [SPI, I2C 및 I3C 프로토콜 보호](https://ez.analog.com/ez-blogs/b/engineering-mind/posts/do-your-embedded-systems-safeguard-against-threats-to-spi-i2c-and-i3c)
#### TPM
- [TPM (신뢰할 수 있는 플랫폼 모듈) 소개](https://sergioprado.blog/introduction-to-tpm-trusted-platform-module/)
- [30분 만에 무력화된 신뢰할 수 있는 플랫폼 모듈 보안](https://arstechnica.com/gadgets/2021/08/how-to-go-from-stolen-pc-to-network-intrusion-in-30-minutes/)
### 메모리 추출
#### eMMC
- [eMMC 프로토콜](https://prodigytechno.com/emmc-protocol/)
- [RPMB: eMMC 내부의 비밀 공간](https://sergioprado.blog/rpmb-a-secret-place-inside-the-emmc/)
- [손상된 스마트폰에서 eMMC 데이터 복구](https://dangerouspayload.com/2018/10/24/emmc-data-recovery-from-damaged-smartphone/)
- [스마트홈 기기를 해방하라: 청소 로봇 해킹](https://media.ccc.de/v/34c3-9147-unleash_your_smart-home_devices_vacuum_cleaning_robot_hacking)
- [실전 IoT 해킹: DEF CON 30에서의 Rapid7](https://www.rapid7.com/blog/post/2022/10/18/hands-on-iot-hacking-rapid7-at-def-con-30-iot-village-part-1/)
### 부채널 및 결함 주입
#### 기초
- [부채널 공격 - Yifan Lu](https://yifan.lu/)
- [보안 시스템 구현에 대한 공격](https://github.com/Yossioren/AttacksonImplementationsCourseBook)
- [퍼징, 바이너리 분석, IoT 보안 논문 모음](https://github.com/0xricksanchez/paper_collection)
#### 글리칭 공격
- [Wink Hub에 대한 NAND 글리칭 공격](https://www.brettlischalk.com/posts/nand-glitching-wink-hub-for-root)
- [Crowbar를 이용한 전압 글리칭 튜토리얼](https://chipwhisperer.readthedocs.io/en/latest/tutorials.html)
- [iCEstick 글리처를 이용한 전압 글리칭 공격](https://www.youtube.com/watch?v=FVUhVewFmxw)
- [FPGA 글리칭 및 부채널 공격 - Samy Kamkar](https://www.youtube.com/watch?v=oGndiX5tvEk)
- [하드웨어 전력 글리치 공격 - rhme2](https://www.youtube.com/watch?v=6Pf3pY3GxBM)
- [플래시 속의 키 - Arduino에서 AES 키 글리칭하기](https://srfilipek.medium.com/keys-in-a-flash-3e984d0de54b)
- [실용적인 전기적 글리칭 공격 구현](https://blackhat.com/docs/eu-15/materials/eu-15-Giller-Implementing-Electrical-Glitching-Attacks.pdf)
- [전압 결함 주입 방법](https://www.synacktiv.com/publications/how-to-voltage-fault-injection)
- [글리처 파트 1 - STM32 마이크로컨트롤러에서 재현 가능한 전압 글리칭](https://sec-consult.com/blog/detail/secglitcher-part-1-reproducible-voltage-glitching-on-stm32-microcontrollers/)
- [STM32L05 전압 글리칭](https://blog.syss.com/posts/voltage-glitching-the-stm32l05-microcontroller/)
#### 전력 분석
- [ChipWhisperer로 AES 깨기](https://www.youtube.com/watch?v=FktI4qSjzaE)
- [ChipWhisperer 위키](https://chipwhisperer.readthedocs.io/)
- [Rowhammer 비트 플립으로 암호화 키 탈취하기](https://arstechnica.com/information-technology/2019/06/researchers-use-rowhammer-bitflips-to-steal-2048-bit-crypto-key/)
#### 기타 마이크로컨트롤러
- [Amlogic A113X 부트롬 덤프하기](https://haxx.in/posts/dumping-the-amlogic-a113x-bootrom/)
- [AMLogic A113X TrustZone 익스플로잇 과정 재조명](https://boredpentester.com/retreading-the-amlogic-a113x-trustzone-exploit-process/)
- [알려지지 않은 마이크로컨트롤러 리버스 엔지니어링](https://dmitry.gr/?r=05.Projects&proj=30.%20Reverse%20Engineering%20an%20Unknown%20Microcontroller)
- [USB를 통한 마이크로컨트롤러 펌웨어 해킹](https://securelist.com/hacking-microcontroller-firmware-through-a-usb/89919/)
- [SoC에 구멍이 있다: MediaTek BootROM 글리칭](https://research.nccgroup.com/2020/10/15/theres-a-hole-in-your-soc-glitching-the-mediatek-bootrom/)
### PCIe 및 DMA 공격
- [Windows 초보자를 위한 실전 PCIe 튜토리얼 - 파트 1](https://ctf.re/windows/kernel/pcie/tutorial/2023/02/14/pcie-part-1/)
- [Windows 초보자를 위한 실전 PCIe 튜토리얼 - 파트 2](https://ctf.re/kernel/pcie/tutorial/dma/mmio/tlp/2024/03/26/pcie-part-2/)
- [보안이 적용된 Jetson Nano에 대한 PCIe DMA 공격 (CVE-2022-21819)](https://www.thegoodpenguin.co.uk/blog/pcie-dma-attack-against-a-secured-jetson-nano-cve-2022-21819/)
---
## 무선 프로토콜
### RF 기초
- [소프트웨어 정의 라디오 완전 정복 과정 - Michael Ossmann](https://greatscottgadgets.com/sdr/)
- [무선 이해하기](https://www.taitradioacademy.com/lessons/introduction-to-radio-communications-principals/)
- [소프트웨어 정의 라디오 입문](https://www.allaboutcircuits.com/technical-articles/introduction-to-software-defined-radio/)
- [GNU Radio Companion 입문](https://wiki.gnuradio.org/index.php/Guided_Tutorial_GRC)
- [GNU Radio Companion에서 플로우 그래프 만들기](https://blog.didierstevens.com/2017/09/19/quickpost-creating-a-simple-flow-graph-with-gnu-radio-companion/)
- [433MHz 무선 신호 분석하기](https://www.rtl-sdr.com/analyzing-433-mhz-transmitters-rtl-sdr/)
- [특정 무선 신호 녹음하기](https://www.rtl-sdr.com/freqwatch-rtl-sdr-frequency-scanner-recorder/)
- [Raspberry Pi와 rpitx를 이용한 재전송 공격](https://www.rtl-sdr.com/tutorial-replay-attacks-with-an-rtl-sdr-raspberry-pi-and-rpitx/)
- [자동차 키 포브 신호 리버스 엔지니어링](https://0x44.cc/radio/2024/03/13/reversing-a-car-key-fob-signal.html)
- [GRCON 2021 - Capture the Signal](https://blog.tclaverie.eu/posts/grcon-2021---capture-the-signal/)
### 블루투스 / BLE
#### 기초
- [Awesome Bluetooth Security](https://github.com/engn33r/awesome-bluetooth-security)
- [블루투스 피코넷에서의 트래픽 엔지니어링](https://www.diva-portal.org/smash/record.jsf?pid=diva2%3A833159)
- [BLE 특성: 초보자 튜토리얼](https://devzone.nordicsemi.com/nordic/short-range-guides/b/bluetooth-low-energy/posts/ble-characteristics-a-beginners-tutorial)
- [블루투스 저전력 입문 (PDF)](https://daskalakispiros.com/files/Ebooks/Intro+to+Bluetooth+Low+Energy+v1.1.pdf)
- [블루투스 LE 보안 학습 가이드](https://www.bluetooth.com/bluetooth-resources/le-security-study-guide/)
- [BLE 기기 리버스 엔지니어링](https://reverse-engineering-ble-devices.readthedocs.io/en/latest/)
- [스마트 밴드 리버스 엔지니어링까지의 여정 - Bluetooth-LE RE](https://medium.com/@arunmag/my-journey-towards-reverse-engineering-a-smart-band-bluetooth-le-re-d1dea00e4de2)
#### 익스플로잇 기법
- [Bluetooth LE 익스플로잇 박스로서의 Intel Edison](https://medium.com/@arunmag/intel-edison-as-bluetooth-le-exploit-box-a63e4cad6580)
- [스마트 마사지기 리버스 엔지니어링 및 익스플로잇](https://medium.com/@arunmag/how-i-reverse-engineered-and-exploited-a-smart-massager-ee7c9f21bf33)
- [MiBand 3 해킹](https://medium.com/@yogeshojha/i-hacked-xiaomi-miband-3-and-here-is-how-i-did-it-43d68c272391)
- [Bluetooth Smart 기기 GATT 공격](https://securing.pl/en/gattacking-bluetooth-smart-devices-introducing-a-new-ble-proxy-tool/index.html)
- [August Smart Lock 분석](https://blog.quarkslab.com/examining-the-august-smart-lock.html)
- [BLE GATT 리버스 엔지니어링 실전 입문](https://jcjc-dev.com/2023/03/19/reversing-domyos-el500-elliptical/)
- [MojoBox - 또 하나의 그다지 스마트하지 않은 잠금장치](https://mandomat.github.io/2023-03-15-testing-mojobox-security/)
- [Bluetooth 스마트 잠금장치](https://www.getkisi.com/blog/smart-locks-hacked-bluetooth-ble)
- [Bluetooth 비콘 취약점](https://www.beaconzone.co.uk/blog/category/security/)
- [쾌락의 거부: Flipper Zero로 비일반적 BLE 타깃 공격하기](https://www.whid.ninja/blog/denial-of-pleasure-attacking-unusual-ble-targets-with-a-flipper-zero)
- [그랜드 테프트 오토: BLE 릴레이 공격 엿보기](https://rollingpwn.github.io/BLE-Relay-Aattck/)
- [스마트 조명을 해킹한 방법: CVE-2022-47758](https://pwning.tech/cve-2022-47758/)
#### 취약점 연구
- [Bluetooth에서 버그 찾기](https://bluetooth.lol/)
- [Sweyntooth 취약점](https://asset-group.github.io/disclosures/sweyntooth/)
- [BrakTooth: Bluetooth 링크 관리자에 혼란 초래하기](https://asset-group.github.io/disclosures/braktooth/)
- [BLUFFS: Bluetooth 순방향 및 미래 비밀성 공격 (CVE-2023-24023)](https://github.com/francozappa/bluffs)
- [AirDrop 유출 - Apple 기기에서 BLE 트래픽 스니핑](https://github.com/hexway/apple_bleee)
- [BleedingTooth: Linux Bluetooth 제로클릭 원격 코드 실행](https://google.github.io/security-research/pocs/linux/bleedingtooth/writeup.html)
- [BRAKTOOTH: Bluetooth 링크 관리자에 혼란 초래하기 (PDF)](https://asset-group.github.io/disclosures/braktooth/braktooth.pdf)
- [Norec 공격: Nordic 라이브러리에서 BLE 암호화 제거 (CVE-2020-15509)](https://infosecwriteups.com/norec-attack-stripping-ble-encryption-from-nordics-library-cve-2020-15509-9798ab893b95)
- [BlueDucky - 패치되지 않은 Android에서의 HID 인젝션 (CVE-2023-45866)](https://github.com/pentestfunctions/BlueDucky)
- [Microsoft Bluetooth 드라이버 스푸핑 - CVE-2024-21306](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21306)
- [Bluetooth Auracast / LE Audio 보안 분석](https://www.bluetooth.com/learn-about-bluetooth/recent-enhancements/le-audio/)
#### 컨퍼런스 발표
- [Blue2thprinting: 대체 내가 지금 뭘 보고 있는 거지?](https://darkmentor.com/publication/2023-11-hardweario/)
- [열린 상처: 지난 5년간 Bluetooth는 피 흘리도록 방치되었다](https://darkmentor.com/publication/2023-10-hacklu/)
- [팬데믹 기간 동안 마스크 너머로 Bluetooth 스니핑하기](https://darkmentor.com/publication/2023-08-hitb/)
#### 도구 - 소프트웨어
- [Bluing - Bluetooth 정보 수집](https://github.com/fO-000/bluing)
- [BlueToolkit - Bluetooth Classic 취약점 테스트](https://github.com/sgxgsx/BlueToolkit)
- [btproxy](https://github.com/conorpp/btproxy)
- [hcitool and bluez](https://www.pcsuggest.com/linux-bluetooth-setup-hcitool-bluez)
- [GATT Tool을 이용한 테스트](https://www.jaredwolff.com/blog/get-started-with-bluetooth-low-energy/)
- [crackle - BLE 암호화 크래킹](https://github.com/mikeryan/crackle)
- [bettercap](https://github.com/bettercap/bettercap)
- [GATTacker](https://github.com/securing/gattacker)
- [BTLEjack - BLE 스위스 아미 나이프](https://github.com/virtualabs/btlejack)
- [DEDSEC Bluetooth Exploit](https://github.com/0xbitx/DEDSEC-Bluetooth-exploit)
- [BrakTooth ESP32 PoC](https://github.com/Matheus-Garbelini/braktooth_esp32_bluetooth_classic_attacks)
- [SweynTooth BLE 공격](https://github.com/Matheus-Garbelini/sweyntooth_bluetooth_low_energy_attacks)
- [ESP32 Bluetooth Classic 스니퍼](https://github.com/Matheus-Garbelini/esp32_bluetooth_classic_sniffer)
- [Bluetooth 해킹 모음](https://github.com/zedxpace/bluetooth-hacking-)
#### 도구 - 하드웨어
- [nRF52840 Dongle](https://www.nordicsemi.com/Software-and-tools/Development-Kits/nRF52840-Dongle)
- [Ubertooth One](https://github.com/greatscottgadgets/ubertooth/wiki/Ubertooth-One)
- [CSR 4.0 Bluetooth Dongle](https://www.amazon.in/GENERIC-Ultra-Mini-Bluetooth-Dongle-Adapter/dp/B0117H7GZ6/)
- [ESP32](https://www.espressif.com/en/products/hardware/esp32/overview)
- [Sena UD100](https://web.archive.org/web/2020/http://www.senanetworks.com/ud100-g03.html)
- [ESP-WROVER-KIT](https://www.digikey.in/en/products/detail/espressif-systems/ESP-WROVER-KIT-VB/8544301)
#### 도구
- [ice9-bluetooth-sniffer](https://github.com/mikeryan/ice9-bluetooth-sniffer)
- [InternalBlue - Bluetooth 실험 프레임워크](https://github.com/seemoo-lab/internalblue)
#### 블루투스 커피 머신 해킹
- [GitHub Actions에서 블루투스를 해킹해 커피 내리기 - 파트 1](https://grack.com/blog/2022/12/01/hacking-bluetooth-to-brew-coffee-on-github-actions-part-1/)
- [GitHub Actions에서 블루투스를 해킹해 커피 내리기 - 파트 2](https://grack.com/blog/2022/12/02/hacking-bluetooth-to-brew-coffee-on-github-actions-part-2/)
- [GitHub Actions에서 블루투스를 해킹해 커피 내리기 - 파트 3](https://grack.com/blog/2022/12/04/hacking-bluetooth-to-brew-coffee-on-github-actions-part-3/)
### Zigbee / Z-Wave
#### 기초
- [소개 및 프로토콜 개요](http://www.informit.com/articles/article.aspx?p=1409785)
- [ZigBee 및 Z-Wave 보안 요약](http://www.riverloopsecurity.com/blog/2018/05/zigbee-zwave-part1/)
- [ZigBee 네트워크 해킹](https://www.infosecinstitute.com/resources/hacking/hacking-zigbee-networks/)
#### 익스플로잇
- [Attify Zigbee 프레임워크로 IoT 기기 해킹하기](https://blog.attify.com/hack-iot-devices-zigbee-sniffing-exploitation/)
- [Zigator: Zigbee 지원 스마트 홈의 보안 분석](https://mews.sv.cmu.edu/papers/wisec-20.pdf)
- [Zigator와 GNU Radio를 이용한 Zigbee 보안 분석](https://mews.sv.cmu.edu/research/zigator/testbed-grcon2020-slides.pdf)
- [저비용 ZigBee 선택적 재밍](https://www.bastibl.net/reactive-zigbee-jamming/)
#### 도구 - 소프트웨어
- [Killerbee](https://github.com/riverloopsec/killerbee)
- [ZigDiggity](https://github.com/BishopFox/zigdiggity)
- [Zigator](https://github.com/akestoridis/zigator)
- [Z3sec](https://github.com/IoTsec/Z3sec)
- [zigbear](https://github.com/philippnormann/zigbear)
#### 도구 - 하드웨어
- [ApiMote](https://www.riverloopsecurity.com/projects/apimote/)
- [RaspBee](https://phoscon.de/en/raspbee/)
- [ATUSB IEEE 802.15.4 Adapter](http://shop.sysmocom.de/products/atusb)
- [USRP](https://www.ettus.com/products/)
### LoRa / LoRaWAN
- [LoRaWAN 보안 개요 - Tektelic](https://tektelic.com/expertise/lorawan-security/)
- [LoRaWAN의 보안 취약점](https://www.cyber-threat-intelligence.com/publications/IoTDI2018-LoraWAN.pdf)
- [저전력, 고위험: LoRaWAN 장치에 대한 공격](https://www.trendmicro.com/en_us/research/21/a/Low-Powered-but-High-Risk-Evaluating-Possible-Attacks-on-LoRaWAN-Devices.html)
- [LAF - LoRaWAN 감사 프레임워크](https://github.com/IOActive/laf)
- [ChirpOTLE - LoRaWAN 보안 프레임워크](https://github.com/seemoo-lab/chirpotle)
#### 기초
- [LoRaWAN 보안 조사 - ScienceDirect](https://www.sciencedirect.com/science/article/abs/pii/S2542660520301359)
- [LoRaWAN - Wikipedia](https://en.wikipedia.org/wiki/LoRa)
#### 익스플로잇
- [LoRaWAN을 사용하는 수백만 대의 장치 노출 - SecurityWeek](https://www.securityweek.com/millions-devices-using-lorawan-exposed-hacker-attacks/)
- [LoRaWAN 네트워크를 무조건 신뢰하십니까? - IOActive](https://www.ioactive.com/do-you-blindly-trust-lorawan-networks-for-iot/)
- [LoRaWAN 암호화 키, 쉽게 크래킹 가능 - Threatpost](https://threatpost.com/lorawan-encryption-keys-easy-to-crack-jeopardizing-security-of-iot-networks/152276/)
- [LoPT: LoRa 침투 테스트 도구 (PDF)](https://www.ijitee.org/wp-content/uploads/papers/v8i9S2/I10810789S219.pdf)
#### 도구
- [LoRa Craft - 패킷 가로채기](https://github.com/PentHertz/LoRa_Craft)
- [오픈 소스 LoRaWAN 해킹 도구](https://www.thethingsnetwork.org/forum/t/open-source-tool-for-hacking-auditing-and-monitoring-lorawan-networks/31185)
- [LoRaWAN Hackaday 프로젝트](https://hackaday.com/tag/lorawan/)
### Matter / Thread
#### 기초
- [Matter 표준 - CSA-IoT](https://csa-iot.org/all-solutions/matter/)
- [Matter 프로토콜 Wikipedia](https://en.wikipedia.org/wiki/Matter_%28standard%29)
- [Matter 프로토콜 완전 가이드 2025](https://thinkrobotics.com/blogs/learn/matter-protocol-explained-for-smart-homes-complete-guide-2025)
- [Matter로 스마트 홈 장치를 보호하는 방법](https://www.iot-now.com/2022/07/12/122292-how-to-secure-smart-home-devices-with-the-matter-standard/)
- [Matter를 위한 스마트 홈 장치 솔루션 - DigiCert](https://www.digicert.com/solutions/security-solutions-for-matter-devices)
#### 보안 연구
- [Matter를 사용하는 스마트 홈의 보안 취약점 및 공격 시나리오](https://www.ndss-symposium.org/wp-content/uploads/2024/07/sdiotsec2024-48-paper.pdf)
- [신뢰가 중요하다: Matter 프로토콜의 취약점 발견 - Nozomi](https://www.nozominetworks.com/blog/trust-matters-uncovering-vulnerabilities-in-the-matter-protocol)
- [Matter over Thread 보안](https://sensereo.com/community/matter-over-thread-security-how-safe-is-your-smart-home-network/)
- [IoT 무선 PAN 프로토콜 보안에 대한 최신 동향 검토](https://www.mdpi.com/2073-8994/12/4/579)
- [Matter 스마트 홈 - Krasamo](https://www.krasamo.com/matter-smart-home/)
- [Threadbare: Thread 네트워크에 대한 실용적 공격 (Black Hat USA 2024)](https://www.blackhat.com/us-24/briefings/schedule/#threadbare-practical-attacks-on-thread-networks-39616)
- [Matter 사양 1.3 - Connectivity Standards Alliance](https://csa-iot.org/developer-resource/specifications-download-request/)
- [Thread Group 보안 분석](https://www.threadgroup.org/Portals/0/documents/support/ThreadCommissioningWhitePaper_2120.pdf)
### 셀룰러 (GSM/LTE/5G)
- [Awesome Cellular Hacking](https://github.com/W00t3k/Awesome-Cellular-Hacking/)
- [GSM 보안 입문](http://www.pentestingexperts.com/introduction-to-gsm-security/)
- [레이어 2에서의 LTE 해킹](https://alter-attack.net/)
- [5Ghoul - 5G NR 공격 및 퍼징](https://github.com/asset-group/5ghoul-5g-nr-attacks)
- [MediaTek 베이스밴드의 CSN.1 버그 악용](https://labs.taszk.io/articles/post/mtk_baseband_csn1_exploitation/)
- [SIM 하이재킹](https://sensepost.com/blog/2022/sim-hijacking/)
- [SigPloit - 통신 신호 익스플로잇 프레임워크](https://github.com/SigPloiter/SigPloit)
- [LTE 스니퍼](https://github.com/SysSec-KAIST/LTESniffer)
- [5G NR 재밍, 스푸핑 및 스니핑](https://github.com/aligungr/UERANSIM)
- [LTrack: LTE에서의 은밀한 휴대폰 추적](https://www.usenix.org/conference/usenixsecurity22/presentation/kotuliak)
- [Open5GS - 오픈 소스 5G/4G 코어](https://github.com/open5gs/open5gs)
- [SCAT - 셀룰러용 신호 수집 및 분석 도구](https://github.com/fgsect/scat)
#### 기초
- [GSM 보안 파트 2](https://web.archive.org/web/2020/https://www.ehacking.net/2011/02/gsm-security-2.html)
- [기지국이란 무엇인가](https://en.wikipedia.org/wiki/Base_transceiver_station)
- [SS7 신호 입문](https://www.patton.com/whitepapers/Intro_to_SS7_Tutorial.pdf)
- [SS7 네트워크 아키텍처](https://youtu.be/pg47dDUL1T0)
- [SIGTRAN 입문](https://www.youtube.com/watch?v=XUY6pyoRKsg)
#### 익스플로잇
- [나만의 로그 GSM BTS 구축 방법](https://l33t.gg/how-to-build-a-rogue-gsm-bts/)
- [USRP B200을 이용한 GSM 취약점](https://ieeexplore.ieee.org/document/7581461/)
- [4G (LTE) 네트워크 보안 테스트](https://web.archive.org/web/2018/https://labs.mwrinfosecurity.com/assets/BlogFiles/mwri-44con-lte-presentation-2012-09-11.pdf)
- [SS7/SIGTRAN 평가 사례 연구](https://nullcon.net/website/archives/pdf/goa-2017/case-study-of-SS7-sigtran.pdf)
#### 도구
- [ss7MAPer - SS7 침투 테스트 툴킷](https://n0where.net/ss7-pentesting-toolkit-ss7maper)
- [가짜 BTS 탐지기 (SCL-8521)](https://www.shoghicom.com/fake-bts-detector.php)
### NFC/RFID
- [Awesome RFID/NFC 보안 발표 모음](https://github.com/doegox/awesome-rfid-talks)
- [RFID 디스코드 그룹](https://discord.gg/Z43TrcVyPr)
- [SoK: EMV 비접촉 결제 시스템의 보안](https://arxiv.org/pdf/2504.12812)
- [Tesla Model Y에 대한 NFC 릴레이 공격](https://act-on.ioactive.com/acton/attachment/34793/f-6460b49e-1afe-41c3-8f73-17dc14916847/1/-/-/-/-/NFC-relay-TESlA_JRoriguez.pdf)
### DECT (디지털 향상 무선 통신)
- [DECT 무선 전화의 실시간 도청](https://www.youtube.com/watch?v=MDF1eUvOte0)
---
[Read more](https://github.com/v33ru/awesome-connected-things-sec)