Understanding firmware security… by actually practicing it

A new DVID training to reveal the invisible mistakes that compromise IoT/OT devices

Embedded firmware security is often seen as a field reserved for reverse engineering experts or cryptographers. Yet most compromises do not come from sophisticated attacks, but from simple design flaws found in thousands of industrial and IoT products.

That is exactly what this new DVID training lets you explore: understanding how an attacker can extract secrets from a device without breaking the cryptography, simply by observing, analyzing and applying a reproducible methodology.

A 100% hands-on approach, true to DVID's DNA

In line with our teaching approach — making IoT cybersecurity concrete, accessible and lasting — this module puts participants in front of a real microcontroller, a real firmware and real design mistakes.

As with our other trainings, the goal is clear: learn by doing, not by theorizing.

Participants learn how to:

• analyze an unencrypted firmware,
• interpret a boot sequence and what it reveals,
• spot signs of poor key management,
• understand why encryption can be perfectly implemented… yet completely ineffective,
• audit a binary to find information leaks before going to production.

This approach matches the spirit of our open source platforms: giving people the means to understand, reproduce and fix.

A real-world scenario: when crypto is not the problem

The training relies on an intentionally vulnerable firmware, representative of what is found in the industry.

Without revealing the technical details, participants quickly realize that:

• UART logs left in production can reveal critical information;
• a poorly stored key can make any encryption useless;
• an unprotected firmware exposes the entire internal logic of the device.

The training material states it explicitly: "Three design mistakes made the encryption completely ineffective."

These mistakes are common, sometimes invisible to product teams, but have serious consequences.

An embedded experimentation lab

Just like the open source DVID board, this training turns a simple exercise into a real firmware analysis lab.

Participants work with:

• an ESP32 or an STM32,
• an unencrypted firmware,
• an encrypted data partition,
• standard tools used in companies.

Each step is progressive, measurable and directly applicable in a professional context, following the same logic as our other hands-on modules.

Key takeaways for participants

Beyond the exercise, the training builds essential reflexes:

• never hardcode a key in a firmware;
• avoid debug logs in production;
• protect the firmware itself, not just the data;
• systematically audit binaries before release.

These simple but fundamental best practices are at the heart of modern IoT/OT security.

Who is it for?

This module is designed for teams that design, audit or operate embedded systems:

• firmware engineers,
• IoT/OT architects,
• pentesters,
• security managers,
• product teams who want to build security in from the design stage.

No cryptography background is required: everything is explained, demonstrated and put into practice.

Available now

This training fits naturally into an IoT/OT upskilling path, whether to strengthen an internal team, prepare for a certification or structure a security-by-design approach.

Learn more: https://dvid.eu
Contact us: https://dvid.eu/#contact
Follow our news: https://www.linkedin.com/company/dvid/